Resubmissions
10/04/2024, 19:04
240410-xrc4tsca3w710/04/2024, 18:53
240410-xjnwcsbf7t710/04/2024, 18:50
240410-xhb56sbf21110/04/2024, 18:40
240410-xbpspabd2s1010/04/2024, 18:37
240410-w9s3bsgb72810/04/2024, 18:37
240410-w9srkabc4x10/04/2024, 18:27
240410-w3qzdsba5v410/04/2024, 18:24
240410-w15d1afh52110/04/2024, 18:13
240410-wtrjkaff78110/04/2024, 18:07
240410-wqcw1aaf4x6Analysis
- max time kernel
442s - max time network
444s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/04/2024, 18:40
Errors
General
- Target sample.html
- Size 18KB
- Sample240410-xbpspabd2s
- SHA256 c7a53cef7508f2abb86996be29a075c2ea63bf09b1bb08e1b1b7a592cf074e60
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 4 IoCs
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Possible privilege escalation attempt 4 IoCs
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 3 IoCs
- Modifies file permissions 1 TTPs 4 IoCs
- Modifies system executable filetype association 2 TTPs 2 IoCs
- Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 37 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Control Panel 4 IoCs
- Modifies data under HKEY_USERS 15 IoCs
- Modifies registry class 15 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 28 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 8 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3bcf46f8,0x7ffa3bcf4708,0x7ffa3bcf47182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5640 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5632 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5772 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5500 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6740558350270307245,3512944941788186451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe"1⤵
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe"1⤵
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\rickroll.exe"1⤵
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe"1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe"1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x150 0x31c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\SkipCompare.ppsm" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\WindowsUpdate.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\WindowsUpdate.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Curfun.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Curfun.exe"1⤵
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\E70C.tmp\E70D.tmp\E70E.vbs //Nologo2⤵
- UAC bypass
- Checks computer location settings
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\E70C.tmp\eulascr.exe"C:\Users\Admin\AppData\Local\Temp\E70C.tmp\eulascr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\1659.tmp\165A.tmp\165B.vbs //Nologo2⤵
- UAC bypass
- Checks computer location settings
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\1659.tmp\eulascr.exe"C:\Users\Admin\AppData\Local\Temp\1659.tmp\eulascr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\27AF.tmp\27B0.tmp\27B1.vbs //Nologo2⤵
- UAC bypass
- Checks computer location settings
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\27AF.tmp\eulascr.exe"C:\Users\Admin\AppData\Local\Temp\27AF.tmp\eulascr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor2.0.7z"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7zO05CF122D\MrsMajor2.0.exe"C:\Users\Admin\AppData\Local\Temp\7zO05CF122D\MrsMajor2.0.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\7429.tmp\742A.vbs3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd\&cd "C:\Users\Admin\AppData\Local\Temp" & eula32.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\eula32.exeeula32.exe5⤵
- Executes dropped EXE
-
-
-
C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\B8C3.bat "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe""5⤵
- Drops file in System32 directory
-
C:\Windows\System32\takeown.exetakeown /f taskmgr.exe6⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\icacls.exeicacls taskmgr.exe /granted "Admin":F6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\System32\takeown.exetakeown /f sethc.exe6⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\icacls.exeicacls sethc.exe /granted "Admin":F6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
-
C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -r -t 54⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3902855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
GetReady.exe
NotMuch.exe
example.txt
eulascr.exe.log
settings.dat
settings.dat
02c6fc1f-6c79-40e9-878d-4ee560dfe670.tmp
115252d8-30c2-42b0-89c8-5305b92afe88.tmp
7aa6baf3-af23-49ec-b346-b0cff82b8f1a.tmp
f_000004
f_000005
f_000006
f_000007
f_000008
f_000009
f_00000a
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe57c515.TMP
CURRENT
Local State
Local State
CurrentDatabase_400.wmdb
9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
WMSDKNS.DTD
WMSDKNS.XML
AgileDotNet.VMRuntime.dll
AgileDotNetRT64.dll
742A.vbs
AppKill.bat
CallFunc.vbs
DgzRun.vbs
breakrule.exe
bsod.exe
checker.bat
clingclang.wav
eula32.exe
excursor.ani
fileico.ico
runner32s.exe
thetruth.jpg
MrsMajor2.0.exe
E70E.vbs
eulascr.exe
xRun.vbs
ccba5a5986c77e43.customDestinations-ms
chilledwindows.mp4
memory/924-792-0x00007FFA28750000-0x00007FFA29211000-memory.dmp
memory/924-718-0x00007FFA28750000-0x00007FFA29211000-memory.dmp
memory/924-796-0x00007FFA28750000-0x00007FFA29211000-memory.dmp
memory/924-735-0x0000000002E80000-0x0000000002E90000-memory.dmp
memory/924-743-0x0000000002E80000-0x0000000002E90000-memory.dmp
memory/924-721-0x0000000002E80000-0x0000000002E90000-memory.dmp
memory/924-717-0x00000000006B0000-0x0000000000B14000-memory.dmp
memory/1276-716-0x0000000000400000-0x0000000000422000-memory.dmp
memory/1692-968-0x00007FFA28C90000-0x00007FFA29751000-memory.dmp
memory/1692-941-0x00007FFA28C90000-0x00007FFA29751000-memory.dmp
memory/1692-946-0x0000000002850000-0x0000000002860000-memory.dmp
memory/1828-1126-0x0000000000380000-0x00000000004BC000-memory.dmp
memory/1828-1128-0x0000000004D90000-0x0000000004E22000-memory.dmp
memory/1828-1125-0x0000000072F60000-0x0000000073710000-memory.dmp
memory/1828-1130-0x0000000004D20000-0x0000000004D2A000-memory.dmp
memory/1828-1127-0x0000000005340000-0x00000000058E4000-memory.dmp
memory/1828-1135-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/1828-1131-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/2460-960-0x00007FFA28C90000-0x00007FFA29751000-memory.dmp
memory/2460-928-0x000000001E360000-0x000000001E888000-memory.dmp
memory/2460-927-0x000000001DC60000-0x000000001DE22000-memory.dmp
memory/2460-926-0x000000001BB80000-0x000000001BB90000-memory.dmp
memory/2460-964-0x000000001BB80000-0x000000001BB90000-memory.dmp
memory/2460-925-0x000000001BB80000-0x000000001BB90000-memory.dmp
memory/2460-917-0x0000000000EE0000-0x0000000000F0A000-memory.dmp
memory/2460-916-0x00007FFA28C90000-0x00007FFA29751000-memory.dmp
memory/2460-970-0x000000001BB80000-0x000000001BB90000-memory.dmp
memory/2872-873-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/2872-882-0x0000000000400000-0x0000000000464000-memory.dmp
memory/2872-878-0x0000000000400000-0x0000000000464000-memory.dmp
memory/3100-713-0x0000000000400000-0x0000000000422000-memory.dmp
memory/3184-815-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-808-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp
memory/3184-855-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-854-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp
memory/3184-852-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp
memory/3184-851-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp
memory/3184-850-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp
memory/3184-824-0x00007FFA07D40000-0x00007FFA07D50000-memory.dmp
memory/3184-823-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-822-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-821-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-820-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-799-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp
memory/3184-800-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-819-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-801-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp
memory/3184-818-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-804-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-817-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-816-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-813-0x00007FFA07D40000-0x00007FFA07D50000-memory.dmp
memory/3184-814-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-812-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-811-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-810-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-856-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-807-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-802-0x00007FFA49DB0000-0x00007FFA49FA5000-memory.dmp
memory/3184-803-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp
memory/3184-806-0x00007FFA09E30000-0x00007FFA09E40000-memory.dmp
memory/3880-714-0x0000000000400000-0x0000000000422000-memory.dmp
memory/4088-966-0x00007FFA28C90000-0x00007FFA29751000-memory.dmp
memory/4088-961-0x000000001B460000-0x000000001B470000-memory.dmp
memory/4088-959-0x000000001B460000-0x000000001B470000-memory.dmp
memory/4088-955-0x00007FFA28C90000-0x00007FFA29751000-memory.dmp
memory/4500-769-0x000000001BC80000-0x000000001BDEA000-memory.dmp
memory/4500-722-0x00000000025E0000-0x00000000025F0000-memory.dmp
memory/4500-739-0x00000000213D0000-0x0000000021408000-memory.dmp
memory/4500-738-0x00000000025E0000-0x00000000025F0000-memory.dmp
memory/4500-737-0x00000000025E0000-0x00000000025F0000-memory.dmp
memory/4500-736-0x0000000020F20000-0x0000000020F28000-memory.dmp
memory/4500-725-0x00000000025E0000-0x00000000025F0000-memory.dmp
memory/4500-740-0x00000000213A0000-0x00000000213AE000-memory.dmp
memory/4500-720-0x00000000025E0000-0x00000000025F0000-memory.dmp
memory/4500-719-0x00007FFA28750000-0x00007FFA29211000-memory.dmp
memory/4500-786-0x00007FFA28750000-0x00007FFA29211000-memory.dmp
memory/5076-869-0x0000000000400000-0x00000000006BC000-memory.dmp
memory/5076-865-0x0000000000C10000-0x0000000000C11000-memory.dmp
memory/5076-863-0x0000000000400000-0x00000000006BC000-memory.dmp
memory/5076-888-0x0000000000C10000-0x0000000000C11000-memory.dmp
memory/5076-864-0x0000000000400000-0x00000000006BC000-memory.dmp