46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172

Analysis

max time kernel
18s
max time network
13s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2024, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
applecleaner.exe
Size 3.6MB
Sample240413-anpxwsbf4x
SHA256 46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172
MD5 f96eb2236970fb3ea97101b923af4228
SHA1 e0eed80f1054acbf5389a7b8860a4503dd3e184a
SHA512 2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7
SSDEEP 98304:z7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6Ko:e+y4ihkl/Wo/afHPb
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	applecleaner.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3248	netsh.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	applecleaner.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 62004f00320048005300200020002d002000320000000000	applecleaner.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3428-0-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp	themida
behavioral2/memory/3428-2-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp	themida
behavioral2/memory/3428-3-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp	themida
behavioral2/memory/3428-4-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp	themida
behavioral2/memory/3428-5-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp	themida
behavioral2/memory/3428-37-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	applecleaner.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	applecleaner.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3428	applecleaner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemBiosVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "9eba7f7a-f4f50a33-d"	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	applecleaner.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "1945ae9f-84a82b8a-2"	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	applecleaner.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3668	ipconfig.exe
3884	ipconfig.exe
4580	ipconfig.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1052	taskkill.exe
4192	taskkill.exe
3048	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
4824	msedge.exe
4824	msedge.exe
3428	applecleaner.exe
3428	applecleaner.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	4192	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4880	WMIC.exe
Token: SeSecurityPrivilege	4880	WMIC.exe
Token: SeTakeOwnershipPrivilege	4880	WMIC.exe
Token: SeLoadDriverPrivilege	4880	WMIC.exe
Token: SeSystemProfilePrivilege	4880	WMIC.exe
Token: SeSystemtimePrivilege	4880	WMIC.exe
Token: SeProfSingleProcessPrivilege	4880	WMIC.exe
Token: SeIncBasePriorityPrivilege	4880	WMIC.exe
Token: SeCreatePagefilePrivilege	4880	WMIC.exe
Token: SeBackupPrivilege	4880	WMIC.exe
Token: SeRestorePrivilege	4880	WMIC.exe
Token: SeShutdownPrivilege	4880	WMIC.exe
Token: SeDebugPrivilege	4880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4880	WMIC.exe
Token: SeRemoteShutdownPrivilege	4880	WMIC.exe
Token: SeUndockPrivilege	4880	WMIC.exe
Token: SeManageVolumePrivilege	4880	WMIC.exe
Token: 33	4880	WMIC.exe
Token: 34	4880	WMIC.exe
Token: 35	4880	WMIC.exe
Token: 36	4880	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4880	WMIC.exe
Token: SeSecurityPrivilege	4880	WMIC.exe
Token: SeTakeOwnershipPrivilege	4880	WMIC.exe
Token: SeLoadDriverPrivilege	4880	WMIC.exe
Token: SeSystemProfilePrivilege	4880	WMIC.exe
Token: SeSystemtimePrivilege	4880	WMIC.exe
Token: SeProfSingleProcessPrivilege	4880	WMIC.exe
Token: SeIncBasePriorityPrivilege	4880	WMIC.exe
Token: SeCreatePagefilePrivilege	4880	WMIC.exe
Token: SeBackupPrivilege	4880	WMIC.exe
Token: SeRestorePrivilege	4880	WMIC.exe
Token: SeShutdownPrivilege	4880	WMIC.exe
Token: SeDebugPrivilege	4880	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4880	WMIC.exe
Token: SeRemoteShutdownPrivilege	4880	WMIC.exe
Token: SeUndockPrivilege	4880	WMIC.exe
Token: SeManageVolumePrivilege	4880	WMIC.exe
Token: 33	4880	WMIC.exe
Token: 34	4880	WMIC.exe
Token: 35	4880	WMIC.exe
Token: 36	4880	WMIC.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 3740	3428	applecleaner.exe	86
PID 3428 wrote to memory of 3740	3428	applecleaner.exe	86
PID 3740 wrote to memory of 1052	3740	cmd.exe	87
PID 3740 wrote to memory of 1052	3740	cmd.exe	87
PID 3428 wrote to memory of 1504	3428	applecleaner.exe	89
PID 3428 wrote to memory of 1504	3428	applecleaner.exe	89
PID 1504 wrote to memory of 4192	1504	cmd.exe	90
PID 1504 wrote to memory of 4192	1504	cmd.exe	90
PID 3428 wrote to memory of 1108	3428	applecleaner.exe	91
PID 3428 wrote to memory of 1108	3428	applecleaner.exe	91
PID 1108 wrote to memory of 3048	1108	cmd.exe	92
PID 1108 wrote to memory of 3048	1108	cmd.exe	92
PID 3428 wrote to memory of 3736	3428	applecleaner.exe	94
PID 3428 wrote to memory of 3736	3428	applecleaner.exe	94
PID 3736 wrote to memory of 4824	3736	cmd.exe	96
PID 3736 wrote to memory of 4824	3736	cmd.exe	96
PID 4824 wrote to memory of 3592	4824	msedge.exe	98
PID 4824 wrote to memory of 3592	4824	msedge.exe	98
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 4660	4824	msedge.exe	99
PID 4824 wrote to memory of 384	4824	msedge.exe	100
PID 4824 wrote to memory of 384	4824	msedge.exe	100
PID 4824 wrote to memory of 3404	4824	msedge.exe	101
PID 4824 wrote to memory of 3404	4824	msedge.exe	101
PID 4824 wrote to memory of 3404	4824	msedge.exe	101
PID 4824 wrote to memory of 3404	4824	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\applecleaner.exe
"C:\Users\Admin\AppData\Local\Temp\applecleaner.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Battle.net.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://applecheats.cc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://applecheats.cc/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9776f46f8,0x7ff9776f4708,0x7ff9776f4718
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,824492511660828376,114690761823529525,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,824492511660828376,114690761823529525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,824492511660828376,114690761823529525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,824492511660828376,114690761823529525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,824492511660828376,114690761823529525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,824492511660828376,114690761823529525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,824492511660828376,114690761823529525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,824492511660828376,114690761823529525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&1
  2⤵
  PID:2268
- - C:\Windows\system32\netsh.exe
    NETSH WINSOCK RESET
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&1
  2⤵
  PID:4444
- - C:\Windows\system32\netsh.exe
    NETSH INT IP RESET
    3⤵
    PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&1
  2⤵
  PID:4876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall reset
    3⤵
    - Modifies Windows Firewall
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&1
  2⤵
  PID:2216
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV4 RESET
    3⤵
    PID:5056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&1
  2⤵
  PID:4452
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV6 RESET
    3⤵
    PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&1
  2⤵
  PID:3740
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE TCP RESET
    3⤵
    PID:2708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&1
  2⤵
  PID:4156
- - C:\Windows\system32\netsh.exe
    NETSH INT RESET ALL
    3⤵
    PID:232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  PID:4652
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  PID:4972
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&1
  2⤵
  PID:1800
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /FLUSHDNS
    3⤵
    - Gathers network information
    PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&1
  2⤵
  PID:3244
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -R
    3⤵
    PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&1
  2⤵
  PID:4276
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -RR
    3⤵
    PID:1852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -a >nul 2>&1
  2⤵
  PID:2352
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -d >nul 2>&1
  2⤵
  PID:3012
- - C:\Windows\system32\ARP.EXE
    arp -d
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&1
  2⤵
  PID:4600
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775
MD5 48cff1baabb24706967de3b0d6869906
SHA1 b0cd54f587cd4c88e60556347930cb76991e6734
SHA512 fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929
MD5 7b56675b54840d86d49bde5a1ff8af6a
SHA1 fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811
SHA512 11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 137e433ff26f74172c8b114f8c583fc87094b574c2b12f6697ff21d95c5270e9
MD5 31a5382046cdd614de4366045464b2eb
SHA1 eded5c81300815e8652dd3fe3bdcedc331f54069
SHA512 95a992ecd5089928ab36960ac7a3b085b0f2cfb6e27fa4549d1b1fa4c604bb765edabb287aa93eaf601518b051b7bce566d87ca31aedb4bd4645b991c80bcb21
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 555B
SHA256 857a0b7ba6393232792a4ad42de769931d515f29f313e87bc6a8ec086ad278b6
MD5 69fe6a467dda4039a38eaae8f89aef58
SHA1 a58632148a8c6396490a9de8d6bf9f6263b8d028
SHA512 9a67931d00b6b406c6822c9e544ad6b8b20d22c05eda976a6f19647688e62b3d54fefc79ac0d8e75e2410ee1ef487cc1bcc99bdbf4a1475af8e37dd94d640569
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 04101e1d414bd6b926fb58a5b1db3344847750a599d91ff422f244715a92a3da
MD5 36070e9774b442f350598c8f313c1e78
SHA1 bd746ba501f73c1dc083d0633c4073af5c2da1c3
SHA512 0ff6f8fd90832d73be11a87300d6da723451a2ffe8c087d488f995ada9f50c48148e0cc2a6f2a6f2092bdd8ebb61216d47c41a8e258593aa62b84a197be35705
SSDEEP 96:nQMkDIAAu1znR5wpvWMoiLaR5mdeT4u8t1jXSX8eWebLyWQyV+VDCAiEwb:nQMkDIyZR5GWMWuushZerlV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f1b64dd1a67200b9099b3b89686f073db0018f010854c4e39ea89341723215f4
MD5 81bd704c3146d9cf9951ca5a7848b526
SHA1 f5a525f09e381a1e5c26ec83aa87f3cb3f3e5fb6
SHA512 0a438c2c9a8cd78338c9ef7bfb8ab491c3b433bef320ec508f3164ab898ef54e56835dfdcde1ab1b346112a504c547d7dd613486735f747993c88d91c9578e2d
SSDEEP 96:nQMkyNAu1znD5wpvWMoiVmdeHXImeWeyUWQyV+VDCziEwb:nQMkyRZD5GWMX7emro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 52e9db57bc31af850abf0ecf126f364640b1c4b451663b32bb3462fd2fe8ae41
MD5 fc358ca1f18bd006db8621bafe524228
SHA1 150a0be6612b1f3700222b508ec0ab097b7a1416
SHA512 81c19c58af8ddd2482eac45135219dd1e75fca5998251de69a239fa6b2d58b4fb6b9e5d02b5ad51b44b26b65fb7f8f07534a96bb662fe2491239b0285c428d09
SSDEEP 192:PoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup42e2RUgFk91ZoiXs4YwKsB:39iIxuERzA83h09RZxY4YxFcZo4NYwpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3428-5-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp

Download

memory/3428-4-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp

Download

memory/3428-0-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp

Download

memory/3428-37-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp

Download

memory/3428-3-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp

Download

memory/3428-2-0x00007FF6D94D0000-0x00007FF6D9E72000-memory.dmp

Download

memory/3428-1-0x00007FF994F10000-0x00007FF995105000-memory.dmp

Download