Overview
overview
7Static
static
1URLScan
urlscan
1https://www.1337x.to...
windows10-1703-x64
4https://www.1337x.to...
windows7-x64
1https://www.1337x.to...
windows10-1703-x64
4https://www.1337x.to...
windows10-2004-x64
1https://www.1337x.to...
windows11-21h2-x64
1https://www.1337x.to...
android-13-x64
7https://www.1337x.to...
android-10-x64
7https://www.1337x.to...
android-11-x64
7https://www.1337x.to...
android-13-x64
7https://www.1337x.to...
android-9-x86
7https://www.1337x.to...
macos-10.15-amd64
4https://www.1337x.to...
macos-10.15-amd64
4https://www.1337x.to...
debian-12-mipsel
https://www.1337x.to...
debian-12-armhf
https://www.1337x.to...
debian-12-mipsel
https://www.1337x.to...
debian-9-armhf
https://www.1337x.to...
debian-9-mips
https://www.1337x.to...
debian-9-mipsel
https://www.1337x.to...
ubuntu-18.04-amd64
7https://www.1337x.to...
ubuntu-20.04-amd64
7Analysis
-
max time kernel
29s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2024 13:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
android-33-x64-arm64-20240229-en
Behavioral task
behavioral7
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
android-x64-20240221-en
Behavioral task
behavioral8
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
android-x64-arm64-20240221-en
Behavioral task
behavioral9
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
android-33-x64-arm64-20240229-en
Behavioral task
behavioral10
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral11
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
macos-20240410-en
Behavioral task
behavioral12
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
macos-20240410-en
Behavioral task
behavioral13
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral14
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral15
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral16
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral17
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral18
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral19
Sample
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
Malware Config
Signatures
-
Drops file in Windows directory 4 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.1337x.to\ = "50" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\1337x.to\Total = "50" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\1337x.to MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\1337x.to\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 06cbb1659491da01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9254dd5f9491da01 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 47faed5f9491da01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.1337x.to\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "101" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.1337x.to\ = "2" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "2" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7bd5c75f9491da01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\1337x.to\NumberOfSubdomains = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\1337x.to\Total = "147" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
MicrosoftEdgeCP.exepid process 1976 MicrosoftEdgeCP.exe 1976 MicrosoftEdgeCP.exe 1976 MicrosoftEdgeCP.exe 1976 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
MicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 5084 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5084 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5084 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5084 MicrosoftEdgeCP.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exepid process 1360 MicrosoftEdge.exe 1976 MicrosoftEdgeCP.exe 5084 MicrosoftEdgeCP.exe 1976 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
MicrosoftEdgeCP.exedescription pid process target process PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1976 wrote to memory of 352 1976 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/"1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\WTVRE43G\www.1337x[1].xmlFilesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\WTVRE43G\www.1337x[1].xmlFilesize
423B
MD5f647dc4f692e930a0a14c0e3214e213e
SHA14bf2e677e4dcdabb98298cad9008d1250e1f1ecf
SHA256c24f655244c67790941ee2ccbbc7d5e5549d2e136897bc4e1d7591fc3e9a0379
SHA512149d949033dc644fab33540ba2a5c964519e94772877d77386c180fab344f7cb8650cf13176c33952498dd36dc8f7364376fe46dece4bd04efd953ed5f230440
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ULF2HJ2M\favicon[1].icoFilesize
1KB
MD5769362362d52b0cfc3271ecb6dec43fb
SHA19df2439bce4e08d28c14c37cd2f74fc678465b23
SHA2567d524db2f0ca2d20b89f7f197110cb9a5bbaea45b19939dc6e30dc366d20eb61
SHA51262c7afcbc6499babcd062345d95c845818d68645f82f7b19c553a28af906e47b944b591c90797ffd13d0a508dcefd230ad7cc7c23ec3d00af30df2b9c1b1d9ff
-
memory/352-199-0x000002CBE75E0000-0x000002CBE75E2000-memory.dmpFilesize
8KB
-
memory/352-204-0x000002CBE7610000-0x000002CBE7612000-memory.dmpFilesize
8KB
-
memory/352-67-0x000002CBD2EF0000-0x000002CBD2EF2000-memory.dmpFilesize
8KB
-
memory/352-62-0x000002CBD2EA0000-0x000002CBD2EA2000-memory.dmpFilesize
8KB
-
memory/352-180-0x000002CBE7580000-0x000002CBE7582000-memory.dmpFilesize
8KB
-
memory/352-188-0x000002CBE75A0000-0x000002CBE75A2000-memory.dmpFilesize
8KB
-
memory/352-197-0x000002CBE75C0000-0x000002CBE75C2000-memory.dmpFilesize
8KB
-
memory/352-245-0x000002CBE46B0000-0x000002CBE46B2000-memory.dmpFilesize
8KB
-
memory/352-202-0x000002CBE7600000-0x000002CBE7602000-memory.dmpFilesize
8KB
-
memory/352-65-0x000002CBD2ED0000-0x000002CBD2ED2000-memory.dmpFilesize
8KB
-
memory/352-206-0x000002CBE7630000-0x000002CBE7632000-memory.dmpFilesize
8KB
-
memory/352-208-0x000002CBE7650000-0x000002CBE7652000-memory.dmpFilesize
8KB
-
memory/352-210-0x000002CBE7670000-0x000002CBE7672000-memory.dmpFilesize
8KB
-
memory/1360-0-0x000001B1BFC20000-0x000001B1BFC30000-memory.dmpFilesize
64KB
-
memory/1360-282-0x000001B1C6510000-0x000001B1C6511000-memory.dmpFilesize
4KB
-
memory/1360-283-0x000001B1C6520000-0x000001B1C6521000-memory.dmpFilesize
4KB
-
memory/1360-35-0x000001B1C0500000-0x000001B1C0502000-memory.dmpFilesize
8KB
-
memory/1360-16-0x000001B1C0100000-0x000001B1C0110000-memory.dmpFilesize
64KB