metasploit | hxxp://blob[:]hxxps://github[.]com/ebef803d-ff66-416b-b817-29077b40ed1c

Resubmissions

24-04-2024 15:34

240424-sz7wysce91 1

24-04-2024 15:31

240424-sx1pvsce5v 10

24-04-2024 15:26

240424-svmp8acd7y 6

Analysis

max time kernel
173s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 15:31

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-24T15:34:16Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_7-dirty.qcow2\"}"

Report Analysis Logs

General

Target

http://blob:https://github.com/ebef803d-ff66-416b-b817-29077b40ed1c

Score

10^/10

metasploit backdoor bootkit evasion persistence ransomware trojan

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

$uckyLocker.exeGoldenEye.exeCertEnrollCtrl.exe

pid process

4520 $uckyLocker.exe
2236 GoldenEye.exe
1692 CertEnrollCtrl.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

132 raw.githubusercontent.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

CertEnrollCtrl.exe

description ioc process

File opened for modification \??\PhysicalDrive0 CertEnrollCtrl.exe

pid	process
4520	$uckyLocker.exe
2236	GoldenEye.exe
1692	CertEnrollCtrl.exe

flow	ioc
132	raw.githubusercontent.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	CertEnrollCtrl.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

$uckyLocker.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

firefox.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1132431369-515282257-1998160155-1000\{4F262AB8-683A-42A8-8C5C-A04C3A4A7F4D}	msedge.exe

NTFS ADS 3 IoCs

Processes:

msedge.exeGoldenEye.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 30987.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 341824.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{73ab274f-de4e-45ee-844d-e2e5f4adec7f}\CertEnrollCtrl.exe\:SmartScreen:$DATA	GoldenEye.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
4640	msedge.exe
4640	msedge.exe
2732	msedge.exe
2732	msedge.exe
2968	identity_helper.exe
2968	identity_helper.exe
5672	msedge.exe
5672	msedge.exe
5216	msedge.exe
5216	msedge.exe
6780	msedge.exe
6780	msedge.exe
6780	msedge.exe
6780	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

firefox.exeCertEnrollCtrl.exe

description pid process

Token: SeDebugPrivilege 2952 firefox.exe
Token: SeDebugPrivilege 2952 firefox.exe
Token: SeShutdownPrivilege 1692 CertEnrollCtrl.exe

description	pid	process
Token: SeDebugPrivilege	2952	firefox.exe
Token: SeDebugPrivilege	2952	firefox.exe
Token: SeShutdownPrivilege	1692	CertEnrollCtrl.exe

Suspicious use of FindShellTrayWindow 53 IoCs

Processes:

msedge.exefirefox.exe

pid	process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

msedge.exefirefox.exe

pid	process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2952	firefox.exe
2952	firefox.exe
2952	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

2952 firefox.exe

pid	process
2952	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2732 wrote to memory of 1044	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 1044	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 376	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 4640	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 4640	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe
PID 2732 wrote to memory of 3264	2732	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://blob:https://github.com/ebef803d-ff66-416b-b817-29077b40ed1c
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd492f46f8,0x7ffd492f4708,0x7ffd492f4718
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5216
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,15008996952730368738,6012573150130187519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  PID:2236
- - C:\Users\Admin\AppData\Roaming\{73ab274f-de4e-45ee-844d-e2e5f4adec7f}\CertEnrollCtrl.exe
    "C:\Users\Admin\AppData\Roaming\{73ab274f-de4e-45ee-844d-e2e5f4adec7f}\CertEnrollCtrl.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of AdjustPrivilegeToken
    PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:368
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.0.52637466\1292217724" -parentBuildID 20230214051806 -prefsHandle 1752 -prefMapHandle 1744 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac5ff7e6-5162-4ea6-a4e9-11b6b7497335} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 1832 2020fa10258 gpu
    3⤵
    PID:5704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.1.405801938\473259893" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {260001ae-bd7d-4c16-a41d-a7f79782acec} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 2400 20202d8a858 socket
    3⤵
    - Checks processor information in registry
    PID:5440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.2.1714588258\331965861" -childID 1 -isForBrowser -prefsHandle 2664 -prefMapHandle 2828 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb6bf3ae-d2f5-47ed-b700-cf28e6861b6c} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 2804 2020ea96058 tab
    3⤵
    PID:4356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.3.836379811\38231444" -childID 2 -isForBrowser -prefsHandle 3948 -prefMapHandle 3944 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00bde183-b6bb-4297-9067-349bb25ac0d8} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 3960 20202d7ae58 tab
    3⤵
    PID:1628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.4.502114744\1495174419" -childID 3 -isForBrowser -prefsHandle 5216 -prefMapHandle 5228 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51909379-16c0-4f20-9790-b0f2357845fb} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 5240 20216f3d458 tab
    3⤵
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.5.1960323665\801637246" -childID 4 -isForBrowser -prefsHandle 5128 -prefMapHandle 5184 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {271a9de7-b629-46c3-a081-026834405d38} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 5380 20216f3da58 tab
    3⤵
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2952.6.2036289441\2031748393" -childID 5 -isForBrowser -prefsHandle 5572 -prefMapHandle 5580 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe71806d-e9b8-4590-b7f8-112ead59744c} 2952 "\\.\pipe\gecko-crash-server-pipe.2952" 5564 20216f3e058 tab
    3⤵
    PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
8e9fc284c83cda36502be187979db78c

SHA1
6805962b02ce2906b726146421b7727c44331960

SHA256
da86047c63ad5cb0a82f09b26a9a46804a5daf38eb0cba45969c1d2827cf2d55

SHA512
7e5015ae8e4e35e018f7c1757c48e1421df222e8224e9af14fd89efb77793aaad84417d0307a6addfc6220813babcedbd07e54048ed249f7ca819b3f90309b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8578147908be0028d63d8cb60cc312d1

SHA1
a23d42656891edee06cc1d4afea2bdcfa9782520

SHA256
b5297752f4be97756e5b52ebf61cfe61f00a8f7ca8365b85004009e2830006b4

SHA512
431ad5f3b07ab4ae7e005c044a324245d3e42b8f2cd78e71f617ad56c3cdfe4cc7a43e2c3d2de54d31bac99170c618f6ad05aa745e8c709465be75513c4b0a3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4318444459f4faa45568c1aa16038442

SHA1
fe6d66b9e1a58b32841947208abf034d14625386

SHA256
7ca0e95d65709b72e465c367fbf5b6c582f6add0a999f513876f353f0a45a680

SHA512
b41f26aa03a5d961b9ed3c82d38632f93eafd7ab01ea51c80fc3042493142968a54eea9429bde705486297eda4efb3f7319a80803ca8ad42d044f398b34c11d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0882d9e588f65eaab0c901c5c530363f

SHA1
0b2beb36b9ef714de129e6c413ab593f42bf99c0

SHA256
a6cb2c4e05b8bd3f3ba4aa2235af10e03a7a3ee558f25924f04b96051e901788

SHA512
b8b5500df29dcba2ef29b6d7e80a6765280c6b658a1f0a7b6c474c0014047dc9759e1431a02aa8b4f2a59f98f42d18177f0bde5344d88ffee4047c90c3ad2d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
35d7714c919e1746240298fb9dd14812

SHA1
b5138de6811a3adb041234b5b2c1f98652a96fa9

SHA256
300f0029526ca28eaf8f21e2ceb165bb088b6aa5c33a37dc931e517f6b1988f2

SHA512
a4204ff7846744d327b1426a26818beb257bfbdcfa3eb86b9fb4b5524bda2cba545ccdea91b92d1b0cc9bd675e3a6cbb5b614ece078227dd085bc629731ab7b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
83d3f6cb96d6fc1e5e38a946ed983cfa

SHA1
84c471128eede3116c0bc82f62d74d978fe9b3a0

SHA256
494b7e9d8057779452dc50508ed1f1fab2e03fa6953dd946f73a8d757b12bb10

SHA512
6058a832be89a786e830f3a5e66b60b73bdd77c2a8550cb99347d12370c62c6662e1f665e805cb25c814e0302eae4c5385ac698f106f0053e80517a28fc71741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fddd0a10e90b54fe2031e872f71019de

SHA1
dc8856477144858804e33e5ae0e7af7675aebbbe

SHA256
c2786da5cf6e1715506357b73aeceff9842e4fd6a081d507386ad8f28d73b2f9

SHA512
b620427e9f1c5bee79e7918d798e3f10b63d9c6ed36d6cb06a880d2934f2151b45d417e0e7334df64b01321bccfbbca26a5dc4afdc312f62cc1f8ea24aa9bff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ac66f2f419560a947bcf184ccba7005

SHA1
4faa46ce56b2212c834761f1f2476c4868b13df6

SHA256
b59bd08b2aac99cf49f7e43cf017cc8e04e2dfb73b8ad00e8a6c68a185254f46

SHA512
b7b169db4bcd792c433a0a5523af81fca04c2f2701d5dd5ca91bb246dda7439b05c2e5f82e478e001b102f48d6280c741305277c6023e4e68d9a6be4bff5b6d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
427b3186b567ebc449e2213481e27ee4

SHA1
6c632a3609a76d4ac3487f9bcef80dee06f748e5

SHA256
823fa2d194e2ed91e182c98dbce55164db8b438d70491ec8bdd8b1889d8ebb14

SHA512
bb01612b0b11fbd27c37c9f7ee5d1ec25f34fe45c5fdf490cccdf492899296311c81394a9429f8f7768b89b22f8f94ff1cc284ae09e42a4fec710b46385d7fe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c7a4650c50296187db9a5545adad498a

SHA1
8b5a592b520ad8414bf4f824cddd4cf6df0f0446

SHA256
0c0a21c15cf7f89dd972edc80cb23e2fa4ccd408937ac0f07282099f096e6da8

SHA512
74da0613aa996d2ea4d2e37854b3681363d7d2a168cdabe454afb78a9d75fb52dc3463ba37e13918743e8fe4b7129b2463b82c46e614f2e05ba56430d545fcd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8166875309d57dda5d9a553dd29293de

SHA1
b8f523ed4db712bbcde2a39d1a61fb08aaf21cb1

SHA256
278481292cda8c5b20137aacf725536bb3c40bb89d28b1c3b9f3a96e142dcccb

SHA512
4a312473c16b85c25894d91f5f9f2fc50326e3bd2715e7f2930c4db32aa405fc743fda07500f1bb76514f72f6c8d56dbefa8f3001735cace341654699d594f7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7d1f853268c83cab5954cef80f53e1b4

SHA1
907a77e13df79dde6fcae9e592ed4fd5cb666f6f

SHA256
8183d8dd9a5823c84fc6bbbe677b92083987a8a74894a05cb6b907fbb976177d

SHA512
210ac88078e77c1dcf79e15ecb14b8a4bf6804527b15ab35d3c186be5608582f6a2738b2fb49265d3bf0d757f67ffe75a696870389b4c0bd66022b6d069b45c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f3534c2fd91f8516172d8995aefd229e

SHA1
b5af1229cdf127249cf871482e624cc2b0c0929a

SHA256
08e399c332508b77f263b9d08d1ccf16726e1de4a49784c14bc2e0a6ed808f70

SHA512
ef41ea055637710662b5789bea1e6d37637f85efa163005a6a6b781467d51226402a1612133f00642e0ce035a8efa530d287e6b02fa681af92dd3101bed0ee30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59169b.TMP

Filesize
538B

MD5
b50ac0673e48c023e1ccc43d9dddfdd3

SHA1
4270151637109519988a590a25ba14207c236347

SHA256
07d3aabf36263a6f5e4e57e20da0e5392329cdedfc2b234ddaf3ab2c8eae0283

SHA512
e87559b6218a5e8bc910fa15ed07ea7a6112b1db47bbe667e8d61efb74fe3e946d9a4127b5095d463bed1dd296182d5e970a501d84f9bd54dfcfc17565c55ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
30f55e3c8fed6c0cc57bed0d69624474

SHA1
c4f62244fd89f3ef79966f7d8fa303bbcd207ca7

SHA256
dadd76a57f28d1b05db135875140f3a9318d3b6030ca862eb37c143beb342b76

SHA512
c847d16f94896fe4265080ca556ab1b37541df2572063e9e425f3d88388aecc514f47fd9787d4b80236a1f582dd132b0e342246f3610b8331247e57232ce201d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98bbbc05b944bf327b94ad2b2957fa27

SHA1
cc39b084589dad812f6d5d3ee26cd63f3141bcca

SHA256
24d4defdfea4e379d6297dda4e81281c04e260ab9ac73295a9789546c4807716

SHA512
6c17b02a7b102397e76a017bcb9a1e2b80cb6dcbb28655475f6a8356f79141e495e2ca81def6888c7f21adb3b7a0b50d3fcf2be823e96743d97f4a08922cd251

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\activity-stream.discovery_stream.json.tmp

Filesize
24KB

MD5
47bcb3ab53ff6beeeb9c0b3c654051b7

SHA1
c018aea445abe7784f4f3b2d4834861a4c4137ad

SHA256
2745ef6c74a232ef4a6ba937a9f5919a390ce9f56d0125f65042f49c6047d792

SHA512
c08e1ef6f2f349ae880f08fef834ffeba4c87a33058a935bff00301728a497b3b5196e8fb9d05364b118d0f9aa0759a119657b8a63f43c3f59b096c80eeff404

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
6KB

MD5
3bc4a6f8aab385a3ea8ea7607b79ab46

SHA1
7c8fdc0da559123622198c8d64f7a4aa6e01b013

SHA256
60724a1bb0f48fdae1ca8299217f554098dfb4478079105befbb45f99864fcfb

SHA512
24c0452a259e2b21ca3322a5802af50276a187dcdce6388184d2d7787e96dde4c7de6e3bec9fb0b6d3866268d0357d6bbd65c64ca7a7ad4baf341402c4f155e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
6KB

MD5
1fc736b3346fe43deadd83d4aab0c413

SHA1
7bd7723cd93dfcd524c89084f3dce189fa43ee6e

SHA256
db40d72993b98edd094862eeee60ab4460a96a33e5f89be92322dc5bdf56dd84

SHA512
66e908ab475d50906a3a62a0e0cea1aa05a6c0415553207a9674fc00d0cf21bd862b88ff2de6a3ed6749947c33ca45bd63feda40c8116e535bf4c9ff59da1aae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore.jsonlz4

Filesize
902B

MD5
205f3f2388e7bd74745c667f8ec0b950

SHA1
34aacce1819af8bf97ec9b9f6955818481d2e316

SHA256
935b2e6ec20d715de0cec51d17d02c671f8922956f7436a8be288dce602c9c73

SHA512
50265468b310096ad3b72f86811bfd1003301736bc8042c3978bf3a3c972c88512f2c318f20159c629a7b88a64b10b09b38eb3da928a1ce9e98f1043fd66b0fb

Download Submit
C:\Users\Admin\AppData\Roaming\{73ab274f-de4e-45ee-844d-e2e5f4adec7f}\CertEnrollCtrl.exe

Filesize
255KB

MD5
b769beb9c07d40f326f312a8a7f24bae

SHA1
0e923fa0804d4a2c115f5f642fc36758b3bca3ac

SHA256
bf924a557551501c08d6b385d3c8e0211029ecd95f05790c56f381fae317efe3

SHA512
37b23e2c5142dbe57e3ba8023f7150344e405e50143aa53a9a3e80cb09e115f63ad06e83a1c067e7f431877b518ec9ea3bfdb7379aef0363d488f7041aed7e61

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 30987.crdownload

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 341824.crdownload

Filesize
254KB

MD5
e3b7d39be5e821b59636d0fe7c2944cc

SHA1
00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88

SHA256
389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97

SHA512
8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

Download Submit
\??\pipe\LOCAL\crashpad_2732_NKGURCYEPLUUEQQU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1692-704-0x00000000006E0000-0x00000000006FA000-memory.dmp

Filesize
104KB

Download
memory/2236-702-0x0000000000A20000-0x0000000000A3A000-memory.dmp

Filesize
104KB

Download
memory/2236-692-0x0000000000A20000-0x0000000000A3A000-memory.dmp

Filesize
104KB

Download
memory/2236-691-0x0000000000A00000-0x0000000000A16000-memory.dmp

Filesize
88KB

Download
memory/4520-436-0x0000000004E10000-0x0000000004E1A000-memory.dmp

Filesize
40KB

Download
memory/4520-432-0x0000000074A70000-0x0000000075220000-memory.dmp

Filesize
7.7MB

Download
memory/4520-431-0x0000000000210000-0x000000000027E000-memory.dmp

Filesize
440KB

Download
memory/4520-434-0x0000000004C80000-0x0000000004D12000-memory.dmp

Filesize
584KB

Download
memory/4520-433-0x0000000005150000-0x00000000056F4000-memory.dmp

Filesize
5.6MB

Download
memory/4520-435-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4520-472-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4520-504-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4520-503-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4520-500-0x0000000074A70000-0x0000000075220000-memory.dmp

Filesize
7.7MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads