7da1fb99de280b8baf392e8d5a62026cf709b202bf78cc74652c3f84c90c929f

Resubmissions

25/04/2024, 08:25

240425-kbmxwaha9x 9

25/04/2024, 08:22

240425-j9jsfaha8w 9

Analysis

max time kernel
114s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Library.exe
Size

4.1MB
MD5

04ed10d94e5cd607770eecc9aee56105
SHA1

f43752eb19d1359efcc90e8b1e7078594beed40c
SHA256

7da1fb99de280b8baf392e8d5a62026cf709b202bf78cc74652c3f84c90c929f
SHA512

ff770a81822005bd0ff9b901cea3fc25d73daf06dafeaebf75cf2ba38841004fae6f6b102e6b34f215d1df5a647c1a398423ed32179ef1bb28b7562fa6036a27
SSDEEP

98304:+80h5vs4SZWnzJgKSF3UPDV/KQBR8rOI4i1q3:pGVs44WntglyCQwAz

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Library.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Library.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Library.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4032-12-0x0000000000530000-0x0000000000E6E000-memory.dmp	themida
behavioral1/memory/4032-13-0x0000000000530000-0x0000000000E6E000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Library.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
70	discord.com
67	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4032	Library.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4084619521-2220719027-1909462854-1000\{75451BFA-0EC0-48DE-B8DB-4230329F1B57}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
2840	msedge.exe
2840	msedge.exe
1528	msedge.exe
1528	msedge.exe
5460	msedge.exe
5460	msedge.exe
4276	identity_helper.exe
4276	identity_helper.exe
5164	msedge.exe
5164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 1528	4032	Library.exe	96
PID 4032 wrote to memory of 1528	4032	Library.exe	96
PID 1528 wrote to memory of 2016	1528	msedge.exe	97
PID 1528 wrote to memory of 2016	1528	msedge.exe	97
PID 4032 wrote to memory of 2632	4032	Library.exe	98
PID 4032 wrote to memory of 2632	4032	Library.exe	98
PID 2632 wrote to memory of 3840	2632	msedge.exe	99
PID 2632 wrote to memory of 3840	2632	msedge.exe	99
PID 4032 wrote to memory of 5092	4032	Library.exe	100
PID 4032 wrote to memory of 5092	4032	Library.exe	100
PID 5092 wrote to memory of 3320	5092	msedge.exe	101
PID 5092 wrote to memory of 3320	5092	msedge.exe	101
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 4456	1528	msedge.exe	102
PID 1528 wrote to memory of 556	1528	msedge.exe	103
PID 1528 wrote to memory of 556	1528	msedge.exe	103
PID 2632 wrote to memory of 3676	2632	msedge.exe	105
PID 2632 wrote to memory of 3676	2632	msedge.exe	105
PID 2632 wrote to memory of 3676	2632	msedge.exe	105
PID 2632 wrote to memory of 3676	2632	msedge.exe	105
PID 2632 wrote to memory of 3676	2632	msedge.exe	105
PID 2632 wrote to memory of 3676	2632	msedge.exe	105
PID 2632 wrote to memory of 3676	2632	msedge.exe	105
PID 2632 wrote to memory of 3676	2632	msedge.exe	105
PID 2632 wrote to memory of 3676	2632	msedge.exe	105
PID 2632 wrote to memory of 3676	2632	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\Library.exe
"C:\Users\Admin\AppData\Local\Temp\Library.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/blammed
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd64946f8,0x7ffdd6494708,0x7ffdd6494718
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3528 /prefetch:8
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2444 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7756902903281611939,2541400959821387722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
    3⤵
    PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://blammed.pro/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdd64946f8,0x7ffdd6494708,0x7ffdd6494718
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12856153197292124790,8117582815787145461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,12856153197292124790,8117582815787145461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/blammedsolutions
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd64946f8,0x7ffdd6494708,0x7ffdd6494718
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,14354749106822643316,3262958122801789231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
dab6edd0f3d6fcd2caab9ba71990a699

SHA1
3e3887e3f6888c47ba472c196b56c7cfd5c834f7

SHA256
eaf6643a1ff8323ba7da7cfc8f003f25b3cb522ab90475ec43a4ce3b61de1d4b

SHA512
e0e5aa61c50e68d954bd5de495f62e0bd87ab7f4a3cb2ae7b3d289af143990bfd02c1af8077513f538226ce4132f3090d4d69397997f6d33eed9883d52790002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
655B

MD5
19be50ec02a07ac12f54c67b793df9e8

SHA1
9163b32c702ae492049914a02d4982fa51d979f1

SHA256
891562abe366502ab81dcbbba6fa4eee2e42ba242eea2b66e3adef84971fb62b

SHA512
4c0fb3a848e941c88aaae6b4a4cf071fbbfbc7994865e1b4e92271f358d100a65a7b2961ba678c1032f4a77a01eabad24828fea21b1e49398629e94d4d0f0c8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0053420666925faa5110732a889f697

SHA1
8bf45d945458cdbe75143da507b90f34880b8418

SHA256
eafdf5fcec6625bc37f5ddd5c40ddc303b9c5f646cb9546599cd7face2e690ab

SHA512
049277b950475cefdc16ca939082afe5cf8181d6b464bac27574fb3d9b7f6ecbf452141356c4e11a6e1c8632badcb562d685d43538a3b681b457b0cc2df78b4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1841359fa303d4236dbfc1fe412fbfc3

SHA1
cc859735a269ad41fc694d10aea16db3d7648bb5

SHA256
7ba59b4377c4a150f91f028db628e13fbb1182b6310b6d3ced9c593229a10ebe

SHA512
29409c0d7e484a05334a584c953638f6e1a27bf8c4af5094ac889d56eb69ba8b3a2a1d3555eaab8476fddeec144b9f0c3aab06fe235c1b1547ec981790f2b689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a2a9bc7a23b86fde7c1734c42b6b88b

SHA1
e17957f281744f9871138f7a604eed48d60995b6

SHA256
de2fdbd368626f9a9dacee5ed8c4185e9d3d23b4ea2f979185630bd6bc20aaca

SHA512
b918592094fdb92d636b1c3b8a759858686141a9bad10fbc7872a7fb6faffd8bd4517ea53399fea3ed843b702bed08a296e4768a3da5c0d0e48a482f41089285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
a847880807f159ca93868346925828bc

SHA1
9d61e8520804ce982dd5b3d1282e37b48ffdb4cb

SHA256
c302d4599f221dfb10daf3f1cb4843af71c06baf5ba07fad84151686e09aff10

SHA512
8a25369aaf85a44a85b4a335d6e95887fa82b01ad421110dc7eb7bd10d477d26ba737b105bf1ff38061de996f8c075bb0d5d76685d8220524fdc5c9b983621d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d745.TMP

Filesize
872B

MD5
6162e92bbc005c306511d8baff9a14f0

SHA1
c582d9cb0ff59ec2384700b632de9c59e70e066e

SHA256
86641861d317a35027233e7d13b5ac6767ceee29aa3a3ff5bb9c0253667a5c19

SHA512
99ff24901e27bfb36ab194648866a0ce29f0fb084abded966a2737a63af0f808ff22f3a72d21fb2887861a5c4a84db23eeea10632e6a79f987722c95d5e571c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b913cae2d0c6dcae7941dd46a92d599e

SHA1
84e7d1736420c252cd13f8d52d3e6cbf4679bff2

SHA256
5c03eaaa3b7e9732c811372550e3608e82d1c2b5a2597d7b5df4cf960db7fe68

SHA512
af85979ba044748bf16f401f9fe100b2c9cd60d08cb4e76de99482761976a674e15fb2abcd061b56b764477a58f220cff15c1ae9e2bab641ad3d7bfbaabb450d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c63bd950f9490d7738494eaa36da88bd

SHA1
6ff83de5a49d997c794fba27cae47c0b50ea00cf

SHA256
17a0cb4a524ab6bde3e6e98d55158fe1af274a60f9443faf4f692c8d2dca718e

SHA512
cf869454e7502fee658fc0dcd534ddd2e0a628ec94ae605f13ff70b9c953546aa22ee59d84a95b348e780a3b85b129d7215be8df9987b3d005178ab6d9d2a7b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b27ae1f57ad6dd3deb4e97d254041e18

SHA1
5402d84a30f538bf4d0bb81fe164b1fab70a57b6

SHA256
8b16b548762a8e64724facf9bb076fba19d5c42aa7e1a521194a8d1a08f1f895

SHA512
10013d6d1f662fb9c095a4dd9544ad3d5027b9565c14156f1c5a4852e8130c89aa18b21e1ec83d067e1888f64857612ea8d2c102ef73c08d3eba5d85159e4d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cec7f463-2414-4d2b-a13c-c9559bfbd7b1.tmp

Filesize
8KB

MD5
642644b440828e28265f14b87769f119

SHA1
b0d6d0f3e641d76271af6c9b11daf6a6d2f1d1ff

SHA256
61c0d516f82d58c1d6671b14a8cf9fc89af96efa428fb2f01582ff6ae3302fe0

SHA512
bfc31e6040c5e89103945f381309a98d02752c3bc1537f1a2f20c5217af3cfb2b0ecc3f63a68dea723c7d3d1e2aec68af422e263f93faa4130de79450592bf46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
c2fa46ffbe2d3379e03c7f8996401706

SHA1
b1cd6896c2923a222963b73b5a689a3523a2d5ff

SHA256
1cbf86f472dbb7eba9061c67313dda4804251c4d5a47d0619ed6acbd07552f0b

SHA512
d1c4c87da3e0e10a2c6224c9200c33dd2c8670b8b3e21b81ca138141aebc50e3442ce1c8170ffcc80d45efbf0e5f0c0a6b70043a7ca1f6f11aea968320d2e4a8

Download Submit
memory/4032-12-0x0000000000530000-0x0000000000E6E000-memory.dmp

Filesize
9.2MB

Download
memory/4032-7-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-22-0x0000000009FD0000-0x000000000A06C000-memory.dmp

Filesize
624KB

Download
memory/4032-17-0x00000000065E0000-0x00000000069B6000-memory.dmp

Filesize
3.8MB

Download
memory/4032-16-0x0000000005B00000-0x0000000005B0A000-memory.dmp

Filesize
40KB

Download
memory/4032-15-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Filesize
584KB

Download
memory/4032-14-0x0000000006030000-0x00000000065D4000-memory.dmp

Filesize
5.6MB

Download
memory/4032-13-0x0000000000530000-0x0000000000E6E000-memory.dmp

Filesize
9.2MB

Download
memory/4032-0-0x0000000000530000-0x0000000000E6E000-memory.dmp

Filesize
9.2MB

Download
memory/4032-164-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-163-0x0000000000530000-0x0000000000E6E000-memory.dmp

Filesize
9.2MB

Download
memory/4032-18-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/4032-9-0x0000000077834000-0x0000000077836000-memory.dmp

Filesize
8KB

Download
memory/4032-227-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-228-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-231-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-8-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-6-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-251-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/4032-5-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-4-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-3-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-2-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download
memory/4032-1-0x0000000077390000-0x0000000077480000-memory.dmp

Filesize
960KB

Download