Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
30/04/2024, 11:29
General
-
Target
2024-04-30_a513b78dbeb8812f596aeb483ee18fff_mafia.exe
-
Size
8.3MB
-
MD5
a513b78dbeb8812f596aeb483ee18fff
-
SHA1
a74578687884801fafdb8f0dc7357ac76e600cf9
-
SHA256
ab189ea48bea31159a35dbc810496a47a3fca3368370a04922967a78bdea4510
-
SHA512
b43cf01048d845bea8d58667df599685176f8255bed5f9a12ef8b2db658be506f54261e10ecc2a86468903b085cd010eafb2790ab3770681c50e939267427cb2
-
SSDEEP
196608:K6eyyDdxk4pCHG9RNQJXz/lU9E+JGeo9T/4erWY+1WXB6:czY4pCHG9RNQbUO4o/lWYCW
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 64 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Kills process with taskkill 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 32 IoCs
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_a513b78dbeb8812f596aeb483ee18fff_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_a513b78dbeb8812f596aeb483ee18fff_mafia.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msiexec.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\smartbar\Installer.msi /quiet2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 46C158A98109F82C495A0ADB6DCE0FEF2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI9C01.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240622750 2 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationStart3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e_sfu0xz.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA22C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA22B.tmp"5⤵
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIA395.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240624546 6 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationRemoveFiles3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIAED1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240627421 73 Smartbar.Installer.CustomActions!Linkury.Installer.CustomActions.CustomActions.InstallationComplete3⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"4⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"4⤵
- Registers COM server for autorun
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"4⤵
- Installs/modifies Browser Helper Object
-
-
C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" /codebase "C:\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"4⤵
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"4⤵
- Modifies registry class
-
-
C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Microsoft.mshtml.dll"4⤵
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"4⤵
-
-
C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe"C:\windows\microsoft.net\Framework64\v2.0.50727\RegAsm.exe" "C:\Users\Admin\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll"4⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe"C:\Users\Admin\AppData\Local\Smartbar\Application\Smartbar.exe"4⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7c3ulrem.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC9E8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC9E7.tmp"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ieku54w7.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB30.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCB2F.tmp"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cpqadejx.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCBBD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCBBC.tmp"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\psix0ynf.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC69.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCC58.tmp"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l0oqnrzs.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD15.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCD14.tmp"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gkgh7eqo.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCDB1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCDB0.tmp"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6gdgd8mj.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE6D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCE6C.tmp"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q2h9jkvp.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF47.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCF46.tmp"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mlp0_klx.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFE4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCFE3.tmp"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1yythvym.cmdline"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD0CE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD0CD.tmp"6⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ynet.co.il/4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe4a946f8,0x7fffe4a94708,0x7fffe4a947185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13271472420706213379,3322700476435103447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:15⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v-4kc_-f.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC7A6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC7A5.tmp"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lq4tl7vi.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB21.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCB20.tmp"5⤵
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD544e85f4a3a33fa519bb67fff1e5a2a3f
SHA1cd20703e3b2de12ed18de4df577b8022884f5f0f
SHA256db8c8298fad294ef3f08f8b40a518206e8ed1a802103615ab2b3c6d8078bf072
SHA5122371e608ae951a285e4ee604b0ffd9c0e016d089a3e764039995065e11b0be2a4c221a9035d60d72e827bcc4a2feb98420725e17a933aeef2d75b59c67242a07
-
Filesize
491B
MD58e28079704db4d073e6c39636eadc0e0
SHA1210a60b4d7139f1779c41babc4c7e7c6b71f26cb
SHA25634462d5da310b13b1000c3ab514350bc17395de96f9bbe4ec161128ca1171b84
SHA512a6bf25f6440d549e2547016f01dd16345fa04655d36b225e87a96bce43195f80d82a1664f001c5ed2db2cd155681ab8cd913834d96e9459ff342012857deff91
-
Filesize
152B
MD51cbd0e9a14155b7f5d4f542d09a83153
SHA127a442a921921d69743a8e4b76ff0b66016c4b76
SHA256243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
SHA51217e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
-
Filesize
152B
MD54e96ed67859d0bafd47d805a71041f49
SHA17806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA256bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
SHA512432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
-
Filesize
6KB
MD5783a9e44702798479061fd778ef6497d
SHA150a0014106de40cc6ab01fa5f75a2c4323d4137a
SHA256cd16296a4bfdea34985220ab2b1908d2cb8bdb7df6338cf994429c69605d5fe8
SHA51221956e94d4691cf7987e8410447ee2c9e94c01888b180c9a4d5761efaba68b678712e8e5581d48e8bf95821312bb23b3e51f33d4b2da8ff6b22b1f9e18851136
-
Filesize
6KB
MD5862fc3f1b1687e193d429ab842a63234
SHA10e82e2e6cc515cd8cb52c52883fde2bfa5431af9
SHA2563790c09304fd640705c07a59ea7c703bf0382db389f7df7ffc20a74d870abce3
SHA512a050e651dd490d995d7cea7be6ef2d26092bffe2e695432e873a1dacce7a1042dd6deadff23c9e8026aa8bc1bacafc54f4ec88018e24c2d5c414721b4534a758
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD524542a0e74871463f584c28daa990cf7
SHA17fe44004aae01912c477654f0627af949a65177c
SHA256bc992c7f20dfb52f7ab859663b995234d341cabc2346962622e9e351b37df697
SHA51210c059aacb4f98b1dc910d6f3f6a5a8a06e74d2955b59b9d2e9d447576b7ae059b03c6cd584c9c529bd7d3900add5209f65d8dab803fa124e4c45eab6938ad36
-
Filesize
12KB
MD502afe6dc961f4498c6876a5e366834a4
SHA17d3b202bf1bb8fadc0c819b9fe9490711b2e1229
SHA25638d819907e0a1742cce76a87ae62cd0d190935b8e69cb090abd281303519f578
SHA512e297bb7c7a9097f822b6baec332699f74a7eb4e07631dec0908fd7565bc088ad21fcc0a5273ce9b1bc1a974938547872789f27297041744a77ce2953ed682151
-
Filesize
4KB
MD5e6ab030a2d47b1306ad071cb3e011c1d
SHA1ed5f9a6503c39832e8b1339d5b16464c5d5a3f03
SHA256054e94c94e34cef7c2fad7a0f3129c4666d07f439bfec39523dca7441a49bd7c
SHA5124cbb002cc2d593bafd2e804cb6f1379187a9cae7d6cc45068fda6d178746420cc90bcd72ba40fc5b8b744170e64df2b296f2a45c8640819aa8b3c775e6120163
-
Filesize
16KB
MD588b0468d9bd76c7c23f0b1d7b7e3a7c2
SHA1c1357cdf8e2ef27419d7577bb47e1bf00d4332d3
SHA256fc1209d341967e2d7b7e51d83a5f34cf49ff58308ffcd3266b8aa9d1f60feaa3
SHA51203672d965fdf5319172492c7169ad3ff9852e40ddc36dba66f7f7fdaf3daf554af0a3a96a989ee7ce41a930c3817808460aff84a44d26ec34f69a7614eb6d475
-
Filesize
2KB
MD54a9459e0b5e0121b3c3a11c3dbbbd28e
SHA196ab18d756c2e6acd4849045a467793b7987f236
SHA256144f5e442df25d9f34127a16f952590cfc118e060a03198934f1f5da5f7edf40
SHA51286ba05da60608808f1e9ccb0d4676aa5f425003aad34367403fdedaee8d883ede476a0a1f8f178df1356bc5578fcdb1ab704e9d38d39e8da19f72ee2923682a7
-
Filesize
1KB
MD58736a294d7874b8c748ea60f45682ffa
SHA1c758e8c09e1563f58fdd28ea350f867e51d92600
SHA256d87487d65506da3e8324ad597dd3aaf6731617fb5edeaf15e00e17509d4fe108
SHA512a1a4ac0024d6679b5768301d40964a1c05828730a25bdd9b5c79c821a6cc52ef72860128fd587867e52a6ef399343c42c304d4bae02a08e0525026ce830ebebf
-
Filesize
68KB
MD57bd63fcd215fc1813a24da055ce47c68
SHA19b4b91f137440d3d966a00846b1f782e8c433a07
SHA256555ef508e7ec207bc7da5c396a8e4fe1902db58c2129f9b842f05eb5b1c0b52b
SHA512f1d2256ca93f90f846ed477d4c4c692ab5e83dce62b0f7f97d721cc72cb2bcc8a8722fe09962622c0413714ddc201a6c66d23eca89f52e48e1a328758a0dc8d8
-
Filesize
383KB
MD50fb00dcd1887e0e1339c630137c422f4
SHA140e83a2b22610e3d718dff15955cca69b54d7d2a
SHA256d9cc21c8899168bbd783d8488405af97f19a18f2402d76683fb3f08733f402c3
SHA51266ba4cc70217ed30f3a5c203e0515025400e03ccd605ab4151ebcaaa078a67c8e9d36d5c7ccbd1883a1a75de5bb5b5c04dff1a975d3e1c0a5cef4eccae4be4a1
-
Filesize
7.0MB
MD5ab3c448a172f887a9a41a98bc37baeb6
SHA14f564531b856433e34755d5f28ed91db09238fb0
SHA256e59bd7fa9ff296101ce04bbdff361af630a4dbe5fa2020d5da11e9ecd8e490fd
SHA512413960883fca3da12fbef69b6501a114fa9f7e9f2e420fc6bca69a8feb19b110745fb22e8709058ac187c13932efb84921e0e31d0adad99ec2f0a6b1d063e6a2
-
Filesize
299KB
MD58b809d7fdef6c276791186b0d97ae839
SHA1ad1202b0578aca08feee0f6937a14ec66fc7d653
SHA256ee7ce728fc421cd33250ad55c5ef0effa3ecc71a0f2ac3b918636dee0f5f84d1
SHA512aef7f1eba4fc8942c67873fd48377bbcfff83aafc0f7a5a32d85df00f13ceada6c60544b57c674b4e9595e7f67ef24f5855b9ce27bdab045fb9502b349f91539
-
Filesize
353KB
MD5fec17d5fb09a03376d3aa204c65562a7
SHA12966508d76523b2c2d28713612b472e7256c66fc
SHA2561e384af4479ba64bd2fa02b00603205c4b0a99a468cfa4cc33cdca7bac845bec
SHA5124e250955a0b6e2a22d41cf24eecc88d3a36de1308c089d8f8ab02beed434f0ed44583f048ca2b436788b7c80ec1c7f0cd79166b3e62d040566c99aa536b9c11e
-
Filesize
968KB
MD550431b75630bbf6b3c245e3c675a90c7
SHA13e99780baa1447056e63bdb677f4d3248e65d855
SHA2564bbcb65193711559141311b1bbcde46471a3836248a96b374c4316e1e0cee161
SHA51262377d84c8db9ef2361db6adc65efd6835405b945156e7680d6c102b4184d5a259dd61ca3822173781ec09d2f2d7784ce62bee256138b0918e01768629257050
-
Filesize
172KB
MD534d4a23cab5f23c300e965aa56ad3843
SHA168c62a2834f9d8c59ff395ec4ef405678d564ade
SHA25627cf8a37f749692ab4c7a834f14b52a6e0b92102e34b85ffcb2c4ee323df6b9c
SHA5127853f1bc1e40c67808da736e30011b3f8a5c19ddf4c6e29b3e0eb458bea2e056fe0b12023ceac7145c948a6635395e466e47bdd6f0cfa1bd7f6a840e31e4694c
-
Filesize
77KB
MD57868ed46c34a1b36bea10560f453598f
SHA172330dac6f8aed0b8fde9d7f58f04192a0303d6b
SHA2565c17864f1572acec1f93cf6355cfd362c1e96236dcba790234985a3f108d8176
SHA5120cc913337e3334ff0653bc1fad044d9df60a8728c233dcc2c7f6139f14608740b70b57c25a9d2d895cbc4d59508779f342a72406e623d30365ae89fb2a3607ba
-
Filesize
12KB
MD55514445cbc6717bc543e993a27b45614
SHA1463fea10195dc9d95c3b185ddc0216154f138843
SHA256515f391b52077e9c54f0dab77b39195378b12be557af43be4d60d078a9c59c2c
SHA5121aceac5534980905717ea30424ef3c8822cec68093ff3dbaf4ea7be52efb2db7f2869bffe5a059c401c50c852d387882233bbba6db544ed77ee81ddd2eb613b8
-
Filesize
126KB
MD56e7e63c2978f2139fc480fa3987c2454
SHA1494c95837404aea3a17f558a70124350cbe0b665
SHA256ef4fbe7fb8ea3db0a6c1d2e3ea85dbdc3b2fe9e203eb4f47f286f9686b70b0c9
SHA5128201f6808cebbf8054fd430605d3f792ccf30816d115cee6087b856d07abb7198a028155113ca66d39a6aaf9c8cf33a40c50e1d40a358050d70a7cac8f8ff097
-
Filesize
7KB
MD5528b6340928ec73f7d3726396e3b8607
SHA136fececd456ed486e83185a39266aaa93d9a3851
SHA256aaecb4c15e8a307714a92d2d962c12b35943058165369140abeda750fdc2bccf
SHA5128cc45713604754832c6f70883f67996564d62e6c41f660fd3c69dd1900c50afa4360b97842c95e9a0fcb39007070549d8bbae069dedd1573511de99b33bf26ef
-
Filesize
72KB
MD5685a150a95abcc23eff7167e45b55eee
SHA17f6f6e6fb67b4eb578598f423ea284e01e12da00
SHA25629feba57a0184ab164d6c5d0195c3b9c1f21e120a5853eee0afc6a66c5ef6a29
SHA512f499ad24337adec2e78a6a4236877b27530d61deaf73cc09263f34c66c0ea84fbcdb057a70dd692c79e1608b69bc8945eff6ee346bb0a4efb3c8c5d4a2f8e703
-
Filesize
61KB
MD55828e61533ad8765e34c8bd5b2684768
SHA1819ca2ba6ceaac7042f0d106f9bbd5b299dea954
SHA256026e85591c1d8f9f6f9103ba5aa1c18ba23c28bd57e56823f4e11ac0abacd4f3
SHA512b5fb79e30c3ca749a5478231ca3bcdfd558db9ef0d87852849b29e6554af305b4eda4f4be9b24e0fd4fa3e371d413f19b0b5f1e1f913b9e31dcb8e5b0b1442c8
-
Filesize
142KB
MD568462e5ccace2103619f9501c7accf51
SHA154e402eef5863227eb1128e17ccfc96bcc1b0c73
SHA256bc31faeea673328c8624334b8d9f699a71221a570043d43f90d1f4672939e776
SHA512162c45d1775e0c77ec6b7c7bbf483142a020193f6f07812e4e48c1686cd791758736d75317f3c796bba30464a92f41fd95c80d8a1d176f13aa7aa6623a13066e
-
Filesize
806B
MD5796621b6895449a5f70ca6b78e62f318
SHA12423c3e71fe5fa55fd71c00ae4e42063f4476bca
SHA25609be5df7a85545fd93d9fd3cd1d6c04c6bfe6e233c68da6f81c49e7a35fcbb84
SHA512081cf1dadb3a0e50f0a31ab03e2b08e80298c06070cd6f9b2806c08d400c07134623f7229a6c99910c6243dfa53c6e2c05d09a497aae1e701bc34b660cf9e4c9
-
Filesize
416B
MD55b7cf489957eb2952242bb4f1163b491
SHA1133454c6f94d74d32b9bdf29ee6cc338c5af3652
SHA256ef44f9f4fa3f70a614b768d0c7781e5d5084a7a86a085264569f0d95f45f7605
SHA51288fe9e04aff1064f42f083be22fa516f1800903df47017b73b311ba506f074fdfc8dbf031693708a758dfccc6035bf8e57910aa735e67b5d018429564f78d5ac
-
Filesize
116KB
MD5459ff9c6762b7fdd91c156ff3e096478
SHA17179debce9a271450b1241e7435a999aea1ddd05
SHA25693865c89e1507409fbbeb9433542a303cdd2fd5acda3d51fecd83e4a8fb8072c
SHA5128b95330d364413122427604af1c0e848694975eb8c541b911aeb0d50fbb5cd15a60863f68593f1088b26f83500f400f52292a2891511223f796be750c6a7583a
-
Filesize
48KB
MD57a5a5de7b05c00821ed6348afff2627b
SHA166f34183d38c9f4da9c9c669bda1149ebe766e97
SHA256ff9d8658fa81697e8f51b105c067996e5aaff2c46cb147667bbcc9fc4929b959
SHA51223730bd76ae297765fa8954affbd71437a7d7bdb5bdf246563a945af353ceca9abd5275d973d8c981fc6ab6d7e25032aab2888f04e33394d95474febee02a0fd
-
Filesize
136KB
MD5cc0611a32becda6d37695f38755a891f
SHA12b987c4cbe8de69b40f4096d424aca5469f90fe5
SHA2569daf27aea3c266457e50501cbaf1485a81c15f2dc51a84609bb5417d286a2769
SHA512bcae75594167257341ac903fbe2a7cb4da6b49044bfaad6bc523f2efcf8aac98a417564d48cdfc57fafa7a74c6a7041b725a7b5112082b499ff2d23d05bcccac
-
Filesize
889KB
MD55b3d3a627813bcef2d7a8651941f2a96
SHA118713ace817081d3b99bb71e01030842345dc750
SHA2562f7e3f285a523b3d918fe8b3cbd3d42d2380835779a1a8b50ccf6bb365a915bc
SHA512fc6754246a071a40bf64d8a66bb7b4f926f031dfe17c25a3e7d37d8421757afad99837f28bf754fb894ca0e19f7b13850557b208b21c4566479619e77cafdff3
-
Filesize
652B
MD5c69a91d8338e903c33dd770b64475cdd
SHA13d43390de94e7f82612b82f64fc031c6a575326e
SHA256f4bdedce26245ea4519c4ff9cbf09152a1d7e3fe9201d9e7d5dafafa0840547f
SHA5129153f29d6f1fcca469d98f1175502285b020cd67c705e172d1d4cef994feb363c9bf8825c7044b68d055a3ccca8ffaf8059f6796d0b7e1a1c3e863956f66f8cb
-
Filesize
144KB
MD580d63b882b411290f39d49cd220b9099
SHA1c045a403ee8e63bf0f745ae71d573371cc5fd547
SHA256588b5a7b7054402f78db94a328401454031310687eb90aa81871d3dc029c9da2
SHA512df6ddc155b36e3440023b3cfe7b6f86aaa8c9a525d2154fc432f4db03068e8ef0734da57fede2606e011d70392b3ae4744ce11387d23267b656eca2028a207bd
-
Filesize
614B
MD5e546e6ae42b4b4786fa021ea77edc503
SHA15cbe6e463fe9f8f66e40ff1fdba49058c7c0a653
SHA2569a0f48304e2ab8476b08663024f785a4ecf7367e6797eae94c31a15e1b6047bc
SHA512f1bb837932c77e4d0441a0b08bed1c6cae313f8cf989819e7fc19a0ffce71191b5f84ff80edf3ee15bc07b47d7cd5f1a9ed6f008d3c9a38d9fc8b81db4fb1463
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
316KB
-
Filesize
624KB
-
Filesize
4.8MB
-
Filesize
96KB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
908KB
-
Filesize
128KB
-
Filesize
152KB
-
Filesize
64KB
