hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n[.]exe

Resubmissions

07/05/2024, 16:42

240507-t7tjzaeh9s10

07/05/2024, 16:12

240507-tnt2dseb4v10

07/05/2024, 16:09

240507-tlvj5sea611

Analysis

max time kernel
456s
max time network
454s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe
Sample240507-tnt2dseb4v

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2412	GoldenEye.exe
1964	TCPSVCS.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
126	raw.githubusercontent.com
127	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	TCPSVCS.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 948938.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{669650f0-f572-4069-8d10-e63d89a91f72}\TCPSVCS.EXE\:SmartScreen:$DATA	GoldenEye.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
116	msedge.exe
116	msedge.exe
2492	identity_helper.exe
2492	identity_helper.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1964	TCPSVCS.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3780	116	msedge.exe	84
PID 116 wrote to memory of 3780	116	msedge.exe	84
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 3128	116	msedge.exe	86
PID 116 wrote to memory of 3128	116	msedge.exe	86
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffabc546f8,0x7fffabc54708,0x7fffabc54718
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3896 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  PID:2412
- - C:\Users\Admin\AppData\Roaming\{669650f0-f572-4069-8d10-e63d89a91f72}\TCPSVCS.EXE
    "C:\Users\Admin\AppData\Roaming\{669650f0-f572-4069-8d10-e63d89a91f72}\TCPSVCS.EXE"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of AdjustPrivilegeToken
    PID:1964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
MD5 62c02dda2bf22d702a9b3a1c547c5f6a
SHA1 8f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA512 a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
MD5 850f27f857369bf7fe83c613d2ec35cb
SHA1 7677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA512 7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9b2d254a27932686bdde2b32eb4bb07862cd568a666b7fcf0ff606365fbad7e6
MD5 ddc1b6598e0ce5b60b20f52d6dd57913
SHA1 a7a8452e15139231bdbde00e21f31562f0a4e72a
SHA512 0ccfb11deaf8b9eab93b44c0afe992f79f64bcc8a6302da931edcd9d7034eae761d446cb706da3a503a0f8e29c6633f23087eb6e6c8da88a333e27efd41dbfb0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 496B
SHA256 159439d953aaa2a0e3226ddb534e5d7c96cf304d4b8e92e62e3c91354526ccdf
MD5 f5efb2cf9219179700770c056a06e17b
SHA1 f821ce0477c2d948f59e90d4e75db6900b1f5f23
SHA512 c8a717e42bd30e0fb9b2cdaca6142f7e048fb8133b0168d0f53748bb60cca6ed5ee6b1d26939f7206b033e307bc000e521a5e399aeee1017d8e5ea7856897a52
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 11335f16400ba7e3951ca775da2de052fa809037606f3124de2e67158ab38cc2
MD5 2f6bd7cb256838154aa08814f5a0c4d6
SHA1 324d4cfe8b18a1cd47bd7a4cad69dcf244b0d4ba
SHA512 057a9256f83d33ada81ef36f9a3cbf30be9fdd349bda18b7eaf1587269f0ebc0f467bb3e98699db143f4f43c538ba02426c3b6fecd23312e44ae4a07675783ab
SSDEEP 96:nzk8j1FWfTwpvWMoiVmde7bkMF0kYYqUWQyV+VD7AiEwb:nzkS/WfTGWMLbk7k2rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a9d3552d2af7691a1395bf6b93ae890547e855bc0e9ca71e11e2e54c0943326d
MD5 5eec43c87362d9ee88db9e062108c81a
SHA1 3f26145ace8458f1410c1e824abcef30a5a10e3e
SHA512 0d8017462d8fcf6d819050f4b0960bc3c02bb2bf39c33549611570542dd1ba8fe2ca86030615b99a4df1408574f66c670c56bff89be6fda0a86958320c4013a3
SSDEEP 96:nzk8sQej1FWfTwpvWMoiVmde7bkMF0kYYcUWQyV+VD7AiEwb:nzkT/WfTGWMLbk7kQrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 863da2b701ce42efd04c0f83a5131d468d417db947be1c8bd91e6d6b34e40f64
MD5 f2d10eb614e1b68d5dbfea156ee0bff3
SHA1 dcf8b8888f6e12d95a0a4b4bed7c8492818ccec7
SHA512 131a868f0520a1544da601562f2645f65a95f9a6dd2aa4281f10770a5a8c53b37245fd0e3aecaf40d4ae2fc7d21d6bf684480c8dc386fb8967c99e8a22bdaed2
SSDEEP 96:nzkbj1N+fTwpvWMoiVmdeHqVqUWQyV+VDCziEwb:nzkfj+fTGWMXZro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3242e39809ccb49bfde5b6141464abf3410066aeb82a56e93fd88cc918f3956b
MD5 2c69bfe98e3d2e911f300265829b8f44
SHA1 0e94e11a064f23b188a873f7017d9166bf536231
SHA512 5becfbdab32a32a465acd48488d31f1373bda9ad222828bcd20cbd4c7d115b1ffaaa48acc81cce478cef07557903833194dd529dc599738bbf2c26c4a429382f
SSDEEP 96:nzk8j1NWfTwpvWMoiVmde/uI1jqvqUWQyV+VD7AiEwb:nzkSjWfTGWMPuIhNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 59ef5ae6027099fc8a008de0685656f079808f4e9204481a799eb7b8e71cedb3
MD5 ac31eb8d64f1313a8d8c0d75b2222833
SHA1 820c5e16510544c443d0eba9c0dd674bb2c308b9
SHA512 4b3a12d93b58be1637d96622441f8eab635909f0334d8c9e1ea3e7ab0fcdbf6b85d664eac11864601a849fa086b0ec9f39f79607bd7d5b6a2baa1a2f0cd15de5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5e1664.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e1664.TMP
Size 874B
SHA256 651e3ff8316f41b131f1ef50a302ae22f9d4c1c32a0504d704046efc7764a6d9
MD5 e4c849f03c598985b29d0d895c2427ba
SHA1 dd1186fbd384f07899dfe27c7656d629c57755e3
SHA512 d8511846d45bf5623ad3a99ecf8e9990b24eb38befd8300bafb4bd04aa764e9f7d9a7a295b3a1f5d5950e11c88288fb8059707deab4961cc5c28005c9bc180e8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5cb3486461312212378f6ed882d8aa9ff78dcb047c54527c85836832e85d8d9f
MD5 96b29cb5b850d7c3914db59819e3b516
SHA1 87d9fcb5bd840af20224aced03964d5cb5094630
SHA512 3da1a95e2b762787f58a7da9a7a6cfd4b33fa6009f8fd32b64d9307d2445ae3658fb2e1274617b2d20100ede17be1a1d64b92f23e1172e875c9aca2709066604
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupX81e2RUUOEVCI+OblfBhD4:A9iIxuERzA83h09RZxYioI/XDafEB+z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4d3707dbf6eb729ecd4f00e6791f821ebe2ce6d14e7f812f42de266937dc6173
MD5 5844e137b860297484626a9036d538de
SHA1 06a1ebf24d607b92edd5f7a5b8ea360645bc4c9d
SHA512 2eb29d3195776ba4bb43bbb43173beb376c616e90adbf01240dfc25fd6f5ab5768203b402d7ae7c9c5b4e80d39a4669dbf5fe03f58072db56279e772ebc9672b
SSDEEP 384:39iIxuERzA83h09RZxY9Lt8yNd/XDafEB+z:sIxuERzA83h09RZxC8yNd/XDa84z
MD5 SHA1 SHA512 SSDEEP

Submit Download

TCPSVCS.EXE

Path C:\Users\Admin\AppData\Roaming\{669650f0-f572-4069-8d10-e63d89a91f72}\TCPSVCS.EXE
Size 255KB
SHA256 abb05ab1a33efe24b4c5370995ec39b5ba5b2eff8fdc7f004edb9d864276582c
MD5 caa4ead7fbb1e3305ca30f0a9e5f1e89
SHA1 fb7d71798c55d1a863e409c17be9bc5bda36299a
SHA512 21b745847c2cb4c6d54bb6467d552d19107c98a5f4e83949871c8ed5762f2db91f42c2e12cd06230fe0efafbcf9196ed3e0fa72be393bfd90ee25af402e5f01f
SSDEEP 3072:uTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3804YgTl:u6nrD0ZMcPBAL7c0fTHs+2srXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 948938.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 948938.crdownload
Size 254KB
SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
MD5 e3b7d39be5e821b59636d0fe7c2944cc
SHA1 00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88
SHA512 8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5
SSDEEP 3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl:i6nrD0ZMcPBAL7c0fTHs+2sYXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads