hxxps://pastebin[.]com/gU4Zj4SD

Resubmissions

07/05/2024, 19:43

240507-yfk6qsfa24 7

07/05/2024, 19:40

07/05/2024, 19:35

07/05/2024, 19:31

07/05/2024, 19:26

07/05/2024, 19:21

07/05/2024, 19:16

07/05/2024, 19:14

Analysis

max time kernel
192s
max time network
196s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pastebin.com/gU4Zj4SD

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4040	MainWindow.exe
4424	PatBlt.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4820-543-0x0000000000400000-0x00000000004F1000-memory.dmp	upx
behavioral1/memory/4820-574-0x0000000000400000-0x00000000004F1000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	WScript.exe
File opened (read-only)	\??\G:	WScript.exe
File opened (read-only)	\??\I:	WScript.exe
File opened (read-only)	\??\J:	WScript.exe
File opened (read-only)	\??\M:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\B:	WScript.exe
File opened (read-only)	\??\O:	WScript.exe
File opened (read-only)	\??\P:	WScript.exe
File opened (read-only)	\??\S:	WScript.exe
File opened (read-only)	\??\A:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\U:	WScript.exe
File opened (read-only)	\??\W:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\Y:	WScript.exe
File opened (read-only)	\??\E:	WScript.exe
File opened (read-only)	\??\H:	WScript.exe
File opened (read-only)	\??\K:	WScript.exe
File opened (read-only)	\??\L:	WScript.exe
File opened (read-only)	\??\N:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
5	pastebin.com
54	raw.githubusercontent.com
1	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2994005945-4089876968-1367784197-1000\{BEC97971-8BC4-4A51-9D37-BE75F7876883}	WScript.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2994005945-4089876968-1367784197-1000\{A2CC7B8F-35FF-4A58-93E6-511C3CD4F1FC}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Coffin32.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Coffin32 (1).zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
4000	msedge.exe
4000	msedge.exe
1964	msedge.exe
1964	msedge.exe
4644	identity_helper.exe
4644	identity_helper.exe
3796	msedge.exe
3796	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
4384	msedge.exe
4384	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3132	WScript.exe
Token: SeCreatePagefilePrivilege	3132	WScript.exe
Token: 33	4344	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4344	AUDIODG.EXE
Token: SeShutdownPrivilege	3132	WScript.exe
Token: SeCreatePagefilePrivilege	3132	WScript.exe
Token: SeShutdownPrivilege	3132	WScript.exe
Token: SeCreatePagefilePrivilege	3132	WScript.exe
Token: SeShutdownPrivilege	3132	WScript.exe
Token: SeCreatePagefilePrivilege	3132	WScript.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4040	MainWindow.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 4108	4000	msedge.exe	80
PID 4000 wrote to memory of 4108	4000	msedge.exe	80
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 3944	4000	msedge.exe	81
PID 4000 wrote to memory of 1892	4000	msedge.exe	82
PID 4000 wrote to memory of 1892	4000	msedge.exe	82
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83
PID 4000 wrote to memory of 2168	4000	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pastebin.com/gU4Zj4SD
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffde20d3cb8,0x7ffde20d3cc8,0x7ffde20d3cd8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1724 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,16777153517087206368,12283076804701527699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1772

C:\Users\Admin\Downloads\Coffin32\Coffin32.exe
"C:\Users\Admin\Downloads\Coffin32\Coffin32.exe"
1⤵
PID:4820
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\AE47.tmp\AE48.tmp\AE49.vbs //Nologo
  2⤵
  - Modifies registry class
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\AE47.tmp\MainWindow.exe
    "C:\Users\Admin\AppData\Local\Temp\AE47.tmp\MainWindow.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\AE47.tmp\PatBlt.exe
    "C:\Users\Admin\AppData\Local\Temp\AE47.tmp\PatBlt.exe"
    3⤵
    - Executes dropped EXE
    PID:4424
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\AE47.tmp\musicplayer.vbs"
    3⤵
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e027def9b55f3d49cde9fb82beba238

SHA1
64baabd8454c210162cbc3a90d6a2daaf87d856a

SHA256
9816e980b04f1fe7efaa4b9c83ff6a0fdd485ee65a884c001b43a0cad7c39d83

SHA512
a315e1336c5ec70cbb002969e539068ba92f3ec681b6d863db95227fd1808a778fd994e2fb03f28f0e401677aa5f7c66813e315b6b99a5065384c49586f9782e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c5042350ee7871ccbfdc856bde96f3f

SHA1
90222f176bc96ec17d1bdad2d31bc994c000900c

SHA256
b8b1cb139d4d19a85adce0152fa3c4f6adfb73a322d7253820e848c6f82afc1b

SHA512
2efdb535fa6a06c4f9702b2129f2dd07c330e37fd10b492f2236007c660c1707773c22005d1e1fa580dbf633dc1a700ada3b7b611ef9accd9555a17a244f61ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
6.4MB

MD5
8d697ea23e055714d5bf096efc37b1b5

SHA1
aa221717741e679657f4b16735fec9b07e684807

SHA256
2f19bfb87a2f462ece90e7c39de3ac8c7a2e0de5bee29819ec804897b4d1adcf

SHA512
6fa30f004d443ef29d9d69cb105b1b2591668deb0bfb126d854dd89695b7604fc5ed5769433d5b1927d24a4336ef554de661712d5bb4c1a3781b6e242cead402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d15f4c5f0e9e6498041a90889a9d9dc4

SHA1
8b97a8776e28c75ffb0f104b628022df5603038e

SHA256
e3daa73d92e90c6831fc25f930b27651131938eb1ae45034c68d603ab9f1e1f3

SHA512
6db2d6337f02f2bb288f7fdcf2ecefeab699c5e4471364fff2d680695ac97235e98a3cf9be6329dcdb327d8e04845cc4b7b4d79cc77c762aa5550f961c0c270b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d6fc995b1de8644bf5dc8be63bb7083f

SHA1
e0eb793869f0025bed284f375e233750b84ac516

SHA256
91f894c210adaad3a3c3d65b0667552e76b920de36124db968606c39fcc36a53

SHA512
337a6b0d04f24d6d879ff596a9bf8f0fdd8cffc1f61dec9e363f0a6a3b51f17fbcdb8f7ce80afd5e345072298bfaad938b2bb4879d83679880a168b9da0b2025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9204e3b0eb6bddc1727720634594f51a

SHA1
2f660bc9f158c119740093ddad3f7508961fe3f1

SHA256
76f4904d068ec2a8ecb18ee8217fd2228a176ff226e2ab9d161b6c8eae3acd78

SHA512
ec2ab4734ced11aa3ddd468079780a39b8c0c976cc1c0a0dbf4b69dfe432fae771c013ceee9cd6abb5e486b07df4f3289a874e94ba9a055f60e29efa4c3f5c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9522299d0ac7040e38073ae0db54a584

SHA1
c3ac672fae5e3255c01e65049d87a343880a2b54

SHA256
118edbce39753899991742244346caaa21149cdf90e6a0c0c34c4a360ec9f3ed

SHA512
b432c45a4239bc3c0f73fdeab5a26ba65a1b5c29c74516e9e4bcacc0f8f4fe891e733ca854900da74820954fcb4ab2a454e5a1795042e2cffa253e5a76009eb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e06635c3f78c3a1ed5b8af202b02035

SHA1
81ab575170ca80262556df0975c9a04dc711066d

SHA256
c6b5916dcd8a986d6ab78a6e0be675f83e24daa9bf396072e460c238f2fe3e22

SHA512
029e82833640e1aa1c797aab290a92a1ccf1ee881bf3baff8f97ca072893426212c5d7f5d8e0b24087e26c68d8aed5cc00f83333aae86de0ac52237649c28743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0dd1c7f3102a41ad88e954331f5fd8c8

SHA1
c33d8f5dca9aecef70407b6bfbc9eea1c6b0063a

SHA256
78e78da0d98e175c584cc2f26c878ef5a158960659e810dbdb253ed89a900295

SHA512
d190cb3b01cfbc2bc8fa21eb1b9be5019223f5fde3d2db49c7e031bb0863a1cd88db3fa8c2a2f9e71b7606510e29f66819696b7d49f71737530628ebb5a40828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ad3fe8495c8658402e551a96facf817

SHA1
5429e5e2dd45079f641d206dbf1af5fc6248ab04

SHA256
4aadf48ddd71e80bf80022a2ca4bbc108a90ccc12093f5b920eec61c616cfcc0

SHA512
a90b3fca0797fa7d9a98dafa91a523c2005e8f4d2e62174d89c5d4638ad7d62aca4dc0a76ceb69b064aa348d4310fda2a4a1d7e53904628a3732abc8bb4ca590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7935b280e002ad8a641e7a2803a28a10

SHA1
c25a6cdac797ff6072a096fb863ec17069cdc3ad

SHA256
15beba24a3ff2bce164fdf9e6770e8ef4fa49e2b2ed0611856d73f301b65ead4

SHA512
bb4e1ad54ce8c1799f166d375a90819815a940bdf6e6ba8d70fef3b5562c908b3b209bd349f31978348554bfd25cf92d60e30738354261b653a48d125ca147a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fdc68ecce945af0de4bae91c9647e99c

SHA1
4e2d91f0c17fc74f2e75f0094957bd56e1bb1246

SHA256
230b4ce44f427f482bc05d1e821f762a84cdb2b68285456bef3acdf5c5aefd7d

SHA512
b879e5cef9f1cdc2307d675d771c5968f1c467d8a255aa93660dadbefd5f931ff71cc0601f04888e7c42e11004eba83398a1138f1f8bd55697e7692429b81f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d8d9ec4937260b8bc71fb24ef9e9f215

SHA1
625a19095aaf6db7d74e52892e93a95934a92a1a

SHA256
e66d5112bc385a1ef7ed3c6f3e885feed8dab759dc59175c3a001acce053e604

SHA512
9d5bfbdd274224d0b1b6b9a60fcf710cb16370c2ca2a4789c15c161d8f4e968147e2f38fc3a98b77887791356fe8a6531bdec1c95b925ade42e05ec1c66a86ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b517.TMP

Filesize
203B

MD5
72d47c69e6f00eecd4b9824a5326f7ca

SHA1
21bcf29a01ed1c4ec1af95090f2ef37e67cbfd04

SHA256
1114026c633e5d0f6c6dd7e8b24d330b7a59bbc804a1ddd544738ceaa68f134b

SHA512
42d51488638ce17e471d319ece45fe07de074176fd3214eea9d2f46883fb24bfacd7956ab54e1912cceee7cda0d294d071b12838e379808c7c029415ac3895d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e8ed0ffa9faadbd623792e4f675a734b

SHA1
83dd92ea152c8933290e87ac495d60a1fb18d9b9

SHA256
7dc0bdd972d6a17f567fa0db0398078c00576c29b1a21d836afcbc3d96ad9712

SHA512
10df9c9427241a9d7d6223b0239aa648ce016ee4a417798ab9d2644c776888ad2b10b37dfb96e7ab2b5213bed92f37c9cada3f9fdd8bae781b46c72a44af67de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0daadda19e0954348fe795d398b2329e

SHA1
2a5daad610911be9153767695c680f4c13bb777e

SHA256
d7807e36092055067d00b5143dc0045a488cba8450fd620cdce89d35ed5409f7

SHA512
96327c4dd36c5957ab934bba4fc516d3cb0edd3ec5f90bdfc235337800b61b30b2623f24ebef6ff676500632ce3b8feeab5ee136d64db3e99ef72b5d84b300bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
a17fdca98db5367e924ca10e4b648fac

SHA1
bde2d32721f75a344a7fc0460da11515b2f62393

SHA256
870b1a9725784c0fcf65b48eb1cc57e06ee01c9b80746a6162683159a4c4baed

SHA512
b0ab3117742050b62340e708c567c77d788ebdfed28e7bcf41f1a4c495aad8703a2d0f5d650c513b85a72541b15c0493a8345119c4e21c5a12b7ca176651fd31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AE47.tmp\AE48.tmp\AE49.vbs

Filesize
782B

MD5
da508c599810d199e7c353d9a600ba9d

SHA1
ebebfa193d54ccf1241be4f2da92616ab84e2843

SHA256
e51aaeeb3184139f174fd2090e1dd69840347fe3665023d1b82cea35a30e34f8

SHA512
d653c1ef7872447ebbbeb3411f776231f9478e35fa8251f8729b6b28ab22d05ee048dc69d345f59731deaf7cc041c706406e613602f22817e8afe36276589fce

Download Submit
C:\Users\Admin\AppData\Local\Temp\AE47.tmp\Cofdance.mp3

Filesize
406KB

MD5
bc2ac588580df06caf8a3bce22487600

SHA1
e06a4e89e362c79469b457a3f3c51ce64165e54a

SHA256
2cee6b6a1eeb44ed10c6778fa47381bfc9516c34d4386e96bde902d79de950cf

SHA512
f42df72c7cb9cfa23c6e6fe94e8ba1e680414e090e29c36f2cd3b667e452fab4af10817c88ebab1b2869999576b8fb9caad26e5c8b2145c4da20a04e542b247b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AE47.tmp\MainWindow.exe

Filesize
28KB

MD5
e0762f28ed02198f5749edff96628654

SHA1
6e1bf64a092c73e1cd9f561a3020d2eace40f76b

SHA256
47bb487575066212743ab91c15a5cb74ef5602afb688a97323558d04a2641c9b

SHA512
363e9d3afda7c7278fc25606c25f4d0283a248bc89c9bb78d15e8dc6a4f0ebea272766d20791f59539632a4df11657c7ab9d4a1d93c70610a422903c5cb3e4dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\AE47.tmp\PatBlt.exe

Filesize
104KB

MD5
a60c5073545f2e379f835b4f76c760a6

SHA1
5db151b9121a765eb668ac015acc085639d5038a

SHA256
773553334b9b64ed0463d90f77c1eb663f830912ea743490f01835247665ed78

SHA512
8b0ad6a5e780b9c6baa7cf8e40b4115008f44d229b2fe612c41e431da740aea9dcf7a1549d9d97da6ddb2441474ea791dd8c9dbdf718916428826967c275a82c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AE47.tmp\musicplayer.vbs

Filesize
225B

MD5
d7d36bded41044507658fe2dbc18b6ee

SHA1
a0315cee9870bc29ece5004b9bb16bbdc19d3ab6

SHA256
212dcf7ddd19b37ba38100943c50f44c2d2ff349613714ee6b236cee4824a1a9

SHA512
ced62a37ced8e7de67286aaba013a7aadd0bfbd49cf33ba1ae8a7516b18cc0b4c496f8f5e60fca052f2d39a07451766622c837b906026bfb49c09050c25daf39

Download Submit
C:\Users\Admin\Downloads\Coffin32.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/3132-576-0x00000246D06E0000-0x00000246D1212000-memory.dmp

Filesize
11.2MB

Download
memory/3132-591-0x00000246D06E0000-0x00000246D1212000-memory.dmp

Filesize
11.2MB

Download
memory/4424-575-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4820-543-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/4820-574-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download