46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172

Analysis

max time kernel
51s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
applecleaner.exe
Size 3.6MB
Sample240515-w8zhqaec74
SHA256 46fe5192387d3f897a134d29c069ebf39c72094c892134d2f0e77b12b11a6172
MD5 f96eb2236970fb3ea97101b923af4228
SHA1 e0eed80f1054acbf5389a7b8860a4503dd3e184a
SHA512 2fd2d28c5f571d40b43a4dd7a22d367ba42420c29627f21ca0a2052070ffb9f689d80dad638238189eed26ed19af626f47e70f1207e10007041c620dac323cc7
SSDEEP 98304:z7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6Ko:e+y4ihkl/Wo/afHPb
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	applecleaner.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3952	netsh.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 37004f00650048005300200020002d002000650000000000	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	applecleaner.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2784-0-0x00007FF660C90000-0x00007FF661632000-memory.dmp	themida
behavioral2/memory/2784-2-0x00007FF660C90000-0x00007FF661632000-memory.dmp	themida
behavioral2/memory/2784-3-0x00007FF660C90000-0x00007FF661632000-memory.dmp	themida
behavioral2/memory/2784-4-0x00007FF660C90000-0x00007FF661632000-memory.dmp	themida
behavioral2/memory/2784-5-0x00007FF660C90000-0x00007FF661632000-memory.dmp	themida
behavioral2/memory/2784-6-0x00007FF660C90000-0x00007FF661632000-memory.dmp	themida
behavioral2/memory/2784-40-0x00007FF660C90000-0x00007FF661632000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	applecleaner.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	applecleaner.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2784	applecleaner.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	applecleaner.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	applecleaner.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "95db07a4-5cdaa727-9"	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	applecleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "240fa0f8-aa59df33-3"	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	applecleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemBiosVersion	applecleaner.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5400	ipconfig.exe
5544	ipconfig.exe
5572	ipconfig.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1072	taskkill.exe
3028	taskkill.exe
4800	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2784	applecleaner.exe
2784	applecleaner.exe
1964	msedge.exe
1964	msedge.exe
3372	msedge.exe
3372	msedge.exe
4116	identity_helper.exe
4116	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	3028	taskkill.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 4380	2784	applecleaner.exe	84
PID 2784 wrote to memory of 4380	2784	applecleaner.exe	84
PID 4380 wrote to memory of 4800	4380	cmd.exe	85
PID 4380 wrote to memory of 4800	4380	cmd.exe	85
PID 2784 wrote to memory of 5024	2784	applecleaner.exe	88
PID 2784 wrote to memory of 5024	2784	applecleaner.exe	88
PID 5024 wrote to memory of 1072	5024	cmd.exe	89
PID 5024 wrote to memory of 1072	5024	cmd.exe	89
PID 2784 wrote to memory of 1464	2784	applecleaner.exe	91
PID 2784 wrote to memory of 1464	2784	applecleaner.exe	91
PID 1464 wrote to memory of 3028	1464	cmd.exe	92
PID 1464 wrote to memory of 3028	1464	cmd.exe	92
PID 2784 wrote to memory of 2080	2784	applecleaner.exe	105
PID 2784 wrote to memory of 2080	2784	applecleaner.exe	105
PID 2080 wrote to memory of 3372	2080	cmd.exe	106
PID 2080 wrote to memory of 3372	2080	cmd.exe	106
PID 3372 wrote to memory of 3756	3372	msedge.exe	108
PID 3372 wrote to memory of 3756	3372	msedge.exe	108
PID 2784 wrote to memory of 4440	2784	applecleaner.exe	109
PID 2784 wrote to memory of 4440	2784	applecleaner.exe	109
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 388	3372	msedge.exe	110
PID 3372 wrote to memory of 1964	3372	msedge.exe	111
PID 3372 wrote to memory of 1964	3372	msedge.exe	111
PID 3372 wrote to memory of 4940	3372	msedge.exe	112
PID 3372 wrote to memory of 4940	3372	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\applecleaner.exe
"C:\Users\Admin\AppData\Local\Temp\applecleaner.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Checks system information in the registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im Battle.net.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://applecheats.cc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://applecheats.cc/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff271c46f8,0x7fff271c4708,0x7fff271c4718
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16949814601479353699,1203895151855937134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&1
  2⤵
  PID:804
- - C:\Windows\system32\netsh.exe
    NETSH WINSOCK RESET
    3⤵
    PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&1
  2⤵
  PID:3924
- - C:\Windows\system32\netsh.exe
    NETSH INT IP RESET
    3⤵
    PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&1
  2⤵
  PID:5388
- - C:\Windows\system32\netsh.exe
    netsh advfirewall reset
    3⤵
    - Modifies Windows Firewall
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&1
  2⤵
  PID:3992
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV4 RESET
    3⤵
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&1
  2⤵
  PID:1104
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE IPV6 RESET
    3⤵
    PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&1
  2⤵
  PID:5188
- - C:\Windows\system32\netsh.exe
    NETSH INTERFACE TCP RESET
    3⤵
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&1
  2⤵
  PID:4532
- - C:\Windows\system32\netsh.exe
    NETSH INT RESET ALL
    3⤵
    PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  PID:5396
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&1
  2⤵
  PID:5276
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /RELEASE
    3⤵
    - Gathers network information
    PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&1
  2⤵
  PID:3112
- - C:\Windows\system32\ipconfig.exe
    IPCONFIG /FLUSHDNS
    3⤵
    - Gathers network information
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&1
  2⤵
  PID:5584
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -R
    3⤵
    PID:5616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&1
  2⤵
  PID:5600
- - C:\Windows\system32\nbtstat.exe
    NBTSTAT -RR
    3⤵
    PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -a >nul 2>&1
  2⤵
  PID:5684
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -d >nul 2>&1
  2⤵
  PID:5716
- - C:\Windows\system32\ARP.EXE
    arp -d
    3⤵
    PID:5392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&1
  2⤵
  PID:5408
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE
    3⤵
    PID:5432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 ed3aab61ac46b16d80a156462987d95553a6504a4caf59bf887ea94df330d4f4
MD5 2934c7873d6ca47928740a7277bd160e
SHA1 100aa9792fd579420ec76d1784b76c1ce6bf7376
SHA512 c33b45859099525d573b84add3fd1092d594069d27e5c097ad4dfe3e3f37adf7f461accd0f9f78df30b8f7586f71759b6ca953bc94bc28de2a42952f8df44e04
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1020B
SHA256 5c4253fb61feae430aa88a5ccc225d9b3e5bed3f5b4ce379ad22ec40e4bcc915
MD5 12c8315f5e7e4fa75ea6a2b778a4294b
SHA1 a7a6326d5d424acaf7761b8fe68df70938bf7d66
SHA512 e3d15480a499ec5d24ae9e152783be3549f86e697d0ffe184fd485d2c16b2f196636bc65bfb9da6685d7968eba589be38a17e281f3a6bbae304d0b08f47ed339
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a205d4fa9d30bc1f2499744cd30e753e6a7f5ead42b5ff6208c5c757fdc1a5bc
MD5 7af6615b70f3417beea432f33d215cf0
SHA1 fad0a6402566066828abde2f9c1ba7f688de88ef
SHA512 335905a176d9ebca362921d2f7cd0e836688b1a4f23adc87ba87ed13b929cc12bda84f3685087763a229fc95d39bb974cf516c9a7adacef99d3000f921ebcce0
SSDEEP 96:nFkpVi19sBwp8lWMoiVmdeyKuHS1jmelPjUWQyV+VD7AiEwb:nFkpkUBnlWMDuyhpjrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3d8365c27d223397c179f52d60d3bb1be3751872684e3e81112badba3a8e363b
MD5 5c8c67093bf58633942494ee56f4de9c
SHA1 7f79006c503676b91adecab74d70bb2be4ff2331
SHA512 c37cdcf9eb56f581ae22d645baa5032b455b254f27aa6967ed2517cfcbed5d1c6e99da28939c8760d3f8e2532754cdd4ed7cbf1f2b80d655bc2617b3dfa2b9c8
SSDEEP 96:nFkHi19oRwpvWMoiVmdeHm0PjUWQyV+VDCziEwb:nFkCgRGWMXrjro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7c3a9909720116c4efe040f45cec0943422d79219bef7228e4a5182c2056bb17
MD5 a160cd7d060c81de70cdeab247ef2e80
SHA1 7afda6b5ffaafb0c851e349b6e29ebcc7293ac35
SHA512 0142b843dabf50d87123a2dbe26b3efae2512389cdd6ce138c28bfed26680579058ed06e88f83dbc16fb426c8f2962f43061b38a532428c1c0152a91e858c3f4
SSDEEP 96:nFk0Vi19s5wpvWMoiUR5mdeswkjNm8epyWQyV+VD7AiEwb:nFk0kU5GWMUywkpSplg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7a46b43a360339e519ef9acc2483dae8a4818b7a60d84eafd7695fc1c2da0d59
MD5 15b76491be501dc27f2e2bc89c38ec41
SHA1 627e2f42b0329c24715f23ec2bdc69685aa064cd
SHA512 1e407beb050ccf74fe0265e4515862b39d3b56dd45282324514023c5b7c47680e548339b43fb1a93920eaa5b9945bc2c4183513e030789755c23f98aeeb38cae
SSDEEP 192:hoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUxe2RU3ezF+OblfBhDaavM:d9iIxuERzA83h09RZxYSvF/XDafEBLQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9f5ee5ebc33e6640eff7c03e30ec333967a1ba95334dd389c16342861dfbe746
MD5 2158113e3b6313e5b81458434a53c141
SHA1 6ae950e149b9bafc3c6f5f14150c8d7b0c30bd3e
SHA512 9bfcccc888a59f9cdeca79e7e1c2ffb99039c35cabaaa8e02c66db2c17aa9659b700400b495156c1e3cbac74574124f01bacbc8913d28d053ef24799f1dbb44d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUxe2RUjez66B+OblfBhDar:A9iIxuERzA83h09RZxYSZ66/XDafEBLQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2784-4-0x00007FF660C90000-0x00007FF661632000-memory.dmp

Download

memory/2784-40-0x00007FF660C90000-0x00007FF661632000-memory.dmp

Download

memory/2784-0-0x00007FF660C90000-0x00007FF661632000-memory.dmp

Download

memory/2784-3-0x00007FF660C90000-0x00007FF661632000-memory.dmp

Download

memory/2784-6-0x00007FF660C90000-0x00007FF661632000-memory.dmp

Download

memory/2784-2-0x00007FF660C90000-0x00007FF661632000-memory.dmp

Download

memory/2784-5-0x00007FF660C90000-0x00007FF661632000-memory.dmp

Download

memory/2784-1-0x00007FFF45D50000-0x00007FFF45D52000-memory.dmp

Download