nanocore | hxxps://download1510[.]mediafire[.]com/7xh1iwhnefsgFMOAMlRJHc7UxyZLh5B9iQTsUls5Hih7-h5ffMxA5z7k0V5y5iRtV0qhy9qFNVIqahJart6-j07_zTwQJI0pssc5PEr_9J2O3vI3kcP4urmi9vd1wZ_efW2EW17eXZzeh3YfQe-hGJh675hrzMM4mFLQE7pbGbhmXZI/jxfvbr368ajrrw8/AHAH[.]exe

Analysis

max time kernel
505s
max time network
502s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download1510.mediafire.com/7xh1iwhnefsgFMOAMlRJHc7UxyZLh5B9iQTsUls5Hih7-h5ffMxA5z7k0V5y5iRtV0qhy9qFNVIqahJart6-j07_zTwQJI0pssc5PEr_9J2O3vI3kcP4urmi9vd1wZ_efW2EW17eXZzeh3YfQe-hGJh675hrzMM4mFLQE7pbGbhmXZI/jxfvbr368ajrrw8/AHAH.exe

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Downloads MZ/PE file

Executes dropped EXE 24 IoCs

Processes:

AHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exeAHAH.exe

pid	process
5988	AHAH.exe
5140	AHAH.exe
5316	AHAH.exe
5388	AHAH.exe
3600	AHAH.exe
2280	AHAH.exe
804	AHAH.exe
1712	AHAH.exe
4992	AHAH.exe
5428	AHAH.exe
5488	AHAH.exe
5536	AHAH.exe
5564	AHAH.exe
5580	AHAH.exe
5092	AHAH.exe
2244	AHAH.exe
3656	AHAH.exe
5440	AHAH.exe
3900	AHAH.exe
5668	AHAH.exe
5800	AHAH.exe
4576	AHAH.exe
3432	AHAH.exe
3312	AHAH.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

AHAH.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisvc.exe"	AHAH.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

AHAH.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AHAH.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AHAH.exe

Drops file in Program Files directory 3 IoCs

Processes:

AHAH.exe

description	ioc	process
File created	C:\Program Files (x86)\DPI Service\dpisvc.exe	AHAH.exe
File opened for modification	C:\Program Files (x86)\DPI Service\dpisvc.exe	AHAH.exe
File created	C:\Program Files (x86)\DPI Service\dpisvc.exe\:SmartScreen:$DATA	AHAH.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exeAHAH.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 582933.crdownload:SmartScreen	msedge.exe
File created	C:\Program Files (x86)\DPI Service\dpisvc.exe\:SmartScreen:$DATA	AHAH.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeAHAH.exetaskmgr.exe

pid	process
4880	msedge.exe
4880	msedge.exe
2576	msedge.exe
2576	msedge.exe
908	identity_helper.exe
908	identity_helper.exe
5852	msedge.exe
5852	msedge.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
5988	AHAH.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AHAH.exe

pid process

5988 AHAH.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

AHAH.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	5988	AHAH.exe
Token: SeDebugPrivilege	1044	taskmgr.exe
Token: SeSystemProfilePrivilege	1044	taskmgr.exe
Token: SeCreateGlobalPrivilege	1044	taskmgr.exe
Token: 33	1044	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1044	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe
1044	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2576 wrote to memory of 3188	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 3188	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 1372	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4880	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4880	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe
PID 2576 wrote to memory of 4588	2576	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download1510.mediafire.com/7xh1iwhnefsgFMOAMlRJHc7UxyZLh5B9iQTsUls5Hih7-h5ffMxA5z7k0V5y5iRtV0qhy9qFNVIqahJart6-j07_zTwQJI0pssc5PEr_9J2O3vI3kcP4urmi9vd1wZ_efW2EW17eXZzeh3YfQe-hGJh675hrzMM4mFLQE7pbGbhmXZI/jxfvbr368ajrrw8/AHAH.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa270646f8,0x7ffa27064708,0x7ffa27064718
2⤵
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
2⤵
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
2⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
2⤵
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5960 /prefetch:8
2⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
2⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6484 /prefetch:8
2⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5852

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5988

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5140

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5316

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5388

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:3600

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:2280

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:804

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:1712

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:4992

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5428

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5488

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5536

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5564

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5580

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5092

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:2244

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:3656

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5440

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:3900

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5668

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
2⤵
- Executes dropped EXE
PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
2⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
2⤵
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
2⤵
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
2⤵
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6458363204004102781,5848575548628926867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
2⤵
PID:5332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5424

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
1⤵
- Executes dropped EXE
PID:4576

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
1⤵
- Executes dropped EXE
PID:3432

C:\Users\Admin\Downloads\AHAH.exe
"C:\Users\Admin\Downloads\AHAH.exe"
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\AHAH.exe.log
Filesize
496B

MD5
5b4789d01bb4d7483b71e1a35bce6a8b

SHA1
de083f2131c9a763c0d1810c97a38732146cffbf

SHA256
e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6

SHA512
357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c5fa8ae0f00e4fce5b982e020361064b

SHA1
054d0cc65d36b57de5f505e6c6fcb829c13c0983

SHA256
ffe0ecd370f1ab10a4f9d2ab77c61d00395f3eb6ac0d5f98066ea7b20e7d201d

SHA512
d0ace1d790abfcfe949f2d01f196b85b0cbef4d21001b82145c63ee319ff1947e0af09f0ff93cb5b8422d594330eef6e7f6ed05825036b858951267fec922b2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5e63adf041eb2fbafab65837eb513bc4

SHA1
582caa40e36ebbafdd46ac9ca615fc19f3447c86

SHA256
687abbaa18f89c3c569df63255e3c95a7288ba3a9cbe30be71eb50128544e234

SHA512
adecb9d27a07f497451aead467ae4eaf38dec2948a8bf0af02d8713ca0e841c7ac8e6a808922b3df0924be90c20a851133d68da175ed656205d2ba9bb7ee1c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b18ad8860d17b419c8f6acff98f29fa5

SHA1
625231669109e9c5dd0cb962adc0f29bdcab223d

SHA256
a0b5473aafc70986d8875f91236497fdc35df7a5fcebd7174abdec3756831ecd

SHA512
416558b62a92da636a9281d3c775847906b73bf2fd88186e918d9b06b1bdb3b873a29fdcdeaf4d2b775783756c1dbb05a0a6711b12f437c33a40022657af548a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
0cfde4298df97dcb876d2472a931fcbb

SHA1
3e48ff0d4ae56beb26ec25dfb88921f501ccdab1

SHA256
aa218efe97cf5898287d53703de70c20e836f0022fb4aaf1741f5844e9de0009

SHA512
097a4b49c88bad676d6fd3223125e64aa3d2d43ebbcff22ef07fc6c321686cf88f56bd41c1cd4a4887797007f6b1d476d41b35799970054ea9a2f8a05d96bfbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
bbd1a85d0a5635517d0edcaffac1741f

SHA1
5522dd8ee1d6f97241d348c8a03175defe085fad

SHA256
22d4c245a4ddb203dad0fd97e5a64f837da72abc9384cf8fa4e5235b054af999

SHA512
738af923a7639ccd360389e80c6c90763902080f8c2487a641e87c4587e172053308cd1958136230d2d128934736da98dbcb8fd56d302a3b05dc8bb07f00cd3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
941d31b327a96873822150c9e1881464

SHA1
11c1696152e524733b72dc26250f58a97b86e2b7

SHA256
7f37c5b31411ed7e69365b8c541751a43250f379f156ef785371db69524584a0

SHA512
69f84976d6c81fc1850c0a5fba823ed44bbe76559e3035d46b163eced241580009d238188bf826a0b637a6ba2d62071943aeedfe597b5959e73d234416b31328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
fae9c344d24ccaab1356bf6826924e55

SHA1
8843a376e85a0624faeca305e83195bc0d5b6356

SHA256
2c5429784c372f874fcd8666a80f6ab4aa74609af032642bf2f5eed098c96dbe

SHA512
d12c7975f521eec40c1de124f045f42f58a3756a5852765ab6a15fd7a3797bf680f24ec66c4cf1b7a9dacc3e4818d7d9444b65ca4e980f7e464c171df5f9f2de

Download Submit
C:\Users\Admin\Downloads\AHAH.exe
Filesize
202KB

MD5
9d15078abcfd87ee3c6c33b0b3f4f883

SHA1
9b95fd18c4efd8b2e9fa43b9f6138f60f6c845c9

SHA256
9e6491c1915787cc010228c0df2f351299babe7f90cc08a3469fb7daa59ff351

SHA512
5cf3d302dea32b30138185cac7b0484f50febdc9bc27daab76385a1b7deec1a28316398f03afbbb19f8c54c7a9ea6d4f9eedc5cd48be14807ae8bfdb3342d4dd

Download Submit
\??\pipe\LOCAL\crashpad_2576_OKJQUIVVKDOBXHXZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1044-204-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download
memory/1044-206-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download
memory/1044-205-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download
memory/1044-210-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download
memory/1044-216-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download
memory/1044-215-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download
memory/1044-214-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download
memory/1044-213-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download
memory/1044-212-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download
memory/1044-211-0x000001C2388F0000-0x000001C2388F1000-memory.dmp

Filesize
4KB

Download