Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
30/05/2024, 19:12
General
-
Target
2024-05-30_8beb6e8902a9cdc119d58a0fb94b1d3c_icedid.exe
-
Size
1.5MB
-
MD5
8beb6e8902a9cdc119d58a0fb94b1d3c
-
SHA1
5fe78eb9fea0b94d2510ee28fea653d1f477bed7
-
SHA256
2fed663d5100094b2de550aad4937e18e2096e55fe7424616736b94b7435d04f
-
SHA512
844e56d7a9423850a86fde7d7dc3fab82426d07a15775765cd62218153be94e683d5fe463645ea42a96c5786f22b7f3f707db86244176a3773c43b39f06ad26a
-
SSDEEP
24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRd5:01/kjtPlERDGnlRANRd5
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 32 IoCs
-
Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_8beb6e8902a9cdc119d58a0fb94b1d3c_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_8beb6e8902a9cdc119d58a0fb94b1d3c_icedid.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DouTu\DouTuDaShi.exe"C:\Program Files (x86)\DouTu\DouTuDaShi.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\rrqjkl.exe"C:\Users\Admin\AppData\Local\Temp\rrqjkl.exe" /jscxyxztjkl2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rrqjkl.exe"C:\Users\Admin\AppData\Local\Temp\rrqjkl.exe" /jsjczxztcq3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\229775.exe"C:\Users\Admin\AppData\Roaming\Download\229775.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Download\229775.exe"C:\Users\Admin\AppData\Roaming\Download\229775.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\284578.exe"C:\Users\Admin\AppData\Roaming\Download\284578.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\284578.exe"C:\Users\Admin\AppData\Roaming\Download\284578.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\385999.exe"C:\Users\Admin\AppData\Roaming\Download\385999.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\385999.exe"C:\Users\Admin\AppData\Roaming\Download\385999.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\672717.exe"C:\Users\Admin\AppData\Roaming\Download\672717.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\672717.exe"C:\Users\Admin\AppData\Roaming\Download\672717.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\801696.exe"C:\Users\Admin\AppData\Roaming\Download\801696.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\801696.exe"C:\Users\Admin\AppData\Roaming\Download\801696.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\399684.exe"C:\Users\Admin\AppData\Roaming\Download\399684.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\399684.exe"C:\Users\Admin\AppData\Roaming\Download\399684.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\687296.exe"C:\Users\Admin\AppData\Roaming\Download\687296.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\687296.exe"C:\Users\Admin\AppData\Roaming\Download\687296.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\670547.exe"C:\Users\Admin\AppData\Roaming\Download\670547.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\670547.exe"C:\Users\Admin\AppData\Roaming\Download\670547.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\726729.exe"C:\Users\Admin\AppData\Roaming\Download\726729.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\726729.exe"C:\Users\Admin\AppData\Roaming\Download\726729.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\103527.exe"C:\Users\Admin\AppData\Roaming\Download\103527.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\103527.exe"C:\Users\Admin\AppData\Roaming\Download\103527.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\339409.exe"C:\Users\Admin\AppData\Roaming\Download\339409.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\339409.exe"C:\Users\Admin\AppData\Roaming\Download\339409.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\381765.exe"C:\Users\Admin\AppData\Roaming\Download\381765.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\381765.exe"C:\Users\Admin\AppData\Roaming\Download\381765.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\707748.exe"C:\Users\Admin\AppData\Roaming\Download\707748.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\707748.exe"C:\Users\Admin\AppData\Roaming\Download\707748.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\618299.exe"C:\Users\Admin\AppData\Roaming\Download\618299.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\618299.exe"C:\Users\Admin\AppData\Roaming\Download\618299.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\744171.exe"C:\Users\Admin\AppData\Roaming\Download\744171.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\744171.exe"C:\Users\Admin\AppData\Roaming\Download\744171.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\986437.exe"C:\Users\Admin\AppData\Roaming\Download\986437.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\986437.exe"C:\Users\Admin\AppData\Roaming\Download\986437.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\132410.exe"C:\Users\Admin\AppData\Roaming\Download\132410.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\132410.exe"C:\Users\Admin\AppData\Roaming\Download\132410.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\644949.exe"C:\Users\Admin\AppData\Roaming\Download\644949.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\644949.exe"C:\Users\Admin\AppData\Roaming\Download\644949.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\302768.exe"C:\Users\Admin\AppData\Roaming\Download\302768.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\302768.exe"C:\Users\Admin\AppData\Roaming\Download\302768.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\777556.exe"C:\Users\Admin\AppData\Roaming\Download\777556.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\777556.exe"C:\Users\Admin\AppData\Roaming\Download\777556.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\670907.exe"C:\Users\Admin\AppData\Roaming\Download\670907.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\670907.exe"C:\Users\Admin\AppData\Roaming\Download\670907.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\100436.exe"C:\Users\Admin\AppData\Roaming\Download\100436.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\100436.exe"C:\Users\Admin\AppData\Roaming\Download\100436.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\293977.exe"C:\Users\Admin\AppData\Roaming\Download\293977.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\293977.exe"C:\Users\Admin\AppData\Roaming\Download\293977.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\795486.exe"C:\Users\Admin\AppData\Roaming\Download\795486.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\795486.exe"C:\Users\Admin\AppData\Roaming\Download\795486.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\738572.exe"C:\Users\Admin\AppData\Roaming\Download\738572.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\738572.exe"C:\Users\Admin\AppData\Roaming\Download\738572.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\911003.exe"C:\Users\Admin\AppData\Roaming\Download\911003.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\911003.exe"C:\Users\Admin\AppData\Roaming\Download\911003.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\108810.exe"C:\Users\Admin\AppData\Roaming\Download\108810.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\108810.exe"C:\Users\Admin\AppData\Roaming\Download\108810.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\120178.exe"C:\Users\Admin\AppData\Roaming\Download\120178.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\120178.exe"C:\Users\Admin\AppData\Roaming\Download\120178.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\211427.exe"C:\Users\Admin\AppData\Roaming\Download\211427.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\211427.exe"C:\Users\Admin\AppData\Roaming\Download\211427.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\354685.exe"C:\Users\Admin\AppData\Roaming\Download\354685.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\354685.exe"C:\Users\Admin\AppData\Roaming\Download\354685.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\Download\376751.exe"C:\Users\Admin\AppData\Roaming\Download\376751.exe" /Shorttailedrestart4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Download\376751.exe"C:\Users\Admin\AppData\Roaming\Download\376751.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\422933.exe"C:\Users\Admin\AppData\Roaming\Download\422933.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\422933.exe"C:\Users\Admin\AppData\Roaming\Download\422933.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\919721.exe"C:\Users\Admin\AppData\Roaming\Download\919721.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\919721.exe"C:\Users\Admin\AppData\Roaming\Download\919721.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\045701.exe"C:\Users\Admin\AppData\Roaming\Download\045701.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\045701.exe"C:\Users\Admin\AppData\Roaming\Download\045701.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\948152.exe"C:\Users\Admin\AppData\Roaming\Download\948152.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\948152.exe"C:\Users\Admin\AppData\Roaming\Download\948152.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\374115.exe"C:\Users\Admin\AppData\Roaming\Download\374115.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\374115.exe"C:\Users\Admin\AppData\Roaming\Download\374115.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\316491.exe"C:\Users\Admin\AppData\Roaming\Download\316491.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\316491.exe"C:\Users\Admin\AppData\Roaming\Download\316491.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\603298.exe"C:\Users\Admin\AppData\Roaming\Download\603298.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\603298.exe"C:\Users\Admin\AppData\Roaming\Download\603298.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\784749.exe"C:\Users\Admin\AppData\Roaming\Download\784749.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\784749.exe"C:\Users\Admin\AppData\Roaming\Download\784749.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\717807.exe"C:\Users\Admin\AppData\Roaming\Download\717807.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\717807.exe"C:\Users\Admin\AppData\Roaming\Download\717807.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\853988.exe"C:\Users\Admin\AppData\Roaming\Download\853988.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\853988.exe"C:\Users\Admin\AppData\Roaming\Download\853988.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\340775.exe"C:\Users\Admin\AppData\Roaming\Download\340775.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\340775.exe"C:\Users\Admin\AppData\Roaming\Download\340775.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\476758.exe"C:\Users\Admin\AppData\Roaming\Download\476758.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\476758.exe"C:\Users\Admin\AppData\Roaming\Download\476758.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\477289.exe"C:\Users\Admin\AppData\Roaming\Download\477289.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\477289.exe"C:\Users\Admin\AppData\Roaming\Download\477289.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\398650.exe"C:\Users\Admin\AppData\Roaming\Download\398650.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\398650.exe"C:\Users\Admin\AppData\Roaming\Download\398650.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\530716.exe"C:\Users\Admin\AppData\Roaming\Download\530716.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\530716.exe"C:\Users\Admin\AppData\Roaming\Download\530716.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\563072.exe"C:\Users\Admin\AppData\Roaming\Download\563072.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\563072.exe"C:\Users\Admin\AppData\Roaming\Download\563072.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Download\585348.exe"C:\Users\Admin\AppData\Roaming\Download\585348.exe" /Shorttailedrestart4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Download\585348.exe"C:\Users\Admin\AppData\Roaming\Download\585348.exe"5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hao.360.cn/?src=lm&ls=n6abbbb598c2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6b2f46f8,0x7ffa6b2f4708,0x7ffa6b2f47183⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18417621174639869649,9187904985188068121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:23⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldsajdklsajdlkjsalkda.bat" "2⤵
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5ab71d658fafe7acc09e7de2116a85f89
SHA1d1dd1a053f2c970bc4d0043bf3e682fbf2ea405f
SHA256f84de427eb42b4815369a0fd1576c0d31dcbc6335e786cc5189837278a9bd24f
SHA51218651fbc489a877400b92beb95dd66c85285586bcbd84c392e2f67dbca9608ec207004a5ad7d8164c9c515cce45ee7628403300eae56786d556305725b9e9e27
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
5KB
MD5e03bb07119cd60f9f0adb4a48d68726b
SHA147d8ae2362d67ac25d3d06387323f6ae75f3a0de
SHA256dce7c3d20c0ee8ec4a2d5f58c344a9d5b0416c51b94fb8938f7ddca37494ba7f
SHA51249436fbc60385d1f29d5c759a70a4893824572cea02f37c2d83cf3cf2729dc0679468647713d46eb11e3812adec2c38f78cdc1b761c2e707f5ac09d37398fe67
-
Filesize
6KB
MD58ff204716e9616aae713292f044638ff
SHA11ed9e208d252520f3e719cd2fd0fffa1cddbf78d
SHA256d6aa830f13b8824169c5739403513e437a607a03ba34d4446d6883ed64732778
SHA512b705dc9c6bca22527b6e6f94a4c03bf70731727bd40f40fef8802f72bb2fa2acc09c65262f0b879f8a279ba504a88c7cac37f6de98ad45d81290c963a5feb5f4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f45d27600e39d5f40ce4dd4286685eaa
SHA1e9e02f434248fb7a37f553410c8f259d5a0c03d7
SHA25672a04b1831f328441a86d264e7e2ac4823f53024d7e1de475761c8b66ac4fa20
SHA512a8794ebb7be2509735d62ace521992a16413dfc2bc7c7654ff8676f93a8f8bbcf58c2c67a1f8bd4f7a8aad05ab56df11f293cd3d86b0f022c84603e81564fa1f
-
Filesize
589B
MD58d429a42926ee993fd964b694d838812
SHA139695db3362a18889277c80871a511029ca62ef2
SHA25620cefb599f8c1acaed3c65ce14b8adb23f0ffdd0eb65a511dc614aa74cee02dd
SHA512f6979caaf41cbe5b5ee1e6fd5fce7027ba6102470cd13bdfe3b3aaf441539b158f626c3b990567cf8a82dcb129dcc718f9408830280b793f995de89bddafe322
-
Filesize
1.5MB
MD58beb6e8902a9cdc119d58a0fb94b1d3c
SHA15fe78eb9fea0b94d2510ee28fea653d1f477bed7
SHA2562fed663d5100094b2de550aad4937e18e2096e55fe7424616736b94b7435d04f
SHA512844e56d7a9423850a86fde7d7dc3fab82426d07a15775765cd62218153be94e683d5fe463645ea42a96c5786f22b7f3f707db86244176a3773c43b39f06ad26a
-
Filesize
1.5MB
MD552c3e6fdf85dda6af8bb6b663387619b
SHA17397e6298472229c261254ad7160986afe599384
SHA2561f8606070cf7cd21fa87d2f83ce4dee85237ea27c5c318525bb2c84b6aff81d5
SHA512f1a69b5b9793dcc2e9ad80b5ca60d43660a1f5637450d3e352046fc171ce22af38a7b9d1d09e87453e7225fffddd1582d58d35077a2510dbbb05d6edc5c541d7
-
Filesize
1.5MB
MD51285179a0a4220659c4aaf49784b5464
SHA1c296584e96f3b5e2aeb922fd5b4ac6919e7707fd
SHA25698438fa7becb17d9dbda9d09266ce3cfcad2f039644125224d01424931bf947a
SHA51276c6e972c460277b669b23c4f63d71ae4da279032786312f72dc98287f34d8840a04d5f185fbb5814eae27e55de97721f0c68b0bb3effe619dce4651017d2dc4
-
Filesize
1.5MB
MD55ed172f8e155d81b3d7026b55b850772
SHA143a62837da885dcd3b0b5c6f9c2ea3fab0149472
SHA256c176c80bf2e921a042c3646f35c4460b4e9c675fc25d50369e74a3ab0f8abf61
SHA512483b640cbea6bd4b7da4fea1dbba1b07caf1d9e22ec5906ea84421e4520493185ed2506a361a6d68495fb67e70f56136aeb44e4c4df288019b14c9abbd011895
-
Filesize
1.5MB
MD541d4f0dd61d113fcc4a61fa9c9bea9f4
SHA18c54dfa18ccdb405f5b51fe8faf96d2d23ec268c
SHA2565294e04e434caa43f364a7ccb3ef144e26afd4e49e4a0b6ad0e85dbf134d6d7f
SHA5125daeb2e99f55bf3b07dfa92836ff9ad017632017fba3ee13e1503fc4f887244da5c875adf6c6a5a2fa2641d9e01c1010cacd62ffd94f9b0d7c63a939cdc08bc1
-
Filesize
1.5MB
MD5a29d3e3dd47ec0fd28b6a37519d9f095
SHA13f153edacdd2217805cbd7d698376b06abed5adf
SHA256c2f97e82d12f59377dd0f17acc5dcd38e81e27067aff8d9c5684c455ce5c56ab
SHA512ad997ca742d95bcd784abd54082adbbb096b429da1973cd293a3d53e17bcecdd298cc2035d4efffbd9c5e193b5bb04154513bbb37b776e3b9504c202a99c583b
-
Filesize
1.5MB
MD589ec6a95910caa26f4ff1db911374cec
SHA198c4817f3be786deac32ca78575c4a642edc0912
SHA25663d0768748c746e3ee20fb621eabc17681bfece88822526775f5952153d73ca9
SHA5128e2fbb6551b104f5fde17edc2026d7db9c74b8a7a2bd61d5c86844b06e45db464485aefdac89e21e7c7f7833d755c5b4347fadeb9acd9f25037b68c5de92c0c1
-
Filesize
1.5MB
MD504d0531d4f27ec08d6812b861a8fdfab
SHA1407bfbe9bf5c55a3119ce94879ba06967fb4c735
SHA25683d8675f75857d774d981e73825ea8e52250350d17b977959545a493f4460aad
SHA5128a60ca7f79a8780495511b50667e47953a3c3b8b5e7d674c92accaffcea4bf6a4b43b9d8cdc1773d75c1e188a97debfff61c0e926978e2689061bfb17de3bd45
-
Filesize
1.5MB
MD56552d14f532c7cb6e896fdbb680ea6ca
SHA164d4f82aa1d17fbcf2cfc36f680452ca7a859524
SHA256458940e5444342dc7e0460aad87770bd572f2406fe7b30c508b1ac5e55c14e12
SHA5128e858d1cb9135f2e5629e8470159d7b3ae6dc94c3c0dbf485175ea4eb87e98362215f88412d7764e4308fccc216d8c39c85da32b481002dbdf0c7bdea0aef62e
-
Filesize
1.5MB
MD535d8842caf9931328400defe99c22a55
SHA13ddae5c81968da1e36f3cb2a0a5492e2b07d78b1
SHA256312a90e3304c6dd31e38b9a58d55742673a4def9cd6f99a16ff8b099386ffff8
SHA5123ec9f902836a521d93f01469c36d7edb5ed44243553233135094c1495e2ee8733c6cf6b32d7eb1517c5c7726a11f36340e00887162b2b048da7caea5661c5745
-
Filesize
1.5MB
MD5a7b59e1bdcbafe9e96eff5e61e62b68b
SHA1533244574eb902612c58c026a5d16e303a236810
SHA2564493aa1a6b77ee6c69d59d3438f000b80893e83e711c680c0976bf44c26ff785
SHA512caf83b2bb45e23bc4baeb8239a9dc318fd3ed796c33468315ac1b372d7b8a928f1cb69f23b7d494e2b5caef8c88ee79be81ff73e84fb6136453307e3f0675c32
-
Filesize
1.5MB
MD5665ff1eb98893eeef56030009a872d16
SHA12498bcafc6155e7a7d3ef38ce8d0e47338ea8f1f
SHA256a7863217615cba5ad7e9a2faad5c76884d564760f4f06524d1c90714838fe05c
SHA512777a924ea457d2e967d0530f24af45bcdfcaa72b14a8538efb9dc6d5bda88bb78699a1c49f39874032932c78b32c6c8ef64f1bbb75b710b0f107ffc3eefbb4ec
-
Filesize
1.5MB
MD59b2f9f93f188d851a18b9085356589b3
SHA10b9586c6feab5901427f7bafdfe1fba290032b83
SHA256059e1dabc3a986114502b421fb82c01f4f4b7d134eecc4cdd681763593de7147
SHA51207ca90059107932fff6d35356312941eb1d6d7f47c8ea15561050354404d8805f37a80deeba21de97b6e89893092cd2ad660209ca8d896331e7f374b6c3181c3
-
Filesize
1.5MB
MD50cbcb41c842aa0e7b3421d1975de7fb8
SHA1de83679e9338146de299f6474ae515de1146b490
SHA25605bc6d1cf9f7a3d1d0103ec412798c7dea0e95517e68d4103c462f9de215ec4c
SHA512b4c22ba13c784f1c2306d4f57a094d408e9db723c185a55dbede8b1f29300a792d07490a1c43dab438708d3d56ca74acd72fe87ee6c59c7ba36029da32c4cf9a
-
Filesize
1.5MB
MD5cd9a16410a03290edf7f5f42c3e84138
SHA135e68767e42e3ee27453218f79303750e35b6aa8
SHA256ed27139d73ec239605cd83b307d9cb893e3ce942d416c5899b3829719cad6230
SHA512d8fcbd073696990e52c708d3125b8afef41eb16dff43bc1fc2d22ceba863d5f8c6ddc9763d3f822f449d44b0020eda7edf0bacb8069808e7a1289553c957ebe5
-
Filesize
1.5MB
MD5e6f6070d579532de466a66ef0f7a3a89
SHA11e32159976b9e6e488b2a20d7fa7309d234b44cd
SHA2567f33a70362b00ab7c262671a999c2501ebd42f352375cc81d02e06031f65b90b
SHA51276c348b57f2d9d0cc1cda9b000c558bf306e0a01557a7976c6833b1e2a33773812f13f72564eb4ab735bcd1d93bde9e656833071f044b3ce08d45a23c0367e5c
-
Filesize
1.5MB
MD536920d639d5f68f97defb5f9f518141b
SHA12015b807f27d5de24a298c2e93756024efdb878b
SHA2563d618412f33583612fce42b90184a1e65fc0daf6c1a3531646ec43c07f143cda
SHA5127fbd12ca27f9f97d65082db595740db8f830e1caaa36c37fbaa5065e77eda1221130916979bfe27b157bd96672f48299db5f514944451bf2583c2faa668f20bf
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB