12ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9

Resubmissions

Analysis

max time kernel
102s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
05-06-2024 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7z2405-x64.exe
Size

1.5MB
MD5

c73433dd532d445d099385865f62148b
SHA1

4723c45f297cc8075eac69d2ef94e7e131d3a734
SHA256

12ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9
SHA512

1211c8b67652664d6f66e248856b95ca557d4fdb4ea90d30df68208055d4c94fea0d158e7e6a965eae5915312dee33f62db882bb173faec5332a17bd2fb59447
SSDEEP

49152:ZEVAbJqaITViU3qLkr7toP9KT+uv6WC+5uxe1o58:ZEVcqeUaki9oBqt+

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

7zFM.exe7zG.exe

pid process

4764 7zFM.exe
1592 7zG.exe
Loads dropped DLL 1 IoCs

Processes:

7zG.exe

pid process

1592 7zG.exe

pid	process
4764	7zFM.exe
1592	7zG.exe

pid	process
1592	7zG.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

7z2405-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

7z2405-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2405-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2405-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 21 IoCs

Processes:

7z2405-x64.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{68C8BB9B-2745-4134-958C-C11915220930}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2405-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2405-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2405-x64.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

3508 msedge.exe
3508 msedge.exe
3532 msedge.exe
3532 msedge.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

4764 7zFM.exe

pid	process
3508	msedge.exe
3508	msedge.exe
3532	msedge.exe
3532	msedge.exe

pid	process
4764	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

7zFM.exe7zG.exe

description	pid	process
Token: SeRestorePrivilege	4764	7zFM.exe
Token: 35	4764	7zFM.exe
Token: SeRestorePrivilege	1592	7zG.exe
Token: 35	1592	7zG.exe
Token: SeSecurityPrivilege	1592	7zG.exe
Token: SeSecurityPrivilege	1592	7zG.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe7zG.exe

pid process

4764 7zFM.exe
1592 7zG.exe

pid	process
4764	7zFM.exe
1592	7zG.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3532 wrote to memory of 1108	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1108	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2728	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 4068	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 4068	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1348	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1348	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1348	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1348	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1348	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1348	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1348	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1348	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 1348	3532	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe
"C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe"
1⤵
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6604 --field-trial-handle=2004,i,3518780201612530827,12523116488201166376,262144 --variations-seed-version /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffa1f2d2e98,0x7ffa1f2d2ea4,0x7ffa1f2d2eb0
2⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2064 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:2
2⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2352 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:3
2⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2540 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:8
2⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4320 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:8
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4320 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:8
2⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:8
2⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4628 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:8
2⤵
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4664 --field-trial-handle=2068,i,5855985743774516074,8907246701594646944,262144 --variations-seed-version /prefetch:8
2⤵
PID:1960

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4764

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap1970:82:7zEvent9748 -ad -saa -- "C:\Users\Public\Desktop\ResizeImport_2"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1592

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll
Filesize
1.8MB

MD5
2537a4ba91cb5ad22293b506ad873500

SHA1
ce3f4a90278206b33f037eaf664a5fbc39089ec4

SHA256
5529fdc4e6385ad95106a4e6da1d2792046a71c9d7452ee6cbc8012b4eb8f3f4

SHA512
7c02445d8a9c239d31f1c14933d75b3e731ed4c5f21a0ecf32d1395be0302e50aab5eb2df3057f3e9668f4b8ec0ccbed533cd54bc36ee1ada4cc5098cc0cfb14

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
960KB

MD5
b161d842906239bf2f32ad158bea57f1

SHA1
4a125d6cbeae9658e862c637aba8f8b9f3bf5cf7

SHA256
3345c48505e0906f1352499ba7cbd439ac0c509a33f04c7d678e2c960c8b9f03

SHA512
0d14c75c8e80af8246ddf122052190f5ffb1f81ffd5b752990747b7efcb566b49842219d9b26df9dbe267c9a3876d7b60158c9f08d295d0926b60dbbebc1fa3c

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
691KB

MD5
ebff295ea5bb139eb04c699e1a52c286

SHA1
4d71053397304ab545f246ed6676d5927691b833

SHA256
835d114678b311e938ee235519be252b38f14f2c5117d3ee3b905f09f0615f94

SHA512
4320277436d737efb3ea04515a52ec86102a02f840b2f16d8f27673244124e149f01eee15870448710ec015c103a83f8bbf491f9928dbc1bc1b55236da8473b9

Download Submit
C:\Program Files\7-Zip\Lang\es.txt
Filesize
10KB

MD5
54ce4d279862f4674c19b6901372208a

SHA1
3e27e163fc9f2f7a574bf6fafa926db4a937ebd1

SHA256
85e1a8a9e7da2afc0444f6fa00d6814bd4e6bd038c00ce7edd8eea091ba2989d

SHA512
5439859e4362a916c8438e9bd78e7bc57f00375f281d7d9625c00b337fac6d6f8743e9c6c794d533648915839d0ec913b212518759803431c0a5116e1fdc9187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
280B

MD5
4c07962c1ad5a7b1e2b079594e6367f8

SHA1
b98bb2abad60387232002476205b4c30ce3bd160

SHA256
69b564f95f428e132134fa472e3bc17fdf3a526370653d9d2e59a91c730e4c45

SHA512
bf34124e0890a977c6e61cda5f2199dcb0e3f62fda916dc9af7039f18fcd1857e89208f88ae505691c1836af37c09b105fc14b6f18dfdd9db69c6152ae62e4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\524e436f-0f81-4ddd-b26c-80551f536a5b.tmp
Filesize
9KB

MD5
ffc1a448a603e1be125801b8e8fd2466

SHA1
ebfddb120c17aefea403d8a18db69efd64ed4fdf

SHA256
830282fb747fed64ba6938f9ce1dc739431d40695a052f706c15eea73c4f3d51

SHA512
d640dfbd24aa11b520d1d5ce94b7dcf0980dc739ac5c7c1f9c15bc00a93e70b86a1ee88e9c79ffc53a8ca83d3dc30db79e54507807e6d25d4a26d18272bd8a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ab0d5f8-66c8-42c6-bd2f-9e7f1953f52b.tmp
Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
126cc95a50fb094b5162d14940481fe7

SHA1
e71b03a303934c6af83931d673147d8c9e996ff2

SHA256
4a7596a124e4de1d57fe04781b58144c72a9e731252f068aef5cd16cfed9c901

SHA512
24af0d7366f5c8e58fe206ad1b2293f46a755ddd05d629e3e0eb75cd473acf119475678df5a14d4ec418ed39458f0326008a7293bf9b22c02f85f41f57a8ed45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
30KB

MD5
4547ef01c27148c4886122c88fa77328

SHA1
326dc8207f62cd7b614f1f803982f1d7ac44ae7f

SHA256
3e2781972cea270a08cf8985c5eb87a449d8e44ea4d08e16c2b8b6f5e23cf24e

SHA512
1b1f9a73cc3798ccbaac0d50d73b6dbe0621c2a3a8341cffc7519197294a5501902d944053f3bb3e44e947cc145d3848d7c960574702cbfc5b350ec60e11dbb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
33KB

MD5
ff816cb8579bfcc1424d47b215e84cfe

SHA1
146f4d93d79746c340761b670ad6a20e75829526

SHA256
2b20305002f339dfc1abe526acb4245272afa33da46f21ad7bbd572e871c9a8a

SHA512
afc68324cf3476506988a1dc11d720a8ebb36986a1648ac4c253de7a3bc7c47bd6a5a9806d48e6f2754aef12cb857aa64a29e32f263fa36d5058d71172f9862c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
42KB

MD5
d6c0a14db904ecece6f8fbaa348ddf3c

SHA1
5222feef58083dd951ed74b565238f29c8f7d412

SHA256
136fd8adb585a667ad08b30b3a7237a74b3a4194c4986a7ede93234104e4a0ef

SHA512
b14670fb4de6de9557dbb705feb557d1b496be88dba279e9d7031f9b30e564dcbc23fa806cd2f568a26de12403540ba1cde311fa8c8604d9e37875c77b66a796

Download Submit
\??\pipe\crashpad_3532_RDKSETMKSKOVPTDJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit