Overview
overview
10Static
static
7WinLocker ....4.exe
windows10-1703-x64
10WinLocker ....4.exe
windows7-x64
10WinLocker ....4.exe
windows10-2004-x64
10WinLocker ....4.exe
windows11-21h2-x64
10WinLocker ....4.exe
ubuntu-18.04-amd64
WinLocker ....4.exe
debian-9-armhf
WinLocker ....4.exe
debian-9-mips
WinLocker ....4.exe
debian-9-mipsel
Analysis
-
max time kernel
1801s -
max time network
1802s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 14:39
Behavioral task
behavioral1
Sample
WinLocker Builder v1.4.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
WinLocker Builder v1.4.exe
Resource
win7-20240611-en
Behavioral task
behavioral3
Sample
WinLocker Builder v1.4.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
WinLocker Builder v1.4.exe
Resource
win11-20240419-en
Behavioral task
behavioral5
Sample
WinLocker Builder v1.4.exe
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral6
Sample
WinLocker Builder v1.4.exe
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral7
Sample
WinLocker Builder v1.4.exe
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral8
Sample
WinLocker Builder v1.4.exe
Resource
debian9-mipsel-20240418-en
General
-
Target
WinLocker Builder v1.4.exe
-
Size
699KB
-
MD5
81dd862410af80c9d2717af912778332
-
SHA1
8f1df476f58441db5973ccfdc211c8680808ffe1
-
SHA256
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f
-
SHA512
8dd014b91fb1e2122d2e4da444db78dd551513c500d447bb1e94ceb7f2f8d45223a8a706e2156102f8c8850d2bb02ae6b8ea0c9282abd7baaa2c84130112af15
-
SSDEEP
12288:0L/xX5KVeOnuH/u1Wig295xsmVXf6AaQLmEc+pdmWSwIHUOS6Vp:0bxpUz13g27raQmEcomWSHHUD
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 9 IoCs
Processes:
resource yara_rule behavioral3/memory/3256-2-0x0000000000400000-0x0000000000545000-memory.dmp modiloader_stage2 behavioral3/memory/3256-3-0x0000000000400000-0x0000000000545000-memory.dmp modiloader_stage2 behavioral3/memory/3256-5-0x0000000000400000-0x0000000000545000-memory.dmp modiloader_stage2 C:\Users\Admin\Desktop\123123.exe modiloader_stage2 behavioral3/memory/3256-60-0x0000000000400000-0x0000000000545000-memory.dmp modiloader_stage2 behavioral3/memory/4048-66-0x0000000000400000-0x000000000046B000-memory.dmp modiloader_stage2 behavioral3/memory/4048-69-0x0000000000400000-0x000000000046B000-memory.dmp modiloader_stage2 behavioral3/memory/4048-71-0x0000000000400000-0x000000000046B000-memory.dmp modiloader_stage2 behavioral3/memory/4048-123-0x0000000000400000-0x000000000046B000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WinLocker Builder v1.4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WinLocker Builder v1.4.exe -
Executes dropped EXE 2 IoCs
Processes:
Upx.exe123123.exepid process 3140 Upx.exe 4048 123123.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Upx.exe upx behavioral3/memory/3140-38-0x0000000000400000-0x000000000057E000-memory.dmp upx behavioral3/memory/3140-59-0x0000000000400000-0x000000000057E000-memory.dmp upx C:\Users\Admin\Desktop\123123.exe upx behavioral3/memory/4048-62-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral3/memory/4048-66-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral3/memory/4048-69-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral3/memory/4048-71-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral3/memory/4048-123-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
123123.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\123123.exe = "C:\\Users\\Admin\\Desktop\\123123.exe" 123123.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 49 IoCs
Processes:
WinLocker Builder v1.4.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000090000000 WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU WinLocker Builder v1.4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy WinLocker Builder v1.4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2" WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 WinLocker Builder v1.4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" WinLocker Builder v1.4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" WinLocker Builder v1.4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" WinLocker Builder v1.4.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags WinLocker Builder v1.4.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656} WinLocker Builder v1.4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
123123.exepid process 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe 4048 123123.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WinLocker Builder v1.4.exepid process 3256 WinLocker Builder v1.4.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
explorer.exedescription pid process Token: SeShutdownPrivilege 2428 explorer.exe Token: SeCreatePagefilePrivilege 2428 explorer.exe Token: SeShutdownPrivilege 2428 explorer.exe Token: SeCreatePagefilePrivilege 2428 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinLocker Builder v1.4.exepid process 3256 WinLocker Builder v1.4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WinLocker Builder v1.4.exedescription pid process target process PID 3256 wrote to memory of 3140 3256 WinLocker Builder v1.4.exe Upx.exe PID 3256 wrote to memory of 3140 3256 WinLocker Builder v1.4.exe Upx.exe PID 3256 wrote to memory of 3140 3256 WinLocker Builder v1.4.exe Upx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"C:\Users\Admin\AppData\Local\Temp\WinLocker Builder v1.4.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Upx.exe"C:\Users\Admin\AppData\Local\Temp\Upx.exe" "C:\Users\Admin\Desktop\123123.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Users\Admin\Desktop\123123.exe"C:\Users\Admin\Desktop\123123.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2152 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Upx.exeFilesize
283KB
MD5308f709a8f01371a6dd088a793e65a5f
SHA1a07c073d807ab0119b090821ee29edaae481e530
SHA256c0f9faffdf14ab2c853880457be19a237b10f8986755f184ecfe21670076cb35
SHA512c107f1af768d533d02fb82ae2ed5c126c63b53b11a2e5a5bbf45e396cb7796ca4e7984ce969b487ad38d817f4d4366e7953fb555b279aa019ffb5d1bbba57e28
-
C:\Users\Admin\Desktop\123123.exeFilesize
387KB
MD57335fc512377e72533c3d6c182c7f109
SHA1a775ae9c569d590b6a5b26fc76a4d0f606ef68db
SHA25679b94a3e044f115fd41e2af3b885726054d82568e7871e92d34404feb1d7cf54
SHA5129132af7d45abf14baa9d2bb1e2c2dec85a4d8cfc45419be4914b03d24cb9e6483c12bf8931eb7e177708356aa1e6b4b29f3805455eebc13f249beb1078c7078e
-
C:\Users\Admin\Desktop\123123.exeFilesize
156KB
MD55db99ff87758e0b820d0bcc3ac1acea3
SHA11e450845af3a9a065345c97d6036f50104051645
SHA2565ce50208bfc92741fd650d5a99a3a08d9b6b3336472eb49153fc3d937b4f49f8
SHA512fe0ac4d1c43565cf8e8af353d0b34cfa99e41402612ab38cdbb01a010c342db2db7a3f3c9d37dd9e1d0f529d613c451f8f38c5fdd620a865da5aeffef116da29
-
memory/3140-59-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/3140-38-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/3256-4-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/3256-5-0x0000000000400000-0x0000000000545000-memory.dmpFilesize
1.3MB
-
memory/3256-0-0x0000000000400000-0x0000000000545000-memory.dmpFilesize
1.3MB
-
memory/3256-3-0x0000000000400000-0x0000000000545000-memory.dmpFilesize
1.3MB
-
memory/3256-2-0x0000000000400000-0x0000000000545000-memory.dmpFilesize
1.3MB
-
memory/3256-60-0x0000000000400000-0x0000000000545000-memory.dmpFilesize
1.3MB
-
memory/3256-1-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/4048-62-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4048-64-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/4048-66-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4048-69-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4048-71-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4048-123-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB