eternity | hxxps://www[.]upload[.]ee/files/16729492/ErinevV3[.]exe[.]html

Analysis

max time kernel
30s
max time network
31s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
17-06-2024 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.upload.ee/files/16729492/ErinevV3.exe.html

Score

10^/10

eternity evasion spyware stealer trojan

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x000700000001ac72-530.dat	disable_win_def
behavioral1/memory/3108-550-0x00000000008A0000-0x000000000098A000-memory.dmp	disable_win_def

Detects Eternity stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/files/0x000700000001ac72-530.dat	eternity_stealer
behavioral1/memory/3108-550-0x00000000008A0000-0x000000000098A000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ErinevV3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ErinevV3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ErinevV3.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
3108	ErinevV3.exe
308	dcd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e0125e6ed6c0da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{61C8F1A9-9CC7-47F9-819E-4F1E7593B66 = "0"	browser_broker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 19ca7a74d6c0da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.upload.ee\ = "109"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.upload.ee\ = "187"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System	browser_broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{61C8F1A9-9CC7-47F9-819E-4F1E7593B66	browser_broker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000e6559b1f10b5d7e58803ebb913d4074a8e2e9db224bb493455416e2ac32a328e6efa41297be72ffa560c7e81f8ab9761e2ca43276467be14afec	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\upload.ee\Total = "109"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ca9fb174d6c0da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{4C091D14-BB38-407E-8AA8-B20BA0F1CB70} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\upload.ee\Total = "159"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{61C8F1A9-9CC7-47F9-819E-4F1E7593B66 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000000caed571d6c0da010caed571d6c0da019b99e171d6c0da0100240e0000000000010000000000000000000000000000009d0314001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800b0003100000000000000000010004d6963726f736f66742e4d6963726f736f6674456467655f3877656b796233643862627765007c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e004d006900630072006f0073006f006600740045006400670065005f003800770065006b00790062003300640038006200620077006500000034005c0031000000000000000000100054656d70537461746500440009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000540065006d00700053007400610074006500000018005c00310000000000000000001000446f776e6c6f61647300440009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000044006f0077006e006c006f00610064007300000018006600320000240e00d1584c8620004572696e657656332e65786500004a0009000400efbed1584c86d1584c862e00000000000000000000000000000000000000000000000000656ec6004500720069006e0065007600560033002e0065007800650000001c000000a20000001c000000010000001c0000003400000000000000a100000018000000030000003bd7f7981000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e4d6963726f736f6674456467655f3877656b7962336438626277655c54656d7053746174655c446f776e6c6f6164735c4572696e657656332e657865000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000066637868746c686c000000000000000076c67ca85be9e04c9e12f9156c937223f329a6b482f2ee11abe26ef3773cdc0a76c67ca85be9e04c9e12f9156c937223f329a6b482f2ee11abe26ef3773cdc0ace000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003100360030003400340037003000310039002d0031003200330032003600300033003100300036002d0034003100360038003700300037003200310032002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000000b36fd38000000000000d01200000000000000000000000000000000	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\upload.ee\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\upload.ee\Total = "2"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "187"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\upload.ee\Total = "53"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\upload.ee	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.upload.ee	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.upload.ee\ = "53"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{61C8F1A9-9CC7-47F9-819E-4F1E7593B66 = "\\\\?\\Volume{38FD360B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ErinevV3.exe"	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ErinevV3.exe.8dafi91.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
4016	powershell.exe
4016	powershell.exe
4016	powershell.exe
2956	powershell.exe
2956	powershell.exe
4016	powershell.exe
2956	powershell.exe
2420	powershell.exe
2420	powershell.exe
3496	powershell.exe
3496	powershell.exe
2708	powershell.exe
2708	powershell.exe
2956	powershell.exe
4856	powershell.exe
4856	powershell.exe
588	powershell.exe
588	powershell.exe
3064	powershell.exe
3064	powershell.exe
2440	powershell.exe
2440	powershell.exe
4024	powershell.exe
4024	powershell.exe
2884	powershell.exe
2884	powershell.exe
4828	powershell.exe
4828	powershell.exe
4024	powershell.exe
2708	powershell.exe
4828	powershell.exe
2420	powershell.exe
3496	powershell.exe
4856	powershell.exe
3064	powershell.exe
588	powershell.exe
2440	powershell.exe
2884	powershell.exe
4024	powershell.exe
4828	powershell.exe
2708	powershell.exe
2420	powershell.exe
4856	powershell.exe
3496	powershell.exe
3064	powershell.exe
588	powershell.exe
2440	powershell.exe
2884	powershell.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2512	MicrosoftEdgeCP.exe
2512	MicrosoftEdgeCP.exe
2512	MicrosoftEdgeCP.exe
2512	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2040	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2040	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2040	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	208	MicrosoftEdge.exe
Token: SeDebugPrivilege	208	MicrosoftEdge.exe
Token: SeDebugPrivilege	3108	ErinevV3.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeIncreaseQuotaPrivilege	2664	powershell.exe
Token: SeSecurityPrivilege	2664	powershell.exe
Token: SeTakeOwnershipPrivilege	2664	powershell.exe
Token: SeLoadDriverPrivilege	2664	powershell.exe
Token: SeSystemProfilePrivilege	2664	powershell.exe
Token: SeSystemtimePrivilege	2664	powershell.exe
Token: SeProfSingleProcessPrivilege	2664	powershell.exe
Token: SeIncBasePriorityPrivilege	2664	powershell.exe
Token: SeCreatePagefilePrivilege	2664	powershell.exe
Token: SeBackupPrivilege	2664	powershell.exe
Token: SeRestorePrivilege	2664	powershell.exe
Token: SeShutdownPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeSystemEnvironmentPrivilege	2664	powershell.exe
Token: SeRemoteShutdownPrivilege	2664	powershell.exe
Token: SeUndockPrivilege	2664	powershell.exe
Token: SeManageVolumePrivilege	2664	powershell.exe
Token: 33	2664	powershell.exe
Token: 34	2664	powershell.exe
Token: 35	2664	powershell.exe
Token: 36	2664	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeIncreaseQuotaPrivilege	4016	powershell.exe
Token: SeSecurityPrivilege	4016	powershell.exe
Token: SeTakeOwnershipPrivilege	4016	powershell.exe
Token: SeLoadDriverPrivilege	4016	powershell.exe
Token: SeSystemProfilePrivilege	4016	powershell.exe
Token: SeSystemtimePrivilege	4016	powershell.exe
Token: SeProfSingleProcessPrivilege	4016	powershell.exe
Token: SeIncBasePriorityPrivilege	4016	powershell.exe
Token: SeCreatePagefilePrivilege	4016	powershell.exe
Token: SeBackupPrivilege	4016	powershell.exe
Token: SeRestorePrivilege	4016	powershell.exe
Token: SeShutdownPrivilege	4016	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeSystemEnvironmentPrivilege	4016	powershell.exe
Token: SeRemoteShutdownPrivilege	4016	powershell.exe
Token: SeUndockPrivilege	4016	powershell.exe
Token: SeManageVolumePrivilege	4016	powershell.exe
Token: 33	4016	powershell.exe
Token: 34	4016	powershell.exe
Token: 35	4016	powershell.exe
Token: 36	4016	powershell.exe
Token: SeIncreaseQuotaPrivilege	2956	powershell.exe
Token: SeSecurityPrivilege	2956	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
208	MicrosoftEdge.exe
2512	MicrosoftEdgeCP.exe
2040	MicrosoftEdgeCP.exe
2512	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2512 wrote to memory of 4984	2512	MicrosoftEdgeCP.exe	76
PID 2276 wrote to memory of 3108	2276	browser_broker.exe	77
PID 2276 wrote to memory of 3108	2276	browser_broker.exe	77
PID 3108 wrote to memory of 308	3108	ErinevV3.exe	79
PID 3108 wrote to memory of 308	3108	ErinevV3.exe	79
PID 3108 wrote to memory of 308	3108	ErinevV3.exe	79
PID 3108 wrote to memory of 2664	3108	ErinevV3.exe	80
PID 3108 wrote to memory of 2664	3108	ErinevV3.exe	80
PID 3108 wrote to memory of 2956	3108	ErinevV3.exe	83
PID 3108 wrote to memory of 2956	3108	ErinevV3.exe	83
PID 3108 wrote to memory of 3064	3108	ErinevV3.exe	84
PID 3108 wrote to memory of 3064	3108	ErinevV3.exe	84
PID 3108 wrote to memory of 3496	3108	ErinevV3.exe	87
PID 3108 wrote to memory of 3496	3108	ErinevV3.exe	87
PID 3108 wrote to memory of 4016	3108	ErinevV3.exe	88
PID 3108 wrote to memory of 4016	3108	ErinevV3.exe	88
PID 3108 wrote to memory of 2420	3108	ErinevV3.exe	91
PID 3108 wrote to memory of 2420	3108	ErinevV3.exe	91
PID 3108 wrote to memory of 2884	3108	ErinevV3.exe	93
PID 3108 wrote to memory of 2884	3108	ErinevV3.exe	93
PID 3108 wrote to memory of 4856	3108	ErinevV3.exe	95
PID 3108 wrote to memory of 4856	3108	ErinevV3.exe	95
PID 3108 wrote to memory of 2708	3108	ErinevV3.exe	96
PID 3108 wrote to memory of 2708	3108	ErinevV3.exe	96
PID 3108 wrote to memory of 4024	3108	ErinevV3.exe	98
PID 3108 wrote to memory of 4024	3108	ErinevV3.exe	98
PID 3108 wrote to memory of 4828	3108	ErinevV3.exe	101
PID 3108 wrote to memory of 4828	3108	ErinevV3.exe	101
PID 3108 wrote to memory of 588	3108	ErinevV3.exe	102
PID 3108 wrote to memory of 588	3108	ErinevV3.exe	102
PID 3108 wrote to memory of 2440	3108	ErinevV3.exe	104
PID 3108 wrote to memory of 2440	3108	ErinevV3.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.upload.ee/files/16729492/ErinevV3.exe.html"
1⤵
PID:3192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:208

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ErinevV3.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ErinevV3.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Users\Admin\AppData\Local\Temp\dcd.exe
    "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
    3⤵
    - Executes dropped EXE
    PID:308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
92688ebe04eac8c3cb69e170b5abef20

SHA1
f6e712691fe508cb21c3a70eabf880c67f94b400

SHA256
82fb1b392bdfe443a826678d0c5d967181b9fc4dcc7f17873087420e7fdfa16c

SHA512
b6a19d1ca347c646b06ef229eb565c92118c304082722394d0d76280725ac55071019627941aaa6ada6a34b8fa04e48245f384a83113b8fdd736efcc42e28a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
dbf0a50577b964fac53b55d9045e983f

SHA1
ec900d64396f00f0b33a58b0c2c3787858a34c91

SHA256
812ae44ae84b2937e00d6438a33f7ec27bfe514fdfdbb504b7575377d4b98736

SHA512
6accb1a1a148da065afbae3fef281bbb5e60b27b7e469f8a84a6520944da21fe8b540adc10d6259190003a24f24e79263b04a036ccfcdff323ba81154674ce2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0bfc32313ca6dd4951ae857c94814ead

SHA1
0d52144570fb489c7f881c281b7b16441f186995

SHA256
fa2c440612ece5ee1a75fc18c652a121e45de40a3672e170d39a31d81599a616

SHA512
c4484371e8bfc80d0358e3ed9006341248c9b30b4397df87445beec7b0ecdc00f5748c1368667a935e56935a36c0a8988105da660e11a9ba19996f01273b25c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
668527eff1e56a20c506444aa7aade15

SHA1
df9d9fffe7b972ae1d3fed2753454ee147e062c4

SHA256
fb385578c2b1b57455c02d6ed4c52123170a8a2d27f3678f6bce71a073c9e8d0

SHA512
e15e63dc558acde591496fa3192b373b6e19f82bfbedcb244a8640b8ab0932ef4a739c395a5a44090915dfb1a4c558be69536fc6d5bcf3805d63fc43bddf5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c1347946f5ced01529561a14093a2921

SHA1
0d806639e24edd2ce5124bc5cc64aa604ebe6b22

SHA256
e9cdb1c67a122607d5964b10ab5d4c3cd4be5a8d7c074e8f781919bb21221267

SHA512
34e1ac90063bc8784d4b6c50692c18e688c9c83513b36ea712c5c09ab68872946e8ceb48cbf22d9f9e0932d643d585f305cf02603289c5468c79e5246cb4634a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1b33dbe6b8f2052544eb1dcfa2bea93c

SHA1
0179cd181241c114537f7c197497a1158a036608

SHA256
cd1534f840ef30e0a5bd4073ce8f389e45c5ba3dc49ff5d2ea97ba81cfd2095d

SHA512
17aab7c40ff9af30c5b82d28f31c12a76c689bc77a191f6e1f67852cf13cda6cc80850582470161b482b62f44e959de6e8b49bb7188f0f89783554d6f347ff23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
308aa4696d8380b851dca6e67fed24cb

SHA1
6362105c5460a52ca5b59d2ab479f2ba8da35d24

SHA256
6c9adfe9f240a98ee088b9e9e8545aa77720b464006bffd0caef1e5856da761c

SHA512
2c6bc87838387552ef35a432b6cb059113309c3b7a36268e838502dc1405979034df547a80714108ea7b35de93a062a6a1da0203e99a8b8e64ef22374794c3a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a4e90a69ddb74dc53e8c296eab7decb2

SHA1
f15726aef92df07c57dfce49a59546ea76366432

SHA256
edca745e8a77c6ad1277c593880401c0468538e82b885261bccf6489d2fd52aa

SHA512
b0a146f4aa445928ef91b892de68d94d03134d2469eeb7600935e8c550d2d65682520e904fbf8830c644f0fd04ccb1d2f566734f354e6dfc082299b068c01388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0b8ec883dc64556f3c363db82438085a

SHA1
4359696a81fefe847d47278190f34b20196a9f8b

SHA256
02dd54a027b436c2a4bd38c6fbbbe59c936a3b1ee3b2b721ba367f1c16f3314f

SHA512
a5cafa933161b4f2e8acf489239a67186c5b7eabc8b63152ee47bf2ec7fe897c3dbccac198ea5922d5c52b5f6334aa8c40680d26305982deb602f5cc0dc631e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d4744900afc4b66875f2850181200254

SHA1
e350343af2874f7174066c3500e6bc1d5ef11193

SHA256
1bd84c7abca8e303bf3193602fc195e5fe637e5c6af2500668563a2044fd6d1f

SHA512
cf3d533120e4966e5500e1e81d29ff04a3c00817f4b013b20592bc90e480076172a18a7a69a4ff55545ed4450778672b2ec9e3adbf6868451f9453411566864a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\V2505MQV\www.upload[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\V2505MQV\www.upload[1].xml

Filesize
434B

MD5
3f6d3f7699582c90856d3697cb87ef8f

SHA1
4d334f1bb4ee2b1d55bd0c35fac9a1c1505e1aa0

SHA256
ee0c1cd2787d474bbc3f6e8943679f12bf5d920c141e65ab103352318ead3536

SHA512
ab49bab7e0d839bd353d81ce146cd3b8ab80a58d3993803de28287a7f389409aac48d10ca2329f702e35ad655db00b9b1d6dab915739e1907fc49e9d80ff5064

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\Y3KUJMYI\favicon[1].ico

Filesize
1KB

MD5
f299cf2e651c19e48d27900ced493ccb

SHA1
c2d1086d517d7a26292e0d7b32da7c55b166c23b

SHA256
115c8eb4840245f7aed0cb2a17fa7e91b86f79bb2f223a25af8cc533e1dedff1

SHA512
b46341bfbac50f48afcd2a4e34910901d722ce72f9f34f809916103e01d7ebc11bce15a28bf6449efd49ab9dfef1f84a94e3ad775cbe52d5822996674124b104

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ErinevV3.exe.8dafi91.partial

Filesize
905KB

MD5
75be298681093c17d0e0c9130be3721c

SHA1
08fcc6117207dff4e7a377159d2c99ba30801566

SHA256
9d7f0e66f98ea4b9d52a4d023586af0505cffccc39d3efb1fdc6a4afbb7b380d

SHA512
5f4dd1a40b74ce18abebe3b463ed41ac85ab7e6b25dc8abd0cb5ca165d17858f17470416cbc2bb87b829ca8359c4be50d24f7037a6c232fd317171a83914c0ac

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\R0FKS6Y0\ErinevV3[1].exe

Filesize
31KB

MD5
e17c0705f924990d70e8014a366dc2b9

SHA1
2b2aab97f22ba7184e2536be9f461de3e325ada5

SHA256
46dcf8bf7efc6aa068127e01c53a312fbd3b485d2d04d238058c0b702d199fab

SHA512
8a83530977aaf2e396715d7a7a8c837bccf07350271f7e8e4b33f943c220b27d0e0f38072df0d89c659d2549a3be2bcae5d8d085fb095000f73e56a06d8aa224

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jr2usy4z.neb.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/208-35-0x000001ACD36B0000-0x000001ACD36B2000-memory.dmp

Filesize
8KB

Download
memory/208-16-0x000001ACCF520000-0x000001ACCF530000-memory.dmp

Filesize
64KB

Download
memory/208-0-0x000001ACCF420000-0x000001ACCF430000-memory.dmp

Filesize
64KB

Download
memory/2040-45-0x000002802AF00000-0x000002802B000000-memory.dmp

Filesize
1024KB

Download
memory/2664-573-0x000001FC3CFE0000-0x000001FC3D002000-memory.dmp

Filesize
136KB

Download
memory/2664-576-0x000001FC3D2F0000-0x000001FC3D366000-memory.dmp

Filesize
472KB

Download
memory/3108-558-0x0000000002CF0000-0x0000000002D2E000-memory.dmp

Filesize
248KB

Download
memory/3108-551-0x0000000002B20000-0x0000000002B70000-memory.dmp

Filesize
320KB

Download
memory/3108-550-0x00000000008A0000-0x000000000098A000-memory.dmp

Filesize
936KB

Download
memory/4984-107-0x000002B0E3100000-0x000002B0E3102000-memory.dmp

Filesize
8KB

Download
memory/4984-346-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-349-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-335-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-334-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-330-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-329-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-328-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-327-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-325-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-326-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-324-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-323-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-322-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-321-0x000002B0E2020000-0x000002B0E2030000-memory.dmp

Filesize
64KB

Download
memory/4984-227-0x000002B0E3110000-0x000002B0E3130000-memory.dmp

Filesize
128KB

Download
memory/4984-109-0x000002B0E3150000-0x000002B0E3152000-memory.dmp

Filesize
8KB

Download
memory/4984-111-0x000002B0E31C0000-0x000002B0E31C2000-memory.dmp

Filesize
8KB

Download
memory/4984-121-0x000002B0E30C0000-0x000002B0E30C2000-memory.dmp

Filesize
8KB

Download
memory/4984-113-0x000002B0E3300000-0x000002B0E3302000-memory.dmp

Filesize
8KB

Download
memory/4984-115-0x000002B0E3360000-0x000002B0E3362000-memory.dmp

Filesize
8KB

Download
memory/4984-63-0x000002B0E2010000-0x000002B0E2012000-memory.dmp

Filesize
8KB

Download
memory/4984-66-0x000002B0E2040000-0x000002B0E2042000-memory.dmp

Filesize
8KB

Download
memory/4984-68-0x000002B0E2100000-0x000002B0E2102000-memory.dmp

Filesize
8KB

Download
memory/4984-60-0x000002B0D1E00000-0x000002B0D1F00000-memory.dmp

Filesize
1024KB

Download