7693e0c9f20b5f90ebf95bbb807bb605ea0aa92f7fa30e4fd3d3d857db492dba

Resubmissions

03/07/2024, 05:55

240703-gml8yazgne 1

03/07/2024, 05:52

240703-gkytystgrk 5

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

voris.bat
Size

1KB
MD5

ad7217bf878a2fa8efdf11016f36070f
SHA1

e49a08f35b9f226bcbea78e1bfbe688d0defc545
SHA256

7693e0c9f20b5f90ebf95bbb807bb605ea0aa92f7fa30e4fd3d3d857db492dba
SHA512

5d9bba18ba248b7fcaba4a5a8426f2bd881cceb241983950086f0e6e06d639d7f8fb32ab45e6635768d774a523f0fcbe66b169070469111ef451d692cdfc66cc

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\System32\@WLOGO_48x48.png	svchost.exe
File opened for modification	C:\Windows\System32\@WirelessDisplayToast.png	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File opened for modification	C:\Windows\System32\@WindowsUpdateToastIcon.png	svchost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3169499791-3545231813-3156325206-1000\{BA47B073-EEA4-4E37-B00F-2ED6797F4BC8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
4584	mspaint.exe
4584	mspaint.exe
668	mspaint.exe
668	mspaint.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
1924	mspaint.exe
1924	mspaint.exe
3968	mspaint.exe
3968	mspaint.exe
4304	mspaint.exe
4304	mspaint.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
4200	msedge.exe
4200	msedge.exe
3972	msedge.exe
3972	msedge.exe
3040	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	taskmgr.exe
Token: SeSystemProfilePrivilege	1712	taskmgr.exe
Token: SeCreateGlobalPrivilege	1712	taskmgr.exe
Token: 33	1712	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1712	taskmgr.exe
Token: SeDebugPrivilege	3040	taskmgr.exe
Token: SeSystemProfilePrivilege	3040	taskmgr.exe
Token: SeCreateGlobalPrivilege	3040	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
1712	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe
3040	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4584	mspaint.exe
668	mspaint.exe
2092	OpenWith.exe
1156	OpenWith.exe
1924	mspaint.exe
3968	mspaint.exe
4304	mspaint.exe
772	OpenWith.exe
1944	OpenWith.exe
2252	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4080	3648	cmd.exe	84
PID 3648 wrote to memory of 4080	3648	cmd.exe	84
PID 3972 wrote to memory of 1604	3972	msedge.exe	118
PID 3972 wrote to memory of 1604	3972	msedge.exe	118
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4464	3972	msedge.exe	119
PID 3972 wrote to memory of 4200	3972	msedge.exe	120
PID 3972 wrote to memory of 4200	3972	msedge.exe	120
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121
PID 3972 wrote to memory of 4800	3972	msedge.exe	121

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\voris.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\batch.bat admin"
  2⤵
  PID:4080

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1712

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4328

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Windows\System32\@WindowsUpdateToastIcon.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4584

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Windows\System32\@WLOGO_48x48.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4348

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2092

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1156

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Windows\System32\@WindowsUpdateToastIcon.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1924

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Windows\System32\@WirelessDisplayToast.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3968

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Windows\System32\@WLOGO_48x48.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1944

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2252

C:\Windows\System32\-1hxuj.exe
"C:\Windows\System32\-1hxuj.exe"
1⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=-1hxuj.exe -1hxuj.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff2cc146f8,0x7fff2cc14708,0x7fff2cc14718
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2934587348469557725,7556121273244411898,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,2934587348469557725,7556121273244411898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,2934587348469557725,7556121273244411898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934587348469557725,7556121273244411898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934587348469557725,7556121273244411898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934587348469557725,7556121273244411898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,2934587348469557725,7556121273244411898,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,2934587348469557725,7556121273244411898,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934587348469557725,7556121273244411898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2af5aa13e6895b50fe90615e64aafd50

SHA1
2a617fd2dff763d012bb9e3f23054a421b06d822

SHA256
77d2d9ed000bb2697b72620059eba6ba080256ab6f835e03036ff130f5ba6f45

SHA512
c8971025c4dae936f0d927fa92bf930c15ab3153999a9b8d5029ee8474e0898c777e6da2ba9df8ead3801f35af3dab64f92e94cad129f7166418b7a8c23767d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a94f1d3cc254901a6d20a002e978792b

SHA1
b20cb94bda4df974449a818db7a2617dcb13ee81

SHA256
4c00e98734794bae1a667e8fa23d9b516acd3d0eeaec012936f0fb506072c720

SHA512
851d4b2202fab31489425e43d7a0ea0f62f20d26cdc69f2c45a09626ac80a7dbb3cdf833bc7ec621f5a54385a082070d11d1695b2cd964656db16eb339c826cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c9b9b60fb086c24961987c3f629189a

SHA1
f37e3949d97b8856d32653314fd3c2928834fe70

SHA256
3a63871fe40b349f897803de0e4e6109f7dc6588da7892c76250d186112e54fc

SHA512
a1f0f8b01284eff30629733ab4c894d4c36ddd9fa674ab0c489f9ea98271af60f0aaacf000a7070895166a4cdf19b3c287e890d2ced61ccdbd7c89b23b073427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
96adb3aaeec83a363c45d14483a3b9bd

SHA1
1cc8098cc104866953eadd7a27009518d13fc5db

SHA256
5ebeab9c6cf3505be1ad034dce9b7e80a4a54e04372b053819c1a395e06626e2

SHA512
24abd0e6936ebe981f9f450d9c1e808a0dd9aab657200d45e809af85d77b1fdae95b4ef6b84654c609b2e64cd0542a26ec0458295b843e708bd0d9a5a26909f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f636052afe11d1d2791eff086e45021a

SHA1
591dcd7e9d97030cd39fbfc8457c89b59a5cf9a2

SHA256
fd0a7f932be3b586c4ae86bb5f4c0ccb32d41229a54383430017d98adbd61b9c

SHA512
7a9bf23221ac2d2ccb5b5ba6a37f18c0f6d4852d0bf3981dee177cb882262453996a952ad7817e290a7b6e5a2e2f4843caa0bbc35406de7e12998cc4bc838c77

Download Submit
memory/1712-9-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/1712-10-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/1712-11-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/1712-7-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/1712-12-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/1712-8-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/1712-2-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/1712-0-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/1712-1-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/1712-6-0x0000028355190000-0x0000028355191000-memory.dmp

Filesize
4KB

Download
memory/3040-24-0x000001C1703C0000-0x000001C1703C1000-memory.dmp

Filesize
4KB

Download
memory/3040-22-0x000001C1703C0000-0x000001C1703C1000-memory.dmp

Filesize
4KB

Download
memory/3040-14-0x000001C1703C0000-0x000001C1703C1000-memory.dmp

Filesize
4KB

Download
memory/3040-15-0x000001C1703C0000-0x000001C1703C1000-memory.dmp

Filesize
4KB

Download
memory/3040-13-0x000001C1703C0000-0x000001C1703C1000-memory.dmp

Filesize
4KB

Download
memory/3040-23-0x000001C1703C0000-0x000001C1703C1000-memory.dmp

Filesize
4KB

Download
memory/3040-25-0x000001C1703C0000-0x000001C1703C1000-memory.dmp

Filesize
4KB

Download
memory/3040-20-0x000001C1703C0000-0x000001C1703C1000-memory.dmp

Filesize
4KB

Download
memory/3040-21-0x000001C1703C0000-0x000001C1703C1000-memory.dmp

Filesize
4KB

Download
memory/4348-42-0x000001BA2A4A0000-0x000001BA2A4A1000-memory.dmp

Filesize
4KB

Download
memory/4348-46-0x000001BA2A540000-0x000001BA2A541000-memory.dmp

Filesize
4KB

Download
memory/4348-45-0x000001BA2A540000-0x000001BA2A541000-memory.dmp

Filesize
4KB

Download
memory/4348-43-0x000001BA2A530000-0x000001BA2A531000-memory.dmp

Filesize
4KB

Download
memory/4348-44-0x000001BA2A530000-0x000001BA2A531000-memory.dmp

Filesize
4KB

Download
memory/4348-27-0x000001BA21790000-0x000001BA217A0000-memory.dmp

Filesize
64KB

Download
memory/4348-40-0x000001BA2A4A0000-0x000001BA2A4A1000-memory.dmp

Filesize
4KB

Download
memory/4348-38-0x000001BA2A420000-0x000001BA2A421000-memory.dmp

Filesize
4KB

Download
memory/4348-31-0x000001BA22320000-0x000001BA22330000-memory.dmp

Filesize
64KB

Download