63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d.exe
Size 37KB
Sample240709-1qhvgazbmd
SHA256 63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d
MD5 3f1a69114973976a39193cfe79aa30ad
SHA1 c84519598c3fb4814131aa48c923a851f42b7245
SHA512 7e0452e05c9045810330b5f151e206eb9fbb4b6525fad74bb1849ca8cbe02ba4abfe5bb7ae135f108b74e33125353393488dc7593c7bbf968692550ef02d38d9
SSDEEP 384:KdGBkiyRnDNGRn5IyUvoIdf1hg/SuswcrAF+rMRTyN/0L+EcoinblneHQM3epzXM:UZ5M5jUvtdAaufcrM+rMRa8NuDmt
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4152	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5776aa158eaa1a907c5b1eea33fc8a4a.exe	SHELD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5776aa158eaa1a907c5b1eea33fc8a4a.exe	SHELD.exe

Executes dropped EXE 1 IoCs

pid	Process
996	SHELD.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5776aa158eaa1a907c5b1eea33fc8a4a = "\"C:\\Users\\Admin\\AppData\\Roaming\\SHELD.exe\" .."	SHELD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5776aa158eaa1a907c5b1eea33fc8a4a = "\"C:\\Users\\Admin\\AppData\\Roaming\\SHELD.exe\" .."	SHELD.exe

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	D:\autorun.inf	SHELD.exe
File created	F:\autorun.inf	SHELD.exe
File opened for modification	F:\autorun.inf	SHELD.exe
File created	C:\autorun.inf	SHELD.exe
File opened for modification	C:\autorun.inf	SHELD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe
996	SHELD.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
996	SHELD.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe
Token: 33	996	SHELD.exe
Token: SeIncBasePriorityPrivilege	996	SHELD.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 996	2752	63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d.exe	84
PID 2752 wrote to memory of 996	2752	63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d.exe	84
PID 2752 wrote to memory of 996	2752	63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d.exe	84
PID 996 wrote to memory of 4152	996	SHELD.exe	85
PID 996 wrote to memory of 4152	996	SHELD.exe	85
PID 996 wrote to memory of 4152	996	SHELD.exe	85
PID 5040 wrote to memory of 4736	5040	msedge.exe	92
PID 5040 wrote to memory of 4736	5040	msedge.exe	92
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4332	5040	msedge.exe	93
PID 5040 wrote to memory of 4324	5040	msedge.exe	94
PID 5040 wrote to memory of 4324	5040	msedge.exe	94
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95
PID 5040 wrote to memory of 4376	5040	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d.exe
"C:\Users\Admin\AppData\Local\Temp\63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Roaming\SHELD.exe
  "C:\Users\Admin\AppData\Roaming\SHELD.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\SHELD.exe" "SHELD.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\MountAssert.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa57bd46f8,0x7ffa57bd4708,0x7ffa57bd4718
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10302951916577217948,16912230707334719530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e
MD5 54aadd2d8ec66e446f1edb466b99ba8d
SHA1 a94f02b035dc918d8d9a46e6886413f15be5bff0
SHA512 7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e
MD5 2f842025e22e522658c640cfc7edc529
SHA1 4c2b24b02709acdd159f1b9bbeb396e52af27033
SHA512 6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05
MD5 SHA1 SHA512

Submit Download

0fd1b73e-7b6a-437c-aa48-447bd722332f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fd1b73e-7b6a-437c-aa48-447bd722332f.tmp
Size 6KB
SHA256 5fc50d74ade6ffc301c9103827765a9017a8baeb105f06a6fcb861234c20383c
MD5 584ec47cfd032c0f226f3f5f42113798
SHA1 75f0b2d4862abb3cd5898b38a291eed900c6c161
SHA512 c2ec86cd73ef41f84e7e570be38b863793d30980bee23736dac2118b2535bd256702f7147475a3f7aca216f437164211762ee570f0d0cd8b60df5a93d723c780
SSDEEP 96:nBkyoS1usZkQqRwpvWMoiVmdeHc7VZryWQyV+VD7AiEwb:nBk4gsGQqRGWMXGZrlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 180B
SHA256 45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed
MD5 00a455d9d155394bfb4b52258c97c5e5
SHA1 2761d0c955353e1982a588a3df78f2744cfaa9df
SHA512 9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b90f9238cabdc7e74aed55811ecf810143109365d7b312f0b2c8d00f447f197c
MD5 c413d36b8bc5abaefb8f7692e4d68077
SHA1 4264cbd5a5d50ed1b21432ab325fcd0be51144af
SHA512 d53026be049a90f318bd4e8ef14b504d7a36b20f514b7a1ee9f02caf98845e528b7c36b523d48e0476b28e5d00d6ed522fd2a732310a52a38ad0e7a58495cd93
SSDEEP 96:nBksoS1uiZkQqRwpvWMoiVmdeHciQ0UWQyV+VDCziEwb:nBkSgiGQqRGWMXw0ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1df0fc80cdcb51d537c36fbd1f74630c66e0d9da0840c53302074cd3916be17a
MD5 e42dddd62af885a845d21923642d9735
SHA1 37fe73dc871929be1897231cf6fbc15a23878417
SHA512 9a0437e880887f9f4c6bcf6e9970435673afc07fa6549f97e4210387d3db3678e17c6976e32bacb3d70cf720172ad83a4acb6198c8d88e001926146afab359f3
SSDEEP 96:nBkQoS1uiZkQqRwpvWMoiVmdeHciQ0UWQyV+VD7AiEwb:nBkGgiGQqRGWMXw0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b63c3100c646160b2224a13ccadf7eb32e6eb88b04f14b0520880cebbf27eeb0
MD5 0e9b572725905328706e85d8aabe48d8
SHA1 23b96596c629e59ac68d5eb026190c60413aa5a7
SHA512 4b0493775f9d95ff9af059e40b014f09c8a9c8d3634f2bfd9d21e5c233072b67f0d061439e44941628338b44077085d6087f6bec1587094976e7048c82be52bf
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupR+e2RUb/70WLgcTzwxAUL1:N9iIxuERzA83h09RZxYRgYYWEh01k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 817daea83638f7ca0f7a9e10e7c95f17f881d1a45f9f558238a8d86e915f1672
MD5 4d67dfb0e0e9cb0addc0faeba9312d10
SHA1 29a898f2a69d609a0ff27d8efdb988f50821ff85
SHA512 f55ec93a386951d647f1098758977e9f992fa2190f9f480c6428b265187cf69a40e274591f97a8be0edc1699f5a306798204cebd72a916b7471b08071e944c2e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupR+e2RUR/70SLgcTzwxAUL1:A9iIxuERzA83h09RZxYRgkYSEh01k
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHELD.exe

Path C:\Users\Admin\AppData\Roaming\SHELD.exe
Size 37KB
SHA256 63384efdad4c0f6dc67bdf47f14d9875ad062627656dc888855e75ddc875419d
MD5 3f1a69114973976a39193cfe79aa30ad
SHA1 c84519598c3fb4814131aa48c923a851f42b7245
SHA512 7e0452e05c9045810330b5f151e206eb9fbb4b6525fad74bb1849ca8cbe02ba4abfe5bb7ae135f108b74e33125353393488dc7593c7bbf968692550ef02d38d9
SSDEEP 384:KdGBkiyRnDNGRn5IyUvoIdf1hg/SuswcrAF+rMRTyN/0L+EcoinblneHQM3epzXM:UZ5M5jUvtdAaufcrM+rMRa8NuDmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/996-26-0x00000000752B0000-0x0000000075861000-memory.dmp

Download

memory/996-25-0x00000000752B0000-0x0000000075861000-memory.dmp

Download

memory/996-24-0x00000000752B0000-0x0000000075861000-memory.dmp

Download

memory/996-14-0x00000000752B0000-0x0000000075861000-memory.dmp

Download

memory/996-12-0x00000000752B0000-0x0000000075861000-memory.dmp

Download

memory/2752-13-0x00000000752B0000-0x0000000075861000-memory.dmp

Download

memory/2752-0-0x00000000752B2000-0x00000000752B3000-memory.dmp

Download

memory/2752-2-0x00000000752B0000-0x0000000075861000-memory.dmp

Download

memory/2752-1-0x00000000752B0000-0x0000000075861000-memory.dmp

Download