hxxp://malwarewatch[.]org

Resubmissions

03-08-2024 19:41

240803-yd9fjsxgpb 10

03-08-2024 19:38

240803-ycw4tsxgkh 7

03-08-2024 19:34

240803-yadvgatajk 10

13-05-2024 19:48

240513-yh3tkacb38 10

Analysis

max time kernel
100s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-08-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://malwarewatch.org

Score

7^/10

discovery persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2072-463-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\Run\2503326475 = "C:\\Users\\Admin\\2503326475\\2503326475.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\2503326475_del = "cmd /c del \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_HMBlocker.zip\\[email protected]\""	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
63	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TaskILL.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Spark.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\HMBlocker.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4972	msedge.exe
4972	msedge.exe
3712	msedge.exe
3712	msedge.exe
3272	identity_helper.exe
3272	identity_helper.exe
4136	msedge.exe
4136	msedge.exe
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]
4236	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	[email protected]
Token: SeShutdownPrivilege	4992	shutdown.exe
Token: SeRemoteShutdownPrivilege	4992	shutdown.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2760	PickerHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1172	4972	msedge.exe	79
PID 4972 wrote to memory of 1172	4972	msedge.exe	79
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 2480	4972	msedge.exe	80
PID 4972 wrote to memory of 4772	4972	msedge.exe	81
PID 4972 wrote to memory of 4772	4972	msedge.exe	81
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82
PID 4972 wrote to memory of 2296	4972	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://malwarewatch.org
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe42c73cb8,0x7ffe42c73cc8,0x7ffe42c73cd8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1828,15736007683132952401,10739596460423699780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4912

C:\Users\Admin\AppData\Local\Temp\Temp1_TaskILL.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_TaskILL.zip\[email protected]"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Users\Admin\AppData\Local\Temp\Temp1_HMBlocker.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_HMBlocker.zip\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
PID:2072
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 6 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4748
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\AppData\Local\Temp\Temp1_HMBlocker.zip\[email protected]\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4024
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\AppData\Local\Temp\Temp1_HMBlocker.zip\[email protected]\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1892

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c9e97e0714480243d6086944aa5be15a

SHA1
95bb4d500cab40c3566a633119ff2a0747ab4cef

SHA256
8fe7cd57aaa2519eceae7288ebd43fc344414aa060235855e5a6dacc5d9f5ac9

SHA512
ad7654e465cf0c5ae83cd510142e18e97b9f5042644adf7fbd98a5d9bcfb41a74cc645ed639670f230e28174665caca1dc6e22c92a7694999ccbf9f60611c151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
527cfb390ff53c2b2bdfd51af87abe5f

SHA1
825f77ffa6637a43f86c897f3800b9a04eed8882

SHA256
607fd5c9c312294016052e36aca938259edac248753901c9f8f0b374d7a4f23a

SHA512
5c1e9ffdaf4c7361a1eea334342375f6ef794f0c1fd11ffec245590c95646843a9f706daab05ac94becd765542f78a0a67e7a4d0c6dc5fb7c8dff6164d7ef6ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce7bf20dbe19ae7829cec3f3984ace4b

SHA1
459815df8fec2bb03c8d0eb24e1bcf6686600f9b

SHA256
a7cfd8542aaae9e17726fdb09821bf678b50ac51e0ce5cc345cac2654a9c1e9c

SHA512
9d6c3ce70562cf379c1aa8f471b8c0834347946295530a5a7b9c743847abcd25f2efc4b4100dfeb2fadc11c63ff46ac733a4388d6430bf1adf8c4d85064a909e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
28604704663ad967290089d7e1901195

SHA1
b3aef56deb4c91a7ac9aa847737376e34c53e991

SHA256
76df45dfe19fd1a41fc0eed2b215b3e747227bb50cf7aad162f407a8bc46f24c

SHA512
b1fc13f47c5d47512b3fa844d4b2cd09c83ffa0771e4dc5d9f6b8b830d7f8317905942cce8cf8b8355467850d122cf7b9ec1cf6e7dde6e8f72df91779f82e22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e5811cb85aba9ce44fed8fc391b944b9

SHA1
9a1823a16c72a3d20b709fa43b6834bc8ad21b19

SHA256
aa9c28c4d4e87ff06edd21b90738cbc646ad2bdc7ec027e7236ba30e2bbd45f6

SHA512
881e8a79c9c88ba3d9a6935ace703b1ef0327cfb4e4668510d2b9afd387867b6d3946bb767ec7672234bb16ade671b77ab25359604023236866a7d2620a69f67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d5416efa75bf7f7cb79193c3ae85ffb2

SHA1
304c8960f3dee501d8ab02934bf41dffa72f5609

SHA256
6b0f058720aac8bcf21c5a1aa7bf4470357bebe2333c5f98d6a1cf86d80676da

SHA512
d50bbefc1344a14ae718669d39f2ff47f0743082245ec96f11c941e5de1d1964de8db6da5b58dc5e651cbcfdffa36080fb2a451e8ebb826f64d55e987632d59d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ca890bd5acc7eced904c96b3b3b0eefd

SHA1
1980343b67920573e45eb5e827bb5af8ebb53b8b

SHA256
5f77042a3dc47b4c3958d473176674e69ee30e7c66aaf817990fb45fb71c7c90

SHA512
b06d38a910d95244e39a578fc4ba14a27c0e598056defe263332e4806d2a37b6d1dd73beb1482abaad01ce67838dd6a0dafd4c66873046f9bddc15a050f5a1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f03c930afb1a1e955031b6db5eac40d8

SHA1
b226009f0a4449f4135a54003445e017e9d2636b

SHA256
6c0d0664f059cff80f9672935e05983d345390d4d7f68ba939d49454a83375b4

SHA512
91d149804551adf7f6467a1c94b96f242f5a4eabb8b2e21a322ab82acf28e011c7e5c458aa6b743f4e97fd6f83a9e59173dc1d9ce532abeff2afb52cf798f2a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e82d.TMP

Filesize
1KB

MD5
db5bf94defa11002096a2ed0fae8e294

SHA1
bcbfc82e307ea7c475fd87a81f35edd5d8b52f55

SHA256
8ff2600f56287b445145f9d2e2d1ef49633b1e764476e9a3a60121df81d2b3a3

SHA512
14260da0004857b62d872d10bedad6516c4808745bb28e767b4490ef3f42f332c3c557799aac95af41c2a89529dfd7ba4b6a5a41253c117fa92afe221b3bc120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cb9b6603d594030380860129091a7f5a

SHA1
c710cf7eb078d29fda5cade95770df10b14b682e

SHA256
35a1db9b947248a0ba9712516f590f2f67f87bd1c60f5a83ba639a219eca9e19

SHA512
53d4a53064c829b756ee974533dcdbd1cac25ba60510e8ea7f4cc17a7e0ec855d71c9dc0dc41bc0c45f6223dc53017cc0d8982aa9c65988af8563a7a22d99f20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cd555f979e25f3ee55f8e90c71fa366b

SHA1
1685442b574c6df5cac3004f5d47d1c9dd6bdf0e

SHA256
627a691b9c675b9a9b0d095906e8fe08e0dd2b1630165c980402828e0e4437be

SHA512
785e8f6805730c3461f49b3c4f4b0f0fd8240f2022f23c1151923cb6dac744275344d8d4610e42e7e1754010c99678311b821cfced6fa44d5bfc3d34bc8c89ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
77a24686a83bd5bb9defea69b0b4fdaf

SHA1
787c88bf94d8044f5748afc11d06da749cd36d78

SHA256
5b0da3daabe87b2f43783943ee31349ac5aff6f9d3e9eed843250f6ddc57aec1

SHA512
b2742cedc58be7b213b4334330bca26280c49784f12d131fa745a323d9208a3b4f4ebaf6959d3683e424b52bc5ec2d3d972df9818fd2b3db89756008c5770fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b04825bfe41395c1238250c5d75bf21c

SHA1
36d54f1f8e99a83395d4bd4a0dbe6e85acd08b55

SHA256
e0eb373c00f566afbc1217a3200bf0a254f4c918b4f9a5ca8bdd742f5b2abe76

SHA512
e33512360126d4ca9bb0080906a71f63da25454d89b4fe22abc3e1ce24e99cbbc0e317595e2a5c288062dd7ec119f62ce622d7e5a35fdc8d67e888195fb24b6e

Download Submit
C:\Users\Admin\Downloads\HMBlocker.zip

Filesize
38KB

MD5
5968e8a8caa61b46ba347f8c521c1f2e

SHA1
88f9a7ce6e77d191c9a57ecf238ef5e9e9ba6c7c

SHA256
a181f8925c8c66614be38de89e6dc38cf85715379a10de8d9f9d70b04891ca35

SHA512
6b0659ff7a5548cd1b752a72a70b147d1c9676dce14148430961a7b5204d4e3a42de5530d423ebb879f8e5c72785a45e5b20bd40cbf93cfaefe981534e96cbe3

Download Submit
C:\Users\Admin\Downloads\Spark.zip

Filesize
1.6MB

MD5
860168a14356be3e65650b8a3cf6c3a0

SHA1
ea99e29e119d88caf9d38fb6aac04a97e9c5ac63

SHA256
1ae2a53c8adc94b1566ea6b3aa63ce7fe2a2b2fcbe4cec3112f9ebe76e2e9bf9

SHA512
0637e4838beded9c829612f0961d981ee6c049f4390c3115fed9c4e919561ad3d0aa7110e32c1d62468a7e4cdc85d2f2e39a741939efd1aafae551de705aab61

Download Submit
C:\Users\Admin\Downloads\TaskILL.zip

Filesize
14KB

MD5
f3f982622520af32cc86d3a22f352af0

SHA1
99b7c8a8afa3cfc7292893d7b2253a581249d9d4

SHA256
653b5c625dc6f24dcab5aaf33e77fd3c994f4783884c21d0a71b5c1fefbeb4e1

SHA512
27482f0293b88c1a31dd1132401b4df19d3636f1a31f2b607ccf9a28dde0165381d65d9d0c492ab6c300bd1da0aac9e8df8c7cb3394cea35c90ce1a544a0576e

Download Submit
C:\Users\Admin\Downloads\TaskILL.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
memory/2072-463-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2072-466-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/2072-464-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/2072-465-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/4236-352-0x0000000000110000-0x000000000011E000-memory.dmp

Filesize
56KB

Download