540d1529f279d882c4ce93756624404efc183075834bffc8ea9ea6cbd55b9b39

Analysis

max time kernel
58s
max time network
61s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/08/2024, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

csghost-v431-only-csgo-vac-bypass-01122021-t174049.html
Size

15KB
MD5

1e47780ede956f07c9e2f1436a352ae4
SHA1

121c88ff34b4988a24d343ca71ae3b7275ec5286
SHA256

540d1529f279d882c4ce93756624404efc183075834bffc8ea9ea6cbd55b9b39
SHA512

4a9c65e90f5db31168e477d48acfecd5301cb6450c82c4f54a47159b4c7638df285b6b4283603a7b8d5621fbf08d18d6ca18c3aee81c9086b9277627a4afe682
SSDEEP

192:PNxyShvK9moqTJkNrv236cdVcycuijbBNBacYWhfNXQR0ik4j3yBcxN:yShi9boJkNzUKNA0f5QNkivN

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
36	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSGhost-v4.3.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSGhost-v4.3.1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "135"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3761892313-3378554128-2287991803-1000\{7D695664-500D-4DFA-A21F-CDA0CB5FC528}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CSGhost-v4.3.1.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
4516	msedge.exe
4516	msedge.exe
916	msedge.exe
916	msedge.exe
3552	identity_helper.exe
3552	identity_helper.exe
3668	msedge.exe
3668	msedge.exe
1936	msedge.exe
1936	msedge.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe
2244	CSGhost-v4.3.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2244	CSGhost-v4.3.1.exe
4720	CSGhost-v4.3.1.exe
2732	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3328	4516	msedge.exe	80
PID 4516 wrote to memory of 3328	4516	msedge.exe	80
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1540	4516	msedge.exe	82
PID 4516 wrote to memory of 1280	4516	msedge.exe	83
PID 4516 wrote to memory of 1280	4516	msedge.exe	83
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84
PID 4516 wrote to memory of 3884	4516	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\csghost-v431-only-csgo-vac-bypass-01122021-t174049.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbec733cb8,0x7ffbec733cc8,0x7ffbec733cd8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11901704760579450999,15982457974586253523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4744

C:\Users\Admin\AppData\Local\Temp\Temp1_CSGhost-v4.3.1.zip\CSGhost-v4.3.1.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_CSGhost-v4.3.1.zip\CSGhost-v4.3.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2244

C:\Users\Admin\AppData\Local\Temp\Temp1_CSGhost-v4.3.1.zip\CSGhost-v4.3.1.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_CSGhost-v4.3.1.zip\CSGhost-v4.3.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4720

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db1dacae9540e883ae83489b18cfc326

SHA1
ec3b68e635d8ce3bdafe258bca5187536d43065b

SHA256
3427a8a3b4868bd25a231ee8fe0ebada0b3474f2d8dc0fdd01a8931a8700a37f

SHA512
2e40df3bd1a045c69173f1a169b7080163de8f62a44d41d46c28f1643943657c532caa72f65b44a2175f976fdfd3d8328d989e011730aa851aecbcf02dde4a95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04aa3f476e468ef3c0866e8dedd8f6e4

SHA1
1e9fa8fd586c03447a4c5b4cee261900e9f464ae

SHA256
87b74207d65f6745b38a19dce13336ee839fb4d7929fce446c3d1177aa80c42a

SHA512
7d860bbe9c847ea0b60f210860d865f1e936aa2210a6f9aa87e9fd72f992a022ecb9a1827212eb9b97dd7798540770f55c67362714d90d0bfd080ad1e5e7aaa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1443b60b2cdd79597555057f35c4ce24

SHA1
ea086ac96dca9bb5cd886f2bb2b523ca51fefecc

SHA256
773eb611bffd057d049dd0f2d0a919cc5a985463a31a08bd81df1132e8acf404

SHA512
a2e917bf53797fc036a078de5ff90242d99f6c8c67bc59653f9f1afdc5eb5cde3ad51def5da087399015d0b81f60808a96d725f873f9332b4246673f38ba1e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
865B

MD5
79a32318015922b8c4a7ccd0f77d897e

SHA1
6002323f4ec5559380753c3397d8448fa17578f6

SHA256
f92e2baeafd7ba442d0266fba4acc7f62431896143b0d65f130bd46cf17a5c16

SHA512
9f82be42cb724b8fa5e1891439629cc3ba0b05116d16bbd0aaf5409dea3a49cc3d15340e7e03d9639d56de766f8d7e2db4e89882bef28be27fe3da1b39ae8e03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a95a180e03d89b33f0d75084c29205e9

SHA1
d28bca0e847418142303c3cd5b9d5cf5a9eb54bd

SHA256
4e5e09828df6451af5a3a32f56f3bb56f94b08b9f6a64fce2574ea9573bff252

SHA512
09b4aedc309c1ae5b72a8de130584107e15d07db3d5f981625130d5fd3b924af87a1f63d88dcfbf10c04a8b347da97ce0dac27ec30b893ee2ba9a10be0fbbc1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45e591de4227d0c8ab7131e1894cc213

SHA1
173aae5f348f7eecd47ffac93195d6544575b3b0

SHA256
6ec06f106784dc2e469ac5e2fe66d2f3e09ef03ad79e8421a2765f0fb20c7d17

SHA512
e68266a2de052259bfab0403ab194d12e9dfe7b37bbc8265decc0b4f7797c192f0576437032061e8f7e31e490c4b3dda13776f01f9ccf80f7141749467a6c2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7768b3f6549be3d917636381798ced0

SHA1
5f05f5de96dd35951c6040c69105d6670ab3b717

SHA256
02e5d71c25a630b3e581e16b6d9eb812a7e3ab6347ea4f65ff75b4b7134e5ec5

SHA512
221ad4301fd59818d55ce1f5ec13f3feefaf08f2bd8718dce64fdb4932ad89cf6fe109e86432b84eb69e64d31f7f4e12f2e8b0ac029caef735a62468da5dff57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03a1695db04f22343dabd0f52a7bc4c8

SHA1
0ca1f6c19dae91cf6b4fe466d7123f1e96b3bfc6

SHA256
03a02b874663123593dc32924a0b6eb7e06d6b81e1e7969846baf0a6cf571797

SHA512
34772d557649472441f4483595cae2a84458202068b20653f40a9a6a10129a1c88c6f2f4df121d38922b823fcb46a0db6b46bb0d7b33807d940f95936c5496d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4fa22810630b4e19d0acf1065d0191cd

SHA1
2148e335fa8508a2a309bc91dfc1792c0c01bf63

SHA256
260415e9a68807b131159d121aa7b137a668639f84687cd3fdaf3613cc6e25ba

SHA512
ef7f5eff24c96d24c080dd241e59bca92ce1ba0d01a3d32b473650589b6ff938a8d489106c2df9ca8614c3e5df4c5f1886a40c629b089e6f1202f9232228168e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
a34680f8b1266e2832acacdd5974cb48

SHA1
8ed0a05cd9bb03b4990ba77cc79662cacb1e9700

SHA256
cebd372ccf5372c18ce3b746cd8dff2d0e01ec59542d1b3079887f9a8d1d1c21

SHA512
6e4739b7489525c9979dd92f7c480d9574b4215aa92f65edee6e5db9aaf555d9c0ba578d6b6ad92c839648060157967e97a16fdb9d66ce173db6f7c82dd8562d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
93d1a2d92421648d40499f83f37fd214

SHA1
868504975e476e7135dd148ae1a264c0a97d3ef4

SHA256
52898fa858c16d317cfbb1e20eed50139409dda779420b8a709e73fcc064399d

SHA512
d30ca054a958bd8594867325026acd75cfc51acf38bf2ee26366de363302a3db4b71ea2dbfdba25eef637196caea51ad3b8e37c0260ae748fbd49eb9f48a991b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58023d.TMP

Filesize
1KB

MD5
7215e7152f509f7f4c0dbeba425c1561

SHA1
33363438ba8f8cc2e8c07e20c8b5b901a9f29174

SHA256
375dd7548b9eff119ef65d1569a9fb795fb20b3fff4e21a5cddedbd723384401

SHA512
8bb08c56a79db9d0dfa3f274c68a8ddf2f0ae12fe4a94aaf20a9455cffb64bdf0793174753ef801377d9ffaecb8888476fa56497676163618da0e35c72e649c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d4f140ce1ea77996c5bd00bcbf19e3fe

SHA1
ecbf3cb8e038cfddaec149b92bba2b59b278068d

SHA256
23ceedd33e52e0da7819dcff47c852d66497897f04c480a41dc5bc9061b9c4a6

SHA512
1cc1b8661a5a51580cbf6f485e6d14a81ea73d6861f6b07e14b070f442c1a3ff7fafcf5065d76c51925c8832e8b7276022a35ef7f003ddf91df84437422ab278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d4c4ac82d62ac9138c78c8a50f666343

SHA1
0fc501cc91a3f1dbfd10034a8147064b27ecec45

SHA256
a9feb9ed4b44503c948da3883f3a5db39a90d60272d6e5d51689ac7131a2a9af

SHA512
1513bac2b5bcbb80e20c8497454017d379d4647bec3c2af9cac7c62f7429ad10a44de521f7863095197ea28d0ec33bc684e5154e3c5eaa36f34f117bab1f8df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
410f6603f4acfcf341398e639191d9ac

SHA1
4f7398b1ceecc411e7cc3ef5e2a194148103604e

SHA256
2a9dc815810ce9980888e8f5cad3c11b49a4545580c55d98994ebe60a91bc96e

SHA512
d05cb16422c6e6a00554c80d4d118258f17e6adbef2d81b3b4e00073f397992e1b3ee06681b73b77360bd9f641c7d38f94467b0c2da1bc9156fd538fbdea29ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29ee13aedb5146f1401892537a489b38

SHA1
6e76ede207845e003282dc3359e2f39bebf3feeb

SHA256
f140b241376a6252c30618f28143ca20d55f1510f904f755a8268f0caac2ccf3

SHA512
06a616153004b4c289d153760f68f9bce244296050403be4bc9ce3d47e74b674d056bb39076caf22e17ff91501f7757a41f2b72840a010afdb646e4e5a1d5497

Download Submit
C:\Users\Admin\Downloads\CSGhost-v4.3.1.zip

Filesize
51KB

MD5
d14883877aacd85d8354fc6942f7add2

SHA1
b3a660cfe3966d47516799e1786f6b75ae49c327

SHA256
84cfa357254df35f283a7e6ed92f8ccd884d7a699f9f8069668030a932c4afe3

SHA512
185189b67ca0808dafb69e9213f6d0e32b580b3d3b78983d39dd59be88bc724a546da000c8024c0db0c24104bbc915bbd6a21068965a3ea37c2bb09894ccb160

Download Submit
C:\Users\Admin\Downloads\CSGhost-v4.3.1.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit