hxxps://github[.]com/user-attachments/files/16311507/Incognito[.]zip

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/user-attachments/files/16311507/Incognito.zip

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Setup\Scripts\ErrorHandler.cmd	compiler.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2564	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4528	schtasks.exe
5104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
2252	msedge.exe
2252	msedge.exe
992	identity_helper.exe
992	identity_helper.exe
4744	msedge.exe
4744	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4556	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe
4556	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1168	2252	msedge.exe	83
PID 2252 wrote to memory of 1168	2252	msedge.exe	83
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 208	2252	msedge.exe	84
PID 2252 wrote to memory of 3008	2252	msedge.exe	85
PID 2252 wrote to memory of 3008	2252	msedge.exe	85
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86
PID 2252 wrote to memory of 3332	2252	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/user-attachments/files/16311507/Incognito.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc28ee46f8,0x7ffc28ee4708,0x7ffc28ee4718
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4807819792378274961,6397874154701080840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3468

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Incognito\Launcher.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:2564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4556
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Incognito\config
  2⤵
  PID:2576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Incognito\Launcher.bat" "
1⤵
PID:3312
- C:\Users\Admin\Downloads\Incognito\compiler.exe
  compiler.exe config
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2940
- - C:\Users\Admin\Downloads\Incognito\compiler.exe
    "C:\Users\Admin\Downloads\Incognito\compiler.exe" "C:\Users\Admin\AppData\Roaming\tmp\conf.lua"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3584
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc daily /st 10:11 /f /tn PhotoEditorTask_ODA0 /tr ""C:\Users\Admin\AppData\Local\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\ODA0.exe" "C:\Users\Admin\AppData\Local\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\conf.lua""
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4528
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc daily /st 10:11 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5104
  - - C:\Users\Admin\Downloads\Incognito\compiler.exe
      "C:\Users\Admin\Downloads\Incognito\compiler.exe" "C:\Users\Admin\AppData\Roaming\tmp\conf.lua"
      4⤵
      PID:224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Incognito\Launcher.bat" "
1⤵
PID:3316
- C:\Users\Admin\Downloads\Incognito\compiler.exe
  compiler.exe config
  2⤵
  PID:4932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Incognito\Launcher.bat" "
1⤵
PID:2540
- C:\Users\Admin\Downloads\Incognito\compiler.exe
  compiler.exe config
  2⤵
  PID:3780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Incognito\Launcher.bat" "
1⤵
PID:3804
- C:\Users\Admin\Downloads\Incognito\compiler.exe
  compiler.exe config
  2⤵
  PID:1416

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4548
- C:\Users\Admin\Downloads\Incognito\compiler.exe
  compiler.exe config
  2⤵
  - System Location Discovery: System Language Discovery
  PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
281B

MD5
16939f471f5356716cdafe74dea7d6b3

SHA1
bea3c097c794384960a7b21258b78fdd350dca0c

SHA256
21f92d288fc0ec0d2a1ab9bcff8884bcba9c637e9a810c3eee3e47e34ac3e485

SHA512
956119105e4334640f635866502c7e347c8c4d8fafd688a2e1397ebdaa92850d46e75823183ce856c28f5705520b71113ff4b80204a393b85758729c2134961d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
1KB

MD5
a16cbfee9fc8ecc88297ba806ccc576d

SHA1
34b28b0f6c1b5df0b063160a3d312e52b4911640

SHA256
891bcd2b69ca42290d19961f1093d4909ec7ea9524a692a41741383e754ace68

SHA512
a92bb53d84a451836fe4b66d6bf82f79ddd9119b3b5f9c7dac2bc1c5cf34d5fe919481ec746f31fe4ed7a6bc7c8d3ca16758726d06384c949bf24cb64a6a6645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
979B

MD5
979e41b6e144bdb24d4a4b0efd2a23f9

SHA1
7272d75da833c58b27ee264bec05859b0b8659a7

SHA256
abead8e00e65d83f7c5055f34ec15c29a478648975e416536446447e46da01b5

SHA512
3feb269aad6b612d66d49697083bd5c72d9be213a63c10c55702ca1df153ef868d48551419ff7d61861ab47790909c760c839e70607934e01c07b44d8ad142b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
471B

MD5
06d4ef8edd1c73f494ecee75432fe641

SHA1
95976c246de2ec6968114a0138b8b68993cb5a4b

SHA256
f22fd175507e06125893335823b8cd9e39e185f38caf563e6cd2f7f13dee4f8e

SHA512
461c7a1f2093fb54bf462ea2c121f8ea03a11dfb9f5841299e266ad365c2ffb8974f2f10fa7d2bdc7ac1b24df8f03b1dc671bc5465c9d1308bc30d8ffddf0fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
480B

MD5
93c2529518e6609d964996350f22aecc

SHA1
73488b7511cc8922a3ffe6822902e6f296113ba7

SHA256
2f884804fa0e111218a1de5449edc015f28388ba3323171aeedccc2ee6e87bb3

SHA512
29cb987ff0d7e62ad94782374a73448b3185f3f3868830bc49e16a958c117b56e5c8e1e56efc4505300e785f15d880600d9cee7966c474f2a83cb655dc05f4dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
20c8895ac2d24c58651fe05fb9ee812d

SHA1
89d095c2e796bfa64197b1cecc19f501559e225c

SHA256
defe708fefd45fc2d6ff1c8b8f2c0e4d7b50d97a4f86f2f6cd5a5ad2fac65e9e

SHA512
32154e3977522b644b62b13f5b622b9d399498c3c268200a9fdf38e1e85ada4bf79e65334d62b5d0dda83573e55722ca7aabe49db934c469bf4381843ee69548

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
480B

MD5
2521eead11030a8084e5958cf7a22943

SHA1
202c59b9021a05b6b1152f53e2f47b669b6be395

SHA256
4ce07070a1ca9276b6b409e64b04b05a95961da821fc9f237d1f9a543b189fc3

SHA512
e64656adabb80063b92be7f95169bc0d1b5225651435bea54a85ea0e1b0d6121b3d1b706e6c18a4083c259f8a20887ab815498705d5f5b06ea73c1aeb166410c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
412B

MD5
1c64762b093e2008344f0c79923c009a

SHA1
3fc48ebd2b880d69938c9dcea62b3b37b5d99cb2

SHA256
63d8a276f918ebb477698494a4ba67eae003b13aed086a1b3a5bfb17f59729b1

SHA512
453fef69eade62d2cbc2835f237aae33b8931b7e08ff2b327dfddad389b2d7ccc3d95a7a51b0cc8ca661f49509edac4444c2f773d27dcd8315e66312116d6418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a387fe5eae8467823fb37042ddbed9ec

SHA1
c6995207a3483e955a097ef981b80038ec65b636

SHA256
ef2879dd7686659c371e074668dce627f21dbef90abf0b3a32ab248e2f74e368

SHA512
e6ef01eb528de612992e2f41e2133767e054c22f54df81c78950eb25d7b8ec268ad4431e71b86d4a0a9c18d77209bd1a720422e68e4ab390380811c5c0117def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3128af762e2fcf490346e876055171e

SHA1
fd239dcefb6377fb34305affc6ca078df370dfa6

SHA256
5d39edcc40fab1d9df672c53233bf85036799cab6fcea7f8e9afda48a6f89c5c

SHA512
ba417d5fa9e3a019381cedc965211c420e397b7462c4028670337f1396039989bec0a21d62435d8451d448d254561651f9c323a5f36002e47881d989b9a70dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb7ee64db90a510662ef3f662eda71d7

SHA1
4057d3d4f050e9b9b056196a65f83b77db8bf5f6

SHA256
8fa147a22cca78a8d473f05067befd08e5dbece2b2abcfe2fe0f78751528a84e

SHA512
c5eea84450cc0e2767bceb7b5332ddf34a6298bc00b4c17ccbf78a47e5da3e7aae2505f5d601789572da231e5451339a3544506fc60f5c5177ecc1bf045c8808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3GJVVK7B\request[1].json

Filesize
896KB

MD5
6621f92e253c53901a45c7eae20938fc

SHA1
7e3759b02202ffaef0e2e41666edf7af66360b65

SHA256
1d359835b097d15a97f9f77359939b79e7d63697eb23de72c88d39b5467fc77b

SHA512
7616351db372c1c391ba5e3cbbada8db17b5d06dc03cb064eaa27083ecf101c3b7d1757ec8dca752200cf5b7118ffdcf818c09dd20f890a0f1dc564db3d1f05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BRZNMQLE\json[1].json

Filesize
311B

MD5
9105750f17d90587cfdb3073e3db4b41

SHA1
68299e57ccb94050710511c9fba7f144af55038d

SHA256
325bea9d40295cd711d613b7dcb0958e04a537f751b177573a9c40303a4879f9

SHA512
07fcd8e2811bc7d8a481694d32a8d220a03ec99dfd8b9f55de99ff8327d392c6afbd821358b5087e29120b5a6d706f258c723585d3c69a26c1b0c385722256de

Download Submit
C:\Users\Admin\AppData\Local\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\ODA0.exe

Filesize
782.2MB

MD5
6bc532e132b9d4cabb5c70d91c391968

SHA1
4d58d3eb8aefce5e1ddc30057ce96419a896615e

SHA256
2f5cf63f03c217e6220648d6a72f64d3b3813ea71c698bf3a7ee037403ecc86b

SHA512
2f35be062b8a131e5cf214eb66247430cc8f2af8567aff2d258b59250354e9aff724c47b1c16fb2d4f5b44dca82701ce2f1fe81384b547716d9f3e7cb8abe0ad

Download Submit
C:\Users\Admin\AppData\Roaming\tmp\conf.lua

Filesize
298KB

MD5
a6e82e3f005f61929f62c981670138b1

SHA1
71f15a319a5f8f353068b6463d153e7bcc4ebf23

SHA256
289b7cd5419091154d2db0c1c70e7580ccde22ebe59b03ada35e95ee6b530bd7

SHA512
0691bc3995e0bae2048c966a7f3c207cfd708fa691b2f95b85618c136ab3bb65d4201b4d9d690b3a3b7812c52c537175a91af6efcf98959ed5fca84aa7467cce

Download Submit
C:\Users\Admin\Downloads\Incognito.zip

Filesize
437KB

MD5
103a4f7233985dae7d3594fb05fc49ea

SHA1
4350cc9c6ec8fd9562b32f70ea59f2269f25f578

SHA256
c17ce4b3c21047ed3f3e40278e5c39ba3f9d66a099a2e7d74eb8c7725e8a87d7

SHA512
ab5b45f404dbfd349bf5d7f60a85b65645ddfe250c94731a64ade2f1b4935d077e678bc40ae7e15436e6aa2a7dcf03d2ef80e8461791b012b8c1dab0f753f8b8

Download Submit
C:\Users\Admin\Pictures\A5C5E2AE85E3447C9E0BC9A7B966D823

Filesize
1KB

MD5
e076fc74f26c343c8fa9e2229947ac19

SHA1
fa7e4408d40f33be8cde6dc990551c656bd9dac8

SHA256
994ee8c0a97073cef1b2fa0fe2d0bba0f6160d2a298833effc16e6bd3870f190

SHA512
a048d9d723eda7ec3b7916a791885d14c109cd348488e40847ebcdd361bca4f0048657bf24f13f2f5d9d8b92121139f8d200a1a604bba45c2723183e954b77dc

Download Submit
memory/2940-145-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-134-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-163-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-162-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-161-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-160-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-159-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-158-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-157-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-156-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-155-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-154-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-153-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-152-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-151-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-150-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-149-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-148-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-147-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-146-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-165-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-144-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-143-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-142-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-141-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-140-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-139-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-138-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-137-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-136-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-135-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-164-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-133-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-132-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-131-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-130-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-129-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-127-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-128-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-126-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-125-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-124-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-123-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-122-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-121-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-120-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-118-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-117-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-116-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-115-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-113-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-166-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-167-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-168-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-169-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-119-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-170-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-171-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-172-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-173-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-174-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-175-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-176-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download
memory/2940-114-0x000000007F5F0000-0x000000007F600000-memory.dmp

Filesize
64KB

Download