hxxps://drive[.]google[.]com/drive/folders/1_KnW0OvqXtY9kqttht79WMbK1xVTewPk?usp=sharing

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1_KnW0OvqXtY9kqttht79WMbK1xVTewPk?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
716	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
4588	msedge.exe
4588	msedge.exe
744	identity_helper.exe
744	identity_helper.exe
640	msedge.exe
640	msedge.exe
3796	winvnc.exe
3796	winvnc.exe
3796	winvnc.exe
3796	winvnc.exe
1504	winvnc.exe
1504	winvnc.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	taskmgr.exe
Token: SeSystemProfilePrivilege	3192	taskmgr.exe
Token: SeCreateGlobalPrivilege	3192	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
3796	winvnc.exe
3796	winvnc.exe
3796	winvnc.exe
3796	winvnc.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
3796	winvnc.exe
3796	winvnc.exe
3796	winvnc.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe
3192	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4528	4588	msedge.exe	82
PID 4588 wrote to memory of 4528	4588	msedge.exe	82
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1448	4588	msedge.exe	84
PID 4588 wrote to memory of 1496	4588	msedge.exe	85
PID 4588 wrote to memory of 1496	4588	msedge.exe	85
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86
PID 4588 wrote to memory of 3740	4588	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1_KnW0OvqXtY9kqttht79WMbK1xVTewPk?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd183e46f8,0x7ffd183e4708,0x7ffd183e4718
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,11945452265504853812,16006556576893353520,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\client-20240808T173048Z-001\client\main.bat" "
1⤵
PID:4800
- C:\Users\Admin\Downloads\client-20240808T173048Z-001\client\winvnc.exe
  winvnc.exe -run
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3796
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:716
- C:\Users\Admin\Downloads\client-20240808T173048Z-001\client\winvnc.exe
  winvnc.exe -connect 192.168.1.36::4444
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:4788

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3192

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\client-20240808T173048Z-001\client\ultravnc.ini
1⤵
PID:436

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\client-20240808T173048Z-001\client\main.bat
1⤵
PID:1976

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\client-20240808T173048Z-001\client\ultravnc.ini
1⤵
PID:3440

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\client-20240808T173048Z-001\client\ultravnc.ini
1⤵
PID:1288

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\client-20240808T173048Z-001\client\ultravnc.ini
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1aa30b01-0357-4ec9-9289-2a27a50633bc.tmp

Filesize
11KB

MD5
b0889a12ce5f8e947d931d42fb2546ee

SHA1
3c8b1a2f3e928b670a1cea1484ffa7d7f4bfa3ee

SHA256
80baacaca9868b48d4c76cc91036907881b98b5d388b7efc5205f0f8a570c49f

SHA512
667df177a0f5515f168010510c0fcee9a3b4fba5a9e1eeafdddf7e209c927893af528319c262e534af154ba2dd3725210538dca9e204b54e51ec0f1fbee50dcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8e68d26fd9624ac783a6c5587846dd93

SHA1
5913f46258fce50659fa244911e9104cd5a809d3

SHA256
ae02db3e83549d4075207d3f4fce8355a6cd19b6d85fe9f36186f20b22557d2f

SHA512
2963031308558ea4ad8ac94949c75da9b1cc629a9aa25e9affb4185491bc38b5d6860847e1b999df23106d17d8e6a213bc8d31c01c9facf59ecbe39cce164f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
de6dcae3c08d0aa1bd9e187a237a559b

SHA1
f292e827778d6ab8ba7a60bf443fbcab281b1097

SHA256
0bd7349fe9e902c7011bb0673e63510459a6b2976aaa25e645e249d855cc7688

SHA512
ac4aed3406ce08bea93b088cf53356b76740e853799d163c2ccbfab4dfb785dc492b41efb32da9a338055a31ce231d8d4c331a87db5d8db4fd2df458a02cfa64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fcf5eb38fabb779a0e00cd205740e73f

SHA1
ec2dfbca14b5ae4bfdace1226edc5847cc24d9f5

SHA256
d71e11bc902a2b804a66b3db714c1c87737c0d6edeea664a550c43fda48d1fc8

SHA512
2fb24f495621b267942ddded3b2eda81ccd26e3c07706e216357c36ee9120d4860214739276a895b0482d00e77bda681b22bede806fa447eca82ef1834898722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
70940af84734750424564c0e888affaa

SHA1
5929cf93ae4126b3e9e1a85b505c8650f64922f7

SHA256
1804539ad1dfcb8577d87ae42efea08deb1793bd327563b534dd01631df524cc

SHA512
1ea673a1c16ac1338d2ef65af1a3297856d2c5f31ce5b3d1c9bae95baf1ba25d5a4da2eed4b352d51b90c7601ffdb10dcbb5c9faf3ab3194ad16cf5d3502d333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40b02c4cb9d0ceae9b1d153c80f330ea

SHA1
7af0fe0d069ebe66dbb839de35c22cfe85ebe909

SHA256
237c51bc1485bec94abcf2dae08fd9b8dcb425e2adad8820d960aecf0f337abd

SHA512
7ff3abfc12b8dff0c22dda7f3ab4170ef878ad930668a456dd59271cd7dd1e33f6027a79d0aee611a52f264caf21efbec4c1d21f83076b7dbfde28f9152c1b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eaa985d1666df09432e380dcc452bf14

SHA1
94069cb410c61dfb4db80276f8d2e96228fce819

SHA256
2d4c9e3903da28cf507a25041e979b1b88e729f45684eb4d2aba62a4b2b4aa5a

SHA512
5135b87f5d92af541b2cb33775cba46334e3f95ca5dd6352feee7c18a7cb85e50930e2f4e26b75bd5f7aa278fec023cea0c7f0e0cd5a61ee10e5eba8b9bd27cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f4fff895c5fc9ea97cfd346290ace86

SHA1
6c1c4c3de66a5195ee00f866e0904337a31f89a6

SHA256
85cd81d5c0172787d216dfbd398218ded2c653b4a671afc24afc710d66b573da

SHA512
d2b9bd44647ed3b2784fac75a63dfd676b95e2e43bfd7ec5a53c3b84def9fce9737b9bd89cc78fb0e66f7691ff0530c2d25a09fffde1b8b496aa5706c7870a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eefa19606445bd00db9d9f6d92849a69

SHA1
eecb38aa4dfb13a09ad64f3d35f4d6adb7b83c2b

SHA256
a81b3781da7c33d69d2baab677e805fdd221d9375b25d3e962faf7ba7924e9e9

SHA512
c6c7b37b68c4feff8fedb38bf8ad23708819c31b0baa31df1168dcb3f1a2ab8e5c7b74116f99e1c18963d22c592b860714a65cc5a5e680f154efd4d9f139b3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
739a523caf54d32008f0105e968714f7

SHA1
22e47a48d49601083c72776d7c3f233b391ae70b

SHA256
796b908f6901a5816b9f7a08fe7aff73bd8820cfd738224a5d647232f003f800

SHA512
c09854172c2e48bee96e4f129da1983e8ac90bc2b6ec649c44af98152e0fe6593b3741ad0c44c39552e7694305a7321085a06e9d8f5d20f6facdb80562fe27e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6f63e11ff76ef0d94fd15aac26446b01

SHA1
c2bd3ba83047ba0eb6d2cc4c485f7914b783f2b5

SHA256
fde9df94b28187515819cb8126761ccc1a529d0767eec1673adfa2980587736a

SHA512
44f478f40401107fb742c76a403b7507819dc191c212974da76366dbfdf82cb49ea5d2cfbfa2844abfa7aabaff997764f7302cd55e22cfbbe6f0fb89dbbe5911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5828d0.TMP

Filesize
1KB

MD5
4b89a29ab3fc76fd498f4ca84f4b5d09

SHA1
ae43f4b0dadfa885e095a9dadf5b0550895f3faf

SHA256
7960debd7030ce9f8d581248593f2f5147e55d2b2248ccfa622e27fb3951dc60

SHA512
9d9cbd851cb52963f7c1f6589e35c9159668e700e36c83a49b68699266057ac5b033e504178b4bef566bb602d42572406e35e9066d10a052f3549e858619cbb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9a3a48b4c331f61f38a7d505fb21082

SHA1
8cd9e5c1ad9dab932fe670376bbb11a8d4822e97

SHA256
9c4c77366d24e69346eed9b01e5e80df8c48ab6393982f3f1e99d50bda24a594

SHA512
95af62459b6836f3675a571c7e25d74f248f993e947ad17129142305faa4d5a092282d5d8d20859dbe092775ac8da46b319a9a51eb1258f0781769a95f8157fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7cc90b35c9019715886b6e7166b6b73e

SHA1
ec10d4126e87576221dbacdfc2549891d9ffd4ce

SHA256
d487301ed84b3ac4f8b5b9cc2de8ffab05494e85dbe471e24f88c30ea7ac2bab

SHA512
726ba97caf8feabee60e6d6a875bbb085b34336ac13ab88efd56bd5cb6df572f7f01ee114442a7dfde7070c45fe1e645d8a777bffe0f5a6016f853d8c21da894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f48562c1-12d8-4a3e-ba88-dc498f23ea93.tmp

Filesize
11KB

MD5
e7c707a3bf4dc5f1face9e451e411e2b

SHA1
f62dc9cd2fa566a1b2b0cc4f7b118ace307829a4

SHA256
b817b76044573b1d5c180c4aa21f32e57443aff1b1727a3dcaa8b2f98a9200ca

SHA512
ebe951624625b1366fd6c31013a08c1b31dce421f6b0f82248b2b58e02489c72e6b67cdaec60f008aaa0c08384e53e0cadc955d2a6666b1c5c8944e19d438004

Download Submit
C:\Users\Admin\Downloads\client-20240808T173048Z-001.zip

Filesize
1.0MB

MD5
8fa048759c864f4c7190b8afcbb6f505

SHA1
fcbe3c4d5a3880183d4fd5a01583eafbe5a23d3b

SHA256
835fb84ce1d7a21637f87d96e6dca28407757cdf97201f1b61d92736d4024b8c

SHA512
3fd235c2d8cac39c28e0441ad3677b427939956113c901267522fffd14835e2d184fffabd967bf2d773b63e4621db01742eb0a938c95749a2f2888c0f28424f8

Download Submit
memory/3192-267-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download
memory/3192-270-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download
memory/3192-269-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download
memory/3192-268-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download
memory/3192-266-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download
memory/3192-265-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download
memory/3192-264-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download
memory/3192-258-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download
memory/3192-259-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download
memory/3192-260-0x00000187775C0000-0x00000187775C1000-memory.dmp

Filesize
4KB

Download