c3a52512be078685aba39201de71013bd27d586b52db3517cb321d6313a95432

Analysis

max time kernel
68s
max time network
45s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08-08-2024 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

990KB
MD5

30f08be765efad10e7be896eacbf8eac
SHA1

c0c89b5ba85a7507927acc60200667da759c4804
SHA256

c3a52512be078685aba39201de71013bd27d586b52db3517cb321d6313a95432
SHA512

2dfdb046eb225fe56ba397a109d6076d1833d044cf915e8dcb1684004d1ffb9db324a2f57d06c8f22132d707df7387c8db47f3b4a43173db32a2303a42a06e25
SSDEEP

24576:gyIZEdtdAl0M8NPKTWqtvBFkB7j5Crb8ZZRhllp6OxMuBRUtm:gyfdDM8NPKTzwBhCAR1ac

Score

9^/10

discovery evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AutoKeyboard.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2316	setup.tmp
3556	AutoKeyboard.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	AutoKeyboard.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\AutoKeyboard.exe	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\MurGeeKeyPresserInstaller.exe	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-OVH2T.tmp	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-Q37HQ.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\unins000.dat	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\Helper.dll	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\MouseClickCounterHelper.dll	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-6FQF6.tmp	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-TIU14.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\AutoKeyPresser.exe	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-FK808.tmp	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-FQPEQ.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\MouseShortcutHelper.dll	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\KeyboardMacro.exe	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\KeyPresser.exe	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\MRH.dll	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-I3TF6.tmp	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-IR2Q2.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\Auto Keyboard by MurGee.com\Macro Recorder.exe	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-7CN3H.tmp	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-TSDJ3.tmp	setup.tmp
File created	C:\Program Files (x86)\Auto Keyboard by MurGee.com\is-C6P9O.tmp	setup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoKeyboard.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 1016.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2316	setup.tmp
2316	setup.tmp
3588	msedge.exe
3588	msedge.exe
1732	msedge.exe
1732	msedge.exe
3820	msedge.exe
3820	msedge.exe
4824	msedge.exe
4824	msedge.exe
4536	msedge.exe
4536	msedge.exe
4820	identity_helper.exe
4820	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3556	AutoKeyboard.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
2316	setup.tmp
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3820	msedge.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3556	AutoKeyboard.exe
3556	AutoKeyboard.exe
3584	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2316	4732	setup.exe	81
PID 4732 wrote to memory of 2316	4732	setup.exe	81
PID 4732 wrote to memory of 2316	4732	setup.exe	81
PID 2316 wrote to memory of 792	2316	setup.tmp	84
PID 2316 wrote to memory of 792	2316	setup.tmp	84
PID 792 wrote to memory of 444	792	msedge.exe	85
PID 792 wrote to memory of 444	792	msedge.exe	85
PID 2316 wrote to memory of 3820	2316	setup.tmp	86
PID 2316 wrote to memory of 3820	2316	setup.tmp	86
PID 3820 wrote to memory of 3060	3820	msedge.exe	87
PID 3820 wrote to memory of 3060	3820	msedge.exe	87
PID 2316 wrote to memory of 1564	2316	setup.tmp	88
PID 2316 wrote to memory of 1564	2316	setup.tmp	88
PID 1564 wrote to memory of 2640	1564	msedge.exe	89
PID 1564 wrote to memory of 2640	1564	msedge.exe	89
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 3820 wrote to memory of 1284	3820	msedge.exe	90
PID 792 wrote to memory of 1456	792	msedge.exe	91
PID 792 wrote to memory of 1456	792	msedge.exe	91
PID 792 wrote to memory of 1456	792	msedge.exe	91
PID 792 wrote to memory of 1456	792	msedge.exe	91
PID 792 wrote to memory of 1456	792	msedge.exe	91
PID 792 wrote to memory of 1456	792	msedge.exe	91
PID 792 wrote to memory of 1456	792	msedge.exe	91
PID 792 wrote to memory of 1456	792	msedge.exe	91
PID 792 wrote to memory of 1456	792	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\is-KS9E2.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KS9E2.tmp\setup.tmp" /SL5="$80222,744005,58368,C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/vs/17/release/vc_redist.x86.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb145f3cb8,0x7ffb145f3cc8,0x7ffb145f3cd8
      4⤵
      PID:444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,2416732226260811879,14986802079385570579,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1840 /prefetch:2
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,2416732226260811879,14986802079385570579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://promo.murgee.net/
    3⤵
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb145f3cb8,0x7ffb145f3cc8,0x7ffb145f3cd8
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5972 /prefetch:8
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1972 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:1
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,5022078938185564546,400977267650351124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2492 /prefetch:1
      4⤵
      PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://share.murgee.net/auto-keyboard/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffb145f3cb8,0x7ffb145f3cc8,0x7ffb145f3cd8
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,10182281331069768777,6277947280566878351,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,10182281331069768777,6277947280566878351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Program Files (x86)\Auto Keyboard by MurGee.com\AutoKeyboard.exe
"C:\Program Files (x86)\Auto Keyboard by MurGee.com\AutoKeyboard.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3556

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Auto Keyboard by MurGee.com\AutoKeyboard.exe

Filesize
164KB

MD5
55692b7546ef84fcce52b747ec3229af

SHA1
ed3bb1c184f8b6a57eabe2f14dcf524a10ab447a

SHA256
a4ee0ee2cab831132f1db4466f7cf5136620323a6f20d73d979eca9d66ae86e2

SHA512
889c4c73884a15f3dda3ec4ec1fbebac84fda42b4988f48e551d192454e1a44474c134733ddccde7746be074345a4a4792c78b4077f66f9912d5b3620398524d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3674efba8ac877b3ea211d1c925d77de

SHA1
a7f7cf7fb99ac055d64b6dad0b14a47606c1c272

SHA256
2264d55c4de7d538f312244ccf92d870d583ecc388ab181ce2686f8aaefc543d

SHA512
a1f1085188f8b2183feefe693a1764e3ba7e59d29d3ff84d5bf4a3663262c528766128e9c8d4e6558aaa46539e146010124f6b216eb5a2d85410777dac809a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3dd863efd6186d4aac05d8eb78a3f65

SHA1
cc2ab8e62c2de8b493a89d57fd38d8ff0672edd9

SHA256
fc1daa87d818fd860895fe452525678a3adc460b5eb6a382ea51d8eb52219a21

SHA512
c00b7b1592caf7c1809e7fb3f5ea1fd43f4f2567aa6b3362e11002ad03631c31d047bf207f4b44c12c49fa52561e032322b1389051e8379a891370ffa0500ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
99a27bc94b93841ffad80b36584b97a4

SHA1
411b309d4bd4392218af8bfd04795ec03a336040

SHA256
85ee89bafce9eb588e9a2c57ff2f9e7b9501308efe2cf59759fa250ae11830ab

SHA512
c9c081cc242e47b1a0659264a9db4f50d1c6ed1809d1fb37a1724a64002f29a187cde7592ff62f2d390cddb21fe4d85224dd533372f84cd28da7a43f504acb49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
daf4a49a0949c50d3bb8d680bd98e6a8

SHA1
7c5e5c66c174c04b7e17b4382dddddca7a089696

SHA256
eb929c8c5992e635fd8baa5f68a1dfc4ba97ed9c1c9da935d9482ee45c9beb74

SHA512
1d01ebe7d023d52ae4f9df69cb65f29bade27cccb8d3eba893afcdec0db5b906b09af36202244953751bdcf9ef10c56763b47f7a4c496fbf5952e82e5f9c8595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5f3a6ed271a5a7c72be45559eb7ee6c2

SHA1
9fdda4a9ec5d20d90efa0dd35ff7cf85df14189e

SHA256
60651eb4abfb725eec24d23787731088d3bd85d6cfe0f4b1f01bc6970334a35e

SHA512
cddeae8373cc421813a0afa5a8cb01988488feb2334b9dddc0cee829efc517c11ffad1d0754714d4e7918cfecad02247cf9c4d5e376a9e9bc5d53d840a3ac961

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
8d55bd42a941f63cb689ac456aa88909

SHA1
e045db9e4e0d212f27cb40c65e829f1e370d2641

SHA256
988ea1a0a41af06f4b99731ba9d493194e0fd8741a02b3d4b68590946e2171f7

SHA512
75a153e11f2faa37c5835202ca58846ffdb13361a2debfa57330ea7cfb351d1659f5128c2708e14f9543fe87fbd96b05929cf8bf5e731a1664f14baa978a27f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KS9E2.tmp\setup.tmp

Filesize
702KB

MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 1016.crdownload

Filesize
13.2MB

MD5
8457542fd4be74cb2c3a92b3386ae8e9

SHA1
198722b4f5fc62721910569d9d926dce22730c22

SHA256
a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600

SHA512
91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182

Download Submit
memory/2316-9-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2316-11-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2316-94-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2316-6-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4732-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4732-1-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4732-2-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/4732-107-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download