hxxps://www[.]youtube[.]com/redirect?event=video_description&redir_token=QUFFLUhqbHNqTVhEV2RFdmg5YTBWSzdWd1FiY3ByeUZOUXxBQ3Jtc0trUU81R2twZWpQc2hzRFZxXzRncXlMQzhVa29VNE9lSXFLNGdoWDNUNFZLWXNkSXppZVpqSWJiR1lodjlyOU9TZFFEZHZObE5HbUdHTUNyMTNTTFpSU0pBTmVMRjZiRDJEMlZDNmpBZFpvS1NGUkxPdw&q=https%3A%2F%2Fibf[.]tw%2FhEEw8&v=oPXd-9lS5P8

Analysis

max time kernel
61s
max time network
62s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11/08/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHNqTVhEV2RFdmg5YTBWSzdWd1FiY3ByeUZOUXxBQ3Jtc0trUU81R2twZWpQc2hzRFZxXzRncXlMQzhVa29VNE9lSXFLNGdoWDNUNFZLWXNkSXppZVpqSWJiR1lodjlyOU9TZFFEZHZObE5HbUdHTUNyMTNTTFpSU0pBTmVMRjZiRDJEMlZDNmpBZFpvS1NGUkxPdw&q=https%3A%2F%2Fibf.tw%2FhEEw8&v=oPXd-9lS5P8

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3736	Trust Launcher.exe
4736	DailyUc.exe
4976	Precisely.pif

Loads dropped DLL 1 IoCs

pid	Process
4736	DailyUc.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3716	tasklist.exe
3176	tasklist.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InternetBufing	DailyUc.exe
File opened for modification	C:\Windows\LlpThreats	DailyUc.exe
File opened for modification	C:\Windows\IpaqCalcium	DailyUc.exe
File opened for modification	C:\Windows\DistributionNj	DailyUc.exe
File opened for modification	C:\Windows\BrandonTherefore	DailyUc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Trust Launcher.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DailyUc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Precisely.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trust Launcher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 158288.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Trust Launcher.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
4708	msedge.exe
4708	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe
3636	msedge.exe
3636	msedge.exe
1548	msedge.exe
1548	msedge.exe
4976	Precisely.pif
4976	Precisely.pif
4976	Precisely.pif
4976	Precisely.pif
4976	Precisely.pif
4976	Precisely.pif

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	Trust Launcher.exe
Token: SeDebugPrivilege	3716	tasklist.exe
Token: SeDebugPrivilege	3176	tasklist.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4976	Precisely.pif
4976	Precisely.pif
4976	Precisely.pif

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4976	Precisely.pif
4976	Precisely.pif
4976	Precisely.pif

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3736	Trust Launcher.exe
3736	Trust Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2248	4708	msedge.exe	78
PID 4708 wrote to memory of 2248	4708	msedge.exe	78
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 3860	4708	msedge.exe	79
PID 4708 wrote to memory of 2060	4708	msedge.exe	80
PID 4708 wrote to memory of 2060	4708	msedge.exe	80
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81
PID 4708 wrote to memory of 4072	4708	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbHNqTVhEV2RFdmg5YTBWSzdWd1FiY3ByeUZOUXxBQ3Jtc0trUU81R2twZWpQc2hzRFZxXzRncXlMQzhVa29VNE9lSXFLNGdoWDNUNFZLWXNkSXppZVpqSWJiR1lodjlyOU9TZFFEZHZObE5HbUdHTUNyMTNTTFpSU0pBTmVMRjZiRDJEMlZDNmpBZFpvS1NGUkxPdw&q=https%3A%2F%2Fibf.tw%2FhEEw8&v=oPXd-9lS5P8
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa1fc63cb8,0x7ffa1fc63cc8,0x7ffa1fc63cd8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1720,12490166943070543179,11818994697188293095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Users\Admin\Downloads\Trust Launcher.exe
  "C:\Users\Admin\Downloads\Trust Launcher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3736
- - C:\Users\Admin\AppData\Local\Temp\DailyUc.exe
    "C:\Users\Admin\AppData\Local\Temp\DailyUc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k move Themes Themes.cmd & Themes.cmd & exit
1⤵
PID:3184
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\system32\findstr.exe
  findstr /I "wrsa.exe opssvc.exe"
  2⤵
  PID:4968
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3176
- C:\Windows\system32\findstr.exe
  findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
  2⤵
  PID:948
- C:\Windows\system32\cmd.exe
  cmd /c md 647551
  2⤵
  PID:584
- C:\Windows\system32\findstr.exe
  findstr /V "LatviaTicketClevelandPoet" Larger
  2⤵
  PID:1484
- C:\Windows\system32\cmd.exe
  cmd /c copy /b Develop + Jeremy + Kazakhstan + Reviewed + Subtle + Expect 647551\h
  2⤵
  PID:1604
- C:\Users\Admin\AppData\Local\Temp\647551\Precisely.pif
  Precisely.pif h
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4976
- C:\Windows\system32\choice.exe
  choice /d y /t 5
  2⤵
  PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56a59e710e878c1976c8d06eab3ba3b2

SHA1
e03e93ab51fab0306253de0f04b48639b64061b5

SHA256
f2353e97d3f040505f52c193b64b007b1786aaa0109d9c9d6266fc3581b4139b

SHA512
d337740d0f4414c9417b26b4b82b5799f10a3a1c0f5f66de107a5afe5e0903ace9fbc2ce84db4731ad7dd2b88f02228656d884f41b60625f8a4860bd79cbcb8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
983134e4e2b9db93219e5440805d9090

SHA1
2e6d678ac2160458256431921c2651eb82ef4bec

SHA256
72cd1e8d23d717fae7efc75a196372ded33e42a7e541e8fe4f1f3c06acd37e87

SHA512
c6577eac8a1d3f640b0dc427a84038b96aba4dc4ad1580762ec4f552c586f563dc107a15d3eacb7ccdc21d1f8604c1c18a19b3e03a040a5b9583d4c7942112e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c540f54cfa6e6213b98499d9a2106898

SHA1
2db03610b3703321e110ec484d0e4af2b917e687

SHA256
1a1d186a5e13649a0f0a6b171aeb531278d2bc72671c6447b8abe10890efc0a8

SHA512
d6f88dde127d461372e12ea747dd5dd796c2a03f9a24859933e4ebab4b43e7482f9ea8a12d5915827be0441e1ba429cabbea0c8f762fcbab630081dad77569a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5d29004aeb674104985c0133cfeca581

SHA1
7c8a9aa3c860c95df3f45e44ef88ac3aae3a7abc

SHA256
131839f798fec5bcfb8dbf7ac2cb974e64e58bc12ae4c0f0c00402149e24eb9f

SHA512
656212fd0e689b9fa085cc453500f01178094e73b7ea447947eede6fe592fa55aedbcfb36d2b90867e895aa60c002b3360b4e083a45bb291e3e9a7f19cfcf96c

Download Submit
C:\Users\Admin\AppData\Local\Temp\647551\Precisely.pif

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\647551\h

Filesize
448KB

MD5
6fdfd7bd8eeb457e56d58555cf25da5e

SHA1
8d62d43f955a3ac6d50f4c9b7d1ed888f9049f07

SHA256
0d27d248085e70ec9840900e32e71ee90f530968906eaf519144d007ce097ce6

SHA512
8a5e0fe06f7bd37aab434a4191d20f3c5074a9703e3797d3f59a17073d7e224824ddb7a9cd5e680efb8ac1f2bad217d18c65d1fa939d7f4c25c89eeaaa0af0de

Download Submit
C:\Users\Admin\AppData\Local\Temp\DailyUc.exe

Filesize
1021KB

MD5
a63aa4427cbc2b463642def398f2d217

SHA1
49c3c7d4fea7f7abdf148e33b3470ce1bc23ecc5

SHA256
d068a6d76dec4793e1c7e67d849485fec2eac4d1da91b48426c31d7b2b172b48

SHA512
4fedbe899a27f0c9c34a8c4cced85c68148dab9b605e24787b4552429ab6d1091bc78f8599ca0ca43acd18c6d74fe94830ed4303f24bf9ffe99b0cf9fec6a198

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deemed

Filesize
872KB

MD5
c30baf006c23f5502a6eac13c4121cac

SHA1
a46b52d9441117cc8a6a1c3f68162ec294b68068

SHA256
0aa9d496c6ba1d362368cf3a612cd737f19fdd6051af41d748746da51dbefe9d

SHA512
af29fa6425006c8ff87fa2c422a2d49148bd6107c6d7a8aadc75ced5d5a08aea0e8d01de99cc95f077c58964b24b872a92b7f8d5d03989c3142c50bbd1b3510d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Develop

Filesize
73KB

MD5
1ebc315401a599085e455ae7d76e177e

SHA1
be61fa1790aff061b8bfe2e371c4352c6d172c1e

SHA256
bb86584cf9142113c81fab982202ccb61ef2c5eb1bb8972a0565eb76a8d97f70

SHA512
5c93163f13ebd7b8b6e81644d6bcffb308a0391c070515bcc9e32094c0e3da7c8167e7feefb21fd7c840abf9074a7959a589b8d0fa7aa76e116c6d6de84977c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expect

Filesize
18KB

MD5
53746be92b194c780a2d58f34ee00b11

SHA1
bb99ba3c2b950b1914182d6aebd760a24b7b8338

SHA256
191e020f3c5af35645b57244b3d84e9bac8463aee6f896bd7141c8e14c905f53

SHA512
f2bbe556a053b2f3b36fc9d6f36de908a23ab633f6a5ff38c62bb105866f0f8a64c66a7c9fad6ae381be1a0e2251bfed51c36ead64f696e24cced718ad1304e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jeremy

Filesize
99KB

MD5
7dc54410052dbb22f08d596a65d1e601

SHA1
79a2e7f1091008f152a586c446b947067b80709d

SHA256
17dce7c80e90b3b23fb3ba0845c44c0a7c90afeabe4545dbfbe96e0282d929ef

SHA512
258e8e9e88a4599fa481fcbaca5b92df22ee4593d7d0590f4a868dfa7165099899416b6987b83311f17818adf19d4dbb65c18ad659a2ee7e33c368d4bbef252b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kazakhstan

Filesize
99KB

MD5
fc34ac746c73f1a69c6ec09cb470964f

SHA1
9d2af2aa3d507e9dc9037801ca553e58ba8eb077

SHA256
31924043f5d76a478d819d8be63bcd1238f0c503a150893dc2a19e80ace9bb62

SHA512
9308a294788afb379fbb22afab6cbe78418048d708e1629a104a54b090327d8a4e3c958c889db96f186399c5f2ee66c8e5f699a2ee5480d764014366eddac0d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Larger

Filesize
490B

MD5
99352b2770c4409f48bc24896f26baae

SHA1
b23f51bf53495bb973fbaf37ff34184e2b83b081

SHA256
057c2fdd3f765865510d3557f9083a2bdb68987f806a469a966dd2edbb28e37f

SHA512
1c9e194f9666ca0e6fc9df690557f58ec28c8393447c339740d1e29f855e0e8ed792310de420cce38df14a6000744b206bc262b38d0b479ed86203a0909ce2d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Reviewed

Filesize
91KB

MD5
dbb1c7e3ee4a5462f0d20f7f30748ed6

SHA1
55a501b433887f89934a7afb9b7e4eb44e828671

SHA256
d1464a5481d67860e6c99d488fcb5599908d15577fee5da65508492f37e387a1

SHA512
66df41b88eb949c5687ec125b1a4ee92e3ec5c72f8074037db60e8e57ad125d28fccddf5ac10e70708dd94a9a921bbec2e901873a8a267fd01d1505c4e3df79b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Subtle

Filesize
68KB

MD5
271a155148cd40704556bce7a8596163

SHA1
121c56e001c1f23b22ea3322c906f5a21eb690cd

SHA256
cf88957d77c63719387019270a38b952332d9d4ad0435c242833b6ea955eb036

SHA512
b7cdef8ee6f8b8ac04ebb294c10dcc10d266f453e0491dca42f5b1fa0bd2b3c61f3c62a7d32c4e69423cff300ee93cf7dc09c37824ca3cd5b66a15d65b474a02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Themes

Filesize
22KB

MD5
36f1c87d9737391327b7a8a85eb876a4

SHA1
950ab5aa64bf8514b991c273251f37884d0baa8d

SHA256
d19b134a54477eb88a8051049bc528f172902bd7109e02bb48c56b113f45210c

SHA512
429bfdd110fdebbb30f3d455db7b1c1e8057e71a7f53db2d01e8e9ae2aab9bad5a15f7ba6c82704fa1dddf90adfc4a0742cc91d8375eaa3f2ba1a63362fb0793

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4A24.tmp\ShellExecAsUser.dll

Filesize
43KB

MD5
552cba3c6c9987e01be178e1ee22d36b

SHA1
4c0ab0127453b0b53aeb27e407859bccb229ea1b

SHA256
1f17e4d5ffe7b2c9a396ee9932ac5198f0c050241e5f9ccd3a56e576613d8a29

SHA512
9bcf47b62ca8ffa578751008cae523d279cdb1699fd916754491899c31ace99f18007ed0e2cbe9902abf132d516259b5fb283379d2fead37c76b19e2e835e95a

Download Submit
C:\Users\Admin\Downloads\Trust Launcher.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/3736-99-0x0000000000220000-0x0000000001220000-memory.dmp

Filesize
16.0MB

Download
memory/3736-111-0x000000000E640000-0x000000000E64A000-memory.dmp

Filesize
40KB

Download
memory/3736-100-0x000000000EBA0000-0x000000000F146000-memory.dmp

Filesize
5.6MB

Download
memory/3736-101-0x000000000E690000-0x000000000E722000-memory.dmp

Filesize
584KB

Download