hxxps://www[.]minecraft[.]net/tr-tr/download

Analysis

max time kernel
132s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
17/08/2024, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.minecraft.net/tr-tr/download

Score

8^/10

discovery evasion ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	000.exe
File opened (read-only)	\??\S:	000.exe
File opened (read-only)	\??\H:	000.exe
File opened (read-only)	\??\I:	000.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\O:	000.exe
File opened (read-only)	\??\R:	000.exe
File opened (read-only)	\??\T:	000.exe
File opened (read-only)	\??\Z:	000.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\K:	000.exe
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\Q:	000.exe
File opened (read-only)	\??\X:	000.exe
File opened (read-only)	\??\E:	000.exe
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\P:	000.exe
File opened (read-only)	\??\U:	000.exe
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\B:	000.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Control Panel\Desktop\Wallpaper	000.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5856	taskkill.exe
4408	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	000.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile	000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\000.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
3828	msedge.exe
3828	msedge.exe
4384	identity_helper.exe
4384	identity_helper.exe
4876	msedge.exe
4876	msedge.exe
5400	msedge.exe
5400	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
676	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeShutdownPrivilege	2384	000.exe
Token: SeCreatePagefilePrivilege	2384	000.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2384	000.exe
2384	000.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2116	3828	msedge.exe	81
PID 3828 wrote to memory of 2116	3828	msedge.exe	81
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 4500	3828	msedge.exe	82
PID 3828 wrote to memory of 6140	3828	msedge.exe	83
PID 3828 wrote to memory of 6140	3828	msedge.exe	83
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84
PID 3828 wrote to memory of 3672	3828	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.minecraft.net/tr-tr/download
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa9cb83cb8,0x7ffa9cb83cc8,0x7ffa9cb83cd8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,7287008586805212289,373654338690362351,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5260

C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\000.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\000.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5856
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='UR NEXT'
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'UR NEXT'
    3⤵
    PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
abcda36a555b8c801cc1749e033b010f

SHA1
2c460c39a8ceaac882769be85f2d1519816e5c3a

SHA256
5526ecfe87e670ff84e4f3ab8becc304ada2afbf309fff934f6d272b1382c9f9

SHA512
7ac7e9449db6e37ba6ee3d77b27382af912e3c79121e94fa738182f3bd7dd456a4b5d9059cb9fa47dd3505f79c387d3cd23c38a2d9f59e6823a55b4aabdb5f42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eae66abf9433c97fd8ee061e9d75f17a

SHA1
f6827cd253e644a657d85cf071d7e69d139625e7

SHA256
4e138e7947a1ae4c787128cf1d89c11a6ab4e7bd57acbc16c8913a917990bec3

SHA512
1e4a7a935ab30fdc84ee114ee62f445331ba40117bb1c038902aaf20728c4d70dc70bfb2098d95f292e44b2e628f49f36c5cb8bb81511726b9029f2362872eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
948a7c6eaba6b872e1cfe0aac6fa3c83

SHA1
4675842336ab986b4aa2c83a1354c403d5bb408e

SHA256
597ac37044c7c24908ab5de199e38107b5b04ebd7626ccb9bf7d706513a9a26b

SHA512
aab018c14cb884d090bceabd21f5e8f98e69188e773efa321c3dbde0c27c2e01ce092438a2d76f9cca4ebacd0f09075f4d78ab1bc8a393204565fd3608bebada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d70b272b41ac713bd0bc7ae2c70b1050

SHA1
9acdc891c4fdc817b88c02ae5b638aaa7f3e34d1

SHA256
993d57d3a89fc525cbe768abae0494491650e504e5013a2fae85650dcd537d35

SHA512
f30ec4dd48a2a4e24eaed763d33fab420ac4f40b3f5d93f5a1cfb6434e0c18ca08ae06686c61907682485f33afc840413b29973073d26f191fa97bc4b0f4a6f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d80f737a38bf43756dd2a19523f8b46f

SHA1
cf3bc3ad8b22b11e08db97f46baefdf0befb0c53

SHA256
463d9fff2a723ea063e6150dd37dc3b43e2b79cdf62a5a3c74fe5b40334d7ed9

SHA512
a93c546223271ee4fd3880aebc6be0b758c1d6c03d0cd573d747e7c94419e6e937b109a7a98264004bc2a31c32d7e99e8d441fac250b3b923827e6294d58aef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63bc7fb2073253d45526301e96a2a116

SHA1
efb86258c1b2c166bf631948c81251bc8cd4afbe

SHA256
76ade16594092690a432f79ec6f26ba1f3ef52a895b165504f2cf851a2af22fa

SHA512
76c2f73043b32e05b4989a365255e1013aec9499e00c478e84c34423464c81b963a31c404ce74cf9c71aea9da5449165220d9434c3d289e8b413b29e1f33e2e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3f1d0286f958348994d8468064e7509

SHA1
21fd7c994f2821f55d108d4280baa5ff8c22d9f8

SHA256
db6caa4191d34d4f08f8461574529b73f7bf4b1a955ecbd970d2a38afde3159b

SHA512
9a097264965f55ba9d905893fb5a7953b9c9bb3d84a7c481ea44e69c8b08e40fbc1142b0b50cf8e4f968716bfe0c43ff67c38fa77a9703ddb506be0370940387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89990b945c464ed150837bac5c82198f

SHA1
0bbe3b6cf73b2e4b07339764f9f550448bf54446

SHA256
61b547f665fdf4ca1f114c76af7fbe5dda7851fd28c2c830a24a10b7e7ad2d0a

SHA512
711daa6002a1693100ce375dd62134572c0618c90c439b850544551b86dc3b6cd27ab4178388b2dd2e2aa8105e45b4e756869da5ca282b094a5e9d9ca84b1e80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ed4387fa541c731a63defda0e36159a

SHA1
8b68f0ccaa14749ba28521e98175b503fbf06b21

SHA256
5311585ce487e559b830f35fe45bc2ca58d0484bfd5a152e9b5badc80f5ce80d

SHA512
1c0514221dcb073abeba8bfeb821f904fa199e800dc543413cc368d9ef78f46b5226e87fa58495ce8bf304dc5388bbc91bf4f737fa6a9b3fc820271f502ddc3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
0193b3aae67315c00bba748821e1b6a9

SHA1
8894ce52c4937213da1937265f28a9da9f33d0e0

SHA256
e27037ff3798055646cc946ca88269b55e98e10bf3bbd057057f3f1a52a3afea

SHA512
2dd184f82b6da5dfdb371c80632cc3321c6fd62a16d3798460a292b9348c42030558a0a7e7e6da53100fbf3d7aee4f7c0b28f62276c8f3cc74e348a4efae7bd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3aac3975110703ec94f2bc69373e6427

SHA1
f0af84f0a0e0b0a79c41e562b03b60b194445eb7

SHA256
46e52c4825bfa8bbfd88a249c2c616a68f874de5cd03444e19de7d64f4c87f44

SHA512
c907eb069daa0f8a5918073769c39073f04c88a29de68167b2faf25a39362c74fad77eb946bbe82519d28715a08e7a9e3890ebd4ce42a3bd16ced1522bd6ea5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5fd1545ced597dd25cbf7d95b6c39c2e

SHA1
b7a6804e9ec6d0f9f6138db04608e1293ede4dd4

SHA256
6c5f26cce10ee19b3992530a2fe4b2751aba85462b62eafeb3272fdf428f8270

SHA512
785b4d3a6b2584560f973c668fff90b281d93ff4d5d050713b7ed3063982cf594b34ead08f546f132f5e0b7bca26544c7602a67c186da15c4c4dd73c3c03f645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5817c9.TMP

Filesize
873B

MD5
e543f3f659564fc01653189667ad9c36

SHA1
84751712dfa774c09b5039c47dbe7730b85a52cd

SHA256
e1c2fe34a88258ce57e09c7ac034741ba0bfca4ebc22a44abdc85fa021d1bcd6

SHA512
6d426eb4414274c94965eeef2e5ea3cee7acc47f5711cf7f0b0e09425a39bfc4ff391de3a0bb85d71283e915bace057483e2610ae15cbdc5a6561a340de5eea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0f9d9ce432cc6fea6f28e44b1386d2cf

SHA1
00afc793a9d9071a1bea800bc1c217494bb20a1e

SHA256
fa81a2c76edc41b9b5648c21b890651efaf79a0cfb83fbcf12546ea79b6c5876

SHA512
e8782738eb1e111c5f10d6e600e5f6ea9b2a94d88f6c4d318d5432a3566faaf99cb18bfad019b8a5a87e78751c0d34e53c7a89bb3af6a708279541e201d21ed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
07eb9eff3b8860f8130ac24353a6c6e7

SHA1
cc64cbecc53ab0d645fc74c35a411d8ea2fcd13b

SHA256
68d7d6182b35476c15729cec25d113024ab1b3b27e411311a68ec6fc75e72634

SHA512
a6bd840b811de5de871e3c0d7f4be0e74cf3b8d40183fd7c7cf7f9409ffc91083073d7af99cc15736c8dc4e445f7d8292bf4ecf5f01749ef7c07bdec38f72060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f596f5341071844693e332797da0354e

SHA1
289ee3e6b8541e01a6b3c3c2f6f66218ce3f117a

SHA256
66c9184908c8ec0c2c020ab826ab1b75e7d1e5c9ccfc2f29efe9020e9d71f18b

SHA512
53474740a06b9b5636551df09b1c6cafe9ce3b5a0b85bf02ec8c9483268c1509d370291eca0d45542a12b7696eb23684980c58e5a76086bfb70c9179598f6cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4490078dcccdaa363eae476ded9d25ac

SHA1
84e808aef73366e6b7ff5ce235ba25395a5ef819

SHA256
e92d6832cce5c2cb885d8dd56a56ab6589985174d908209dab18a963fa38c694

SHA512
8a3c2cfd5abdc8820914ac30aea2400cfbea3fe385022d3fb7ce0c1960c57caa4e6fcbe53f72bc6332e6e818a50d53caf0dabf8317dc70a76efca3ee178eb3eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
ec57ccc35167573c7c1dfc37dea39eb1

SHA1
cc35ee2a0b7a1a8a97bc2758331371145b0f1b16

SHA256
d0882633af819f16e4c78e1f6b7f425ebefb8152a8275bc5abc498bdb8619a6c

SHA512
67a16d328fccae8cc672548abaa3fef0f31c5a4fef55868c54bbe8c2eb9828f5c5652b5d0eb61b854a3960b63f613c70f0fba0c5811d7cca0d0d39879b8537de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.2\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\one.rtf

Filesize
403B

MD5
6fbd6ce25307749d6e0a66ebbc0264e7

SHA1
faee71e2eac4c03b96aabecde91336a6510fff60

SHA256
e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

SHA512
35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

Download Submit
C:\Users\Admin\AppData\Local\Temp\rniw.exe

Filesize
76KB

MD5
9232120b6ff11d48a90069b25aa30abc

SHA1
97bb45f4076083fca037eee15d001fd284e53e47

SHA256
70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

SHA512
b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

Download Submit
C:\Users\Admin\AppData\Local\Temp\windl.bat

Filesize
771B

MD5
a9401e260d9856d1134692759d636e92

SHA1
4141d3c60173741e14f36dfe41588bb2716d2867

SHA256
b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

SHA512
5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

Download Submit
C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\Downloads\000.zip

Filesize
119KB

MD5
f5d73448dbe1ec4f9a8ec187f216d9e5

SHA1
6f76561bd09833c75ae8f0035dcb2bc87709e2e5

SHA256
d66c4c08833f9e8af486af44f879a0a5fb3113110874cc04bd53ee6351c92064

SHA512
edbdc1d3df9094c4e7c962f479bb06cdc23555641eeb816b17a8a5d3f4d98f4d1d10299fd2f9152d30e3fa9e5b12c881fd524e75612e934b287109492ee1520b

Download Submit
C:\Users\Admin\Downloads\000.zip:Zone.Identifier

Filesize
640B

MD5
8d44fc62ed723ac8091af21090cabc37

SHA1
e2173cd1863e1bc97dc0685a507f6e9dadb3bd5c

SHA256
c3e4db88671ec2250fa62b6ce135d45da136d92a427a509beaf2e00ffb00f095

SHA512
46cd3240cac52e5f404a731a84ec4b3431812e58e36b86ccbe8f40e7293c47d9cf736d09fbf937cdab114f0a213ec1753ee6f86c4da7db072fa961783cbb7921

Download Submit
memory/2384-571-0x000000000C000000-0x000000000C010000-memory.dmp

Filesize
64KB

Download
memory/2384-567-0x000000000C040000-0x000000000C050000-memory.dmp

Filesize
64KB

Download
memory/2384-568-0x000000000C040000-0x000000000C050000-memory.dmp

Filesize
64KB

Download
memory/2384-569-0x000000000C040000-0x000000000C050000-memory.dmp

Filesize
64KB

Download
memory/2384-545-0x00000000062A0000-0x0000000006846000-memory.dmp

Filesize
5.6MB

Download
memory/2384-572-0x000000000C000000-0x000000000C010000-memory.dmp

Filesize
64KB

Download
memory/2384-574-0x000000000C040000-0x000000000C050000-memory.dmp

Filesize
64KB

Download
memory/2384-573-0x000000000C040000-0x000000000C050000-memory.dmp

Filesize
64KB

Download
memory/2384-575-0x000000000C000000-0x000000000C010000-memory.dmp

Filesize
64KB

Download
memory/2384-570-0x000000000C040000-0x000000000C050000-memory.dmp

Filesize
64KB

Download
memory/2384-564-0x000000000BDB0000-0x000000000BDBE000-memory.dmp

Filesize
56KB

Download
memory/2384-563-0x000000000BDF0000-0x000000000BE28000-memory.dmp

Filesize
224KB

Download
memory/2384-544-0x0000000000AC0000-0x000000000116E000-memory.dmp

Filesize
6.7MB

Download