hxxps://github[.]com/Endermanch/MalwareDatabase

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2632	usеrinit.exe
5476	usеrinit.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_Antivirus Pro 2017.zip\\[email protected]"	[email protected]

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\Z:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
84	raw.githubusercontent.com
85	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5244 set thread context of 4392	5244	[email protected]	122
PID 5448 set thread context of 3180	5448	[email protected]	127

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Key created	\registry\machine\Software\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe
Key created	\registry\machine\Software\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Key created	\registry\machine\Software\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Key created	\registry\machine\Software\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
2652	msedge.exe
2652	msedge.exe
464	identity_helper.exe
464	identity_helper.exe
5748	msedge.exe
5748	msedge.exe
2632	usеrinit.exe
2632	usеrinit.exe
5476	usеrinit.exe
5476	usеrinit.exe
812	msedge.exe
812	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5372	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5244	[email protected]
Token: SeSecurityPrivilege	5244	[email protected]
Token: SeDebugPrivilege	2632	usеrinit.exe
Token: SeDebugPrivilege	5448	[email protected]
Token: SeSecurityPrivilege	5448	[email protected]
Token: SeDebugPrivilege	5476	usеrinit.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
5372	[email protected]
5372	[email protected]
5372	[email protected]
5372	[email protected]
5372	[email protected]
5372	[email protected]

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
5372	[email protected]
5372	[email protected]
5372	[email protected]
5372	[email protected]
5372	[email protected]
5372	[email protected]

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5372	[email protected]
5372	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3536	2652	msedge.exe	84
PID 2652 wrote to memory of 3536	2652	msedge.exe	84
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 1480	2652	msedge.exe	85
PID 2652 wrote to memory of 3116	2652	msedge.exe	86
PID 2652 wrote to memory of 3116	2652	msedge.exe	86
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87
PID 2652 wrote to memory of 4644	2652	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb34846f8,0x7ffcb3484708,0x7ffcb3484718
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3552617208756913955,9928109253905492219,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6088

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:4392
- \??\globalroot\systemroot\system32\usеrinit.exe
  /install
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:3180
- \??\globalroot\systemroot\system32\usеrinit.exe
  /install
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5476

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus Pro 2017.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus Pro 2017.zip\[email protected]"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3da83a0e-418b-458c-bfd7-a343e77d7382.tmp

Filesize
1KB

MD5
0632e2902b753c77f42dbe62db7cca0e

SHA1
8ae4f8a793abcea2917b88c91624cf35e2c8cb4c

SHA256
451d3a847014eec3be9a9aff7c065442bd91546023a9e438d67c1640a56a3662

SHA512
e59421d2ffeeabb325a8ee661b9e6db8932d428138c7f0e49b0781e1b302d61d39a69433bf05e1acf59869632ecef216cd6d601e381c64f5f341e1e78f94186d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
96b11ae3a0e0f8c3af25414dab0101d1

SHA1
3b45c416795ad894eb23666647b609e4637ab746

SHA256
818db664f0c306f3df3c9043077ad76d81209bb3714b055c99ee9002f2215e10

SHA512
b5ced0453ac58abde007b1fc11858593ded11b9129c734678b14c10f23745ef5a8750e07caa79d70800dc90e86e4fe3da3ef6ee88ccc0f3b28c07f0bac3b994d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
ed5f4213c17629776cd75510648fc019

SHA1
ebfa685dca9b7c920cd5ad521c03e4ad0ce435b9

SHA256
e969795f0e63ec8a35cdf34d5bc43867ca0825bebfed9734943e69b34ed2ad87

SHA512
71bcc166ae5a48f7a79aa5de7ecc7e10dce22c39240ca9ffe9d0f9340f40fc2a2429529cfee8b2b5d7082efe94921fa7df3454852d5313ff4093bfdffc189627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c54bdc8798c616ef724e236b1ce7bef

SHA1
b390e60d1e056af40d8cf40d587facb5560d9866

SHA256
dc4a3b1670bf57936967c919b90132ddb23e9325c28b44ec9189ec1395cbecff

SHA512
45fe001a46aac843d4776d8618a1ff1b74e38f028b28aa105e108c84022163f76ba3f618893091b3b8e87007dfa44ec95fcd79d495898d5238fde9c4deb6e8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
443ba7b087f8d60f5f497aaa268f6b5b

SHA1
11c9a6c4665760197e3ec4e7832fb1ede26f8c62

SHA256
2f3b95f92185144dc22dd3842167d83cd1a0f86998a9d5c917c79109bb9a9404

SHA512
e64e4d842fd714a3d22c22e0224d40751f8154d8bc7dd160efe21750464166d2837e51848f792dafa11fbb5df1a3d494ca4b75da184bf062646dd0d646a589f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76b3e23175dde5d8b00a158946da02bb

SHA1
86f45112ff730205a6858a4d74309ab92ce135a2

SHA256
8f3c756ca14d446487529038ee77cb5da59a460740e5a03bfef7c235a483dce9

SHA512
c419368bf2bc88b7b4b5639b491527507cbd47807664d75f374050e03b5dfb2558ae6ab9c33f80e1ee2b8a0100ccad1d50c217c2528ec1b99d3b217bdaf23168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
757414374ed5e4236b658dcef357047b

SHA1
0b3b5b84683be2cd5cfc9b063d35066c37fec227

SHA256
4b00edeb0a371fba050e3e0401f294e52707900bc2d44d05eb70ff1458be6d09

SHA512
c37e5c61b68edc543095f6cab07cf85199d0ecfee641dc14d7ce4576194ed005983aae9f5c0480afa0e4e2087f1f840812eb19dd0cdfb7a13e8be5843841d0ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
81baf534de51c3515a340eb25fd6e773

SHA1
f004b5a94449618c3e2d1d127a9a7f6966e3c649

SHA256
73207a36c49e56cf17d55b0da565512cbe0e12476c8f1d801dba588102a94d0c

SHA512
eea0a885b85ca4372bb6c9fad4541b9b23ad4aef1207c22b01456c39012f07c41440d40d43a7c69d66c6ad6d06bf3e19799d77284007df43616f8c4b65d2004b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d3ab.TMP

Filesize
1KB

MD5
78313245d6af1a35f6e70410b8eeb5c6

SHA1
f948161aeb32b00685eb3de8c03aa6dec83c5522

SHA256
1a3bc24546ffc6f2f631d840aee71e4c541bc90b97f3636188c8c0b7bda64e3a

SHA512
996ebc2bd3e04f6bdea0f8852b7a1325bbcb6d94d263202a9a7d5b577275b1f5fd2eb24339a55069002460d53d627bbcc1aa2e3300e0e7f44f175199f8887df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
74172514129e624781f3aa836446c88e

SHA1
ca54b287278aba9adcf49aeab0b73cf0a09d82f0

SHA256
b1888a15f592a1f6bd9d29bf6b1683a9493e05c5c7cf86a8d6317917d8c88fc1

SHA512
4762f5953bb1f671b87d5df59d02fe126f856739ce2062fa82c58632b9cb66bc5e8ed782e7c9f73ca312240eba75a383c6ba6ad37e9a5648d6904c84d30e3e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f948396e8662d55ba45a9abc8ee94aea

SHA1
9439d558a3aaa27c737d2b90b9e81049a44cac7e

SHA256
c9bb31fb8104ec51e6279cf38119845826eb5ccd23c0be1111d342e5399ad945

SHA512
9204748f1dfaa2c35f47004021c1f54bb050c83ea8a611cf437450519e5f125319484084885742fd95f10dbac7c8df7ee891d7ebf49804496642f3a44b5ae44b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4fddd135d3c89f3ca4ffa794f7560c17

SHA1
57946286f2c37d9f9359cf4bede44d14be95e94a

SHA256
3649e8adf200381441bb7fe1a7c7578d91721104327e969727b90a0abfb9b34d

SHA512
2ea5d40d1878302f3ecf0ca876fe1433bb07a99dbc79ac9c69fabaea2ae9beb20eed95522469818267fd4a7d3e2074fafc93c3ca0ac65332dbaec3b7b4af1da9

Download Submit
C:\Users\Admin\Downloads\Antivirus 2010.zip

Filesize
688KB

MD5
1876b2d886ec392d71f37423dfef0c11

SHA1
af78db6206cada4f780f030d45fcaa881f892a99

SHA256
61ff034c476d4060fbea6debc5f84494cf02f337a9a897ddb6b3eb3a28c16406

SHA512
9070d1c35ddc045c7d5aa7938d231d139437c0b363c72a71d1edf3b77ea40484869c92e3dc9b021c2897d224d3f2b6bcf64b4dcf44149da9d6cc15d4dfa9951e

Download Submit
C:\Users\Admin\Downloads\Antivirus Pro 2017.zip

Filesize
794KB

MD5
ab1187f7c6ac5a5d9c45020c8b7492fe

SHA1
0d765ed785ac662ac13fb9428840911fb0cb3c8f

SHA256
8203f1de1fa5ab346580681f6a4c405930d66e391fc8d2da665ac515fd9c430a

SHA512
bbc6594001a2802ed654fe730211c75178b0910c2d1e657399de75a95e9ce28a87b38611e30642baeae6e110825599e182d40f8e940156607a40f4baa8aeddf2

Download Submit
\??\globalroot\systemroot\system32\usеrinit.exe

Filesize
139KB

MD5
4acd14244d2cd76d06939163127cfb10

SHA1
75f3e3c764f7d20c9950f5410f753f3210bcc2e7

SHA256
29b5b65a1cdf119ac7c6c9df76c6843b25a81bd00aa5a5e995ec675e34bf1acb

SHA512
001504da15c1825102479ba379b0be7ec15e779626d450d9d763552d7e1ac71f5bb86110f9361363bd401aabc53cdfd2d554480aec8bef85ed8c7b03cebf4031

Download Submit
\systemroot\system32\exefile.exe

Filesize
115KB

MD5
72178bb0f9674f0ce0b6b188d1219266

SHA1
ae3c43c7846c0ef977fa90991e1c366e34ab671c

SHA256
09cd3c864182b703a1384a15e60424c0ee8c82c3fd19f197c391a0e3ec5bd16e

SHA512
d9004c1b8402375c92690525f06ae83198bb929bb18dfc46fda9036a4054ed9c38637438b13ecc2566f98f2a8ac297ec7f0151b63a59c4f7bbc2ab8f7b6d779e

Download Submit
\systemroot\system32\mseeeeee.dll

Filesize
718KB

MD5
8736c2a37ff0adf6f03d94bb34d1f784

SHA1
e4867b136e100c9d45f6adea593c9a636134f308

SHA256
dbe318e7c72f9558f836c920510a5245ae5af29996b62f661399ce3724458ec3

SHA512
2bbb22540e6ae0ebdd7c5303f67fb3911025a9f8f68c1c192edf5247a66bff885e292dded093d4522488b9a98f5bb00f24b00374e8eeb219184faacc95818848

Download Submit
memory/5244-284-0x0000000000400000-0x00000000004C4400-memory.dmp

Filesize
785KB

Download
memory/5372-378-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/5372-397-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/5372-409-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/5372-412-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/5372-413-0x0000000000400000-0x0000000000A06000-memory.dmp

Filesize
6.0MB

Download
memory/5448-329-0x0000000000400000-0x00000000004C4400-memory.dmp

Filesize
785KB

Download