hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/000[.]exe

Resubmissions

19/08/2024, 02:23

240819-cvbd7asfkr 8

19/08/2024, 02:22

240819-ctq39ayhle 8

19/08/2024, 02:19

240819-cr16fasdrq 3

19/08/2024, 02:17

240819-cq1hhsyfrf 8

Analysis

max time kernel
42s
max time network
51s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19/08/2024, 02:17

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/000.exe

Score

8^/10

defense_evasion discovery evasion persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4268	000.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	000.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\O:	000.exe
File opened (read-only)	\??\U:	000.exe
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\B:	000.exe
File opened (read-only)	\??\E:	000.exe
File opened (read-only)	\??\I:	000.exe
File opened (read-only)	\??\L:	000.exe
File opened (read-only)	\??\S:	000.exe
File opened (read-only)	\??\X:	000.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\Q:	000.exe
File opened (read-only)	\??\R:	000.exe
File opened (read-only)	\??\T:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\K:	000.exe
File opened (read-only)	\??\P:	000.exe
File opened (read-only)	\??\Z:	000.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
28	raw.githubusercontent.com
51	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Control Panel\Desktop\Wallpaper	000.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\000.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2092	taskkill.exe
4824	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile	000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-6179872-1886041298-1573312864-1000\{2EE531A9-3FF1-45C5-8E0B-C332F6F47D74}	000.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon	000.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\000.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 607447.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 547618.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 104770.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 299163.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
3484	msedge.exe
3484	msedge.exe
5064	msedge.exe
5064	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe
3880	msedge.exe
3880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeShutdownPrivilege	4268	000.exe
Token: SeCreatePagefilePrivilege	4268	000.exe
Token: SeDebugPrivilege	4824	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3100	WMIC.exe
Token: SeSecurityPrivilege	3100	WMIC.exe
Token: SeTakeOwnershipPrivilege	3100	WMIC.exe
Token: SeLoadDriverPrivilege	3100	WMIC.exe
Token: SeSystemProfilePrivilege	3100	WMIC.exe
Token: SeSystemtimePrivilege	3100	WMIC.exe
Token: SeProfSingleProcessPrivilege	3100	WMIC.exe
Token: SeIncBasePriorityPrivilege	3100	WMIC.exe
Token: SeCreatePagefilePrivilege	3100	WMIC.exe
Token: SeBackupPrivilege	3100	WMIC.exe
Token: SeRestorePrivilege	3100	WMIC.exe
Token: SeShutdownPrivilege	3100	WMIC.exe
Token: SeDebugPrivilege	3100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3100	WMIC.exe
Token: SeRemoteShutdownPrivilege	3100	WMIC.exe
Token: SeUndockPrivilege	3100	WMIC.exe
Token: SeManageVolumePrivilege	3100	WMIC.exe
Token: 33	3100	WMIC.exe
Token: 34	3100	WMIC.exe
Token: 35	3100	WMIC.exe
Token: 36	3100	WMIC.exe
Token: SeShutdownPrivilege	4268	000.exe
Token: SeCreatePagefilePrivilege	4268	000.exe
Token: SeIncreaseQuotaPrivilege	3100	WMIC.exe
Token: SeSecurityPrivilege	3100	WMIC.exe
Token: SeTakeOwnershipPrivilege	3100	WMIC.exe
Token: SeLoadDriverPrivilege	3100	WMIC.exe
Token: SeSystemProfilePrivilege	3100	WMIC.exe
Token: SeSystemtimePrivilege	3100	WMIC.exe
Token: SeProfSingleProcessPrivilege	3100	WMIC.exe
Token: SeIncBasePriorityPrivilege	3100	WMIC.exe
Token: SeCreatePagefilePrivilege	3100	WMIC.exe
Token: SeBackupPrivilege	3100	WMIC.exe
Token: SeRestorePrivilege	3100	WMIC.exe
Token: SeShutdownPrivilege	3100	WMIC.exe
Token: SeDebugPrivilege	3100	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3100	WMIC.exe
Token: SeRemoteShutdownPrivilege	3100	WMIC.exe
Token: SeUndockPrivilege	3100	WMIC.exe
Token: SeManageVolumePrivilege	3100	WMIC.exe
Token: 33	3100	WMIC.exe
Token: 34	3100	WMIC.exe
Token: 35	3100	WMIC.exe
Token: 36	3100	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3604	WMIC.exe
Token: SeSecurityPrivilege	3604	WMIC.exe
Token: SeTakeOwnershipPrivilege	3604	WMIC.exe
Token: SeLoadDriverPrivilege	3604	WMIC.exe
Token: SeSystemProfilePrivilege	3604	WMIC.exe
Token: SeSystemtimePrivilege	3604	WMIC.exe
Token: SeProfSingleProcessPrivilege	3604	WMIC.exe
Token: SeIncBasePriorityPrivilege	3604	WMIC.exe
Token: SeCreatePagefilePrivilege	3604	WMIC.exe
Token: SeBackupPrivilege	3604	WMIC.exe
Token: SeRestorePrivilege	3604	WMIC.exe
Token: SeShutdownPrivilege	3604	WMIC.exe
Token: SeDebugPrivilege	3604	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3604	WMIC.exe
Token: SeRemoteShutdownPrivilege	3604	WMIC.exe
Token: SeUndockPrivilege	3604	WMIC.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4268	000.exe
4268	000.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 1928	3484	msedge.exe	81
PID 3484 wrote to memory of 1928	3484	msedge.exe	81
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 1092	3484	msedge.exe	82
PID 3484 wrote to memory of 4192	3484	msedge.exe	83
PID 3484 wrote to memory of 4192	3484	msedge.exe	83
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84
PID 3484 wrote to memory of 4732	3484	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/000.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffc9f53cb8,0x7fffc9f53cc8,0x7fffc9f53cd8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1980 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,11696514962623041146,1553423267431980191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1172 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4824
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3100
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3604
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /f /r /t 0
      4⤵
      PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39fc855 /state1:0x41c64e6d
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6e85c76654355e2ba9c1c797c3fd0a89

SHA1
5e3246bc157e7c678caf3628682410a22cd008cb

SHA256
07db8e5fcfd58c467f88a0465c16ccac9a34305c170252ad2bb84aa1e9e0ce3c

SHA512
14bd2c7ff57285cdbefcf377730129393721c84152235fef9ec8678233a588253eb7f5f7f7b614dda1fabaf5023d65758c376a50039327b05b37fff69a814ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f50ba15ea686a55b06c2fd0fe6395e68

SHA1
ad9bd56efd35075eaea315ae16231d3119329d3c

SHA256
54d57e3437a8c25ed4a38d58cbd50642bad99ce24a30cd567158e8f961469348

SHA512
a0f800cae207bac399da3d5056829f9a6495cd6d68c7cd4be1a434c5638c3e676e16f2ec887f2a9946d8c741d177c4b5397b6c8a852e94873fa3ae3dd309b7e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dad1360367518e7710772ec37eb39429

SHA1
ed7551ceb3b1a89a711f514642f2cdf932d1ae54

SHA256
7dab72e32e0cbfcfe17b3ca6635971aee668adbe8316212728d782633e5fbaa2

SHA512
71e2a59a75e4d0b86495bf16beca40873c4907a9e0121dc201d98a85fc59beda274ba48d66ed8f832521b71819d430620cdb5c1cb824894a4394ec0bd8c21c35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c54a5b0c2d1537ad07140296b9a8791a

SHA1
3675d2ab4f3c1dc09783177d75ce0be07194a5e7

SHA256
f9779de677284fe8f366863f292af4099475b8f0b49dd9938021c3034d07cf22

SHA512
66a6dfe55d75384e4bcd0604c2347a5a3264ca505022eeabf21f1b21b4b4c5eac74e2ddd6961db57c87b560e4f17e4eb55046c4bac3f5ac59ad828a5bfb2f924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
26604bc6bc93add527ba91f36d83793b

SHA1
484b431a8b67b29080cf624e41c545bb51787bdd

SHA256
497d70b4858364037705f91a7131ff6d7874c4e8f72a8f7bcafbee650905dafa

SHA512
b147c328b57ae67a4495b3d83dcd6af4f18b884783b45d07ef83e4e3e0893c6bd27107436a6b99952c5554fc59429f083fcf5f9e74588d4806d7fbf016f2f3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5813b2.TMP

Filesize
1KB

MD5
9537512d7b9f4f77941d1bcee4975339

SHA1
2860f05e68336d5cb6618d0d5847b56616ed2d62

SHA256
37846aa2f048c2622f3955139e428d61a5ea10a7195192ae6726c95e29a45496

SHA512
3692ccf71b6bf0dbc59d8cb678e7d368b2b5e20cea310028ba3cc11f31fb5f2797c222f3236cec5497cd02b5d7ec7cf5559d8e2e2bad1c4b7b8ab8dd1616d5be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\60b44471-e0b2-49ce-b603-819851305bea\3

Filesize
1.7MB

MD5
f7afb25d27a61917a2f26df8df3a1c1e

SHA1
bbfc1acb17d86f6a9562e1bd0f0f740413be2e78

SHA256
82df41538e6d381bc55ff884d5eadbc2dbbfeff57f50782e24842c4341829554

SHA512
ae7cb5d064728256959351d10f8f9f05482b2b796dcb08a378548656a91c1df3754c9225ac69e9462908ae332713202699767033e53aa1c74e0f542fb21b654b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d7f1d704add2e73f829efa7e740c28af

SHA1
eecc5d9d1a7f87481c4b94a5e089cc49e2254728

SHA256
0522f622100329d3df4a6856ce445268ef8132a32e7c14423a22866db416b63d

SHA512
8e4dfbaeec0515afe871e044ee7844514fb1565ac0135dfab7b8fb84c8731aef8d9ebe4330bef56de92890684098cc07f6796fb88ff0841bbe0421d8c7d78230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9dba9c81c67e742e1d026294e99f8cb

SHA1
557bd145691155ef5d0d708dd23750f796797bf6

SHA256
058d20a41b40d2372ee57ad7add8a3a6ee0c607134ee3872cd8df050a533c146

SHA512
adc70e8b975d2c7f1adc2d6af934250eb14be4269dc8ddd751a2bf5a923d5be143e2c34d48530ffd65338f85a77043e5f59bfc9cb8a92b295093a96fde276662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
923d7863028308848dca068700944e06

SHA1
c38a2c67437dec29759858eb069c67b84bdc4d3f

SHA256
5bd07a343dc9701552ac8fe7ad9bc6144bd5fb55f56531f90cefd7c883861d94

SHA512
1d044df38ab4920f3bb63d4d491ff3be5ec23629765c26af7f9264351874ca9560f25782812d684256a8c919df12457792951b6bed129f162861dd2f74b17810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
a195f69f5994676e2aabd2d04ba1c078

SHA1
a698dbb9012169995d28417eb1845f8539411384

SHA256
a59b13b3eb4b4f53724952ff36503acc752a6bd1fc20c87ec15f812f3e0f3da6

SHA512
bd6dff6ee450c9dfd43b700a9d020eae34d273674fd9c13a48ad9b4d66d82e4d86d9ce0b62a4d922f6c53c38ffcf7c4ab42c3006ea22546e08de2d11bb892988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\one.rtf

Filesize
403B

MD5
6fbd6ce25307749d6e0a66ebbc0264e7

SHA1
faee71e2eac4c03b96aabecde91336a6510fff60

SHA256
e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

SHA512
35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

Download Submit
C:\Users\Admin\AppData\Local\Temp\rniw.exe

Filesize
76KB

MD5
9232120b6ff11d48a90069b25aa30abc

SHA1
97bb45f4076083fca037eee15d001fd284e53e47

SHA256
70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

SHA512
b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

Download Submit
C:\Users\Admin\AppData\Local\Temp\text.txt

Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\AppData\Local\Temp\windl.bat

Filesize
771B

MD5
a9401e260d9856d1134692759d636e92

SHA1
4141d3c60173741e14f36dfe41588bb2716d2867

SHA256
b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

SHA512
5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

Download Submit
C:\Users\Admin\Downloads\000.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 607447.crdownload

Filesize
6.7MB

MD5
f2b7074e1543720a9a98fda660e02688

SHA1
1029492c1a12789d8af78d54adcb921e24b9e5ca

SHA256
4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966

SHA512
73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

Download Submit
memory/4268-319-0x000000000B860000-0x000000000B870000-memory.dmp

Filesize
64KB

Download
memory/4268-313-0x000000000B8A0000-0x000000000B8B0000-memory.dmp

Filesize
64KB

Download
memory/4268-311-0x000000000B8A0000-0x000000000B8B0000-memory.dmp

Filesize
64KB

Download
memory/4268-289-0x0000000005A10000-0x0000000005FB6000-memory.dmp

Filesize
5.6MB

Download
memory/4268-318-0x000000000B860000-0x000000000B870000-memory.dmp

Filesize
64KB

Download
memory/4268-308-0x00000000090E0000-0x00000000090EE000-memory.dmp

Filesize
56KB

Download
memory/4268-321-0x000000000B8A0000-0x000000000B8B0000-memory.dmp

Filesize
64KB

Download
memory/4268-320-0x000000000B8A0000-0x000000000B8B0000-memory.dmp

Filesize
64KB

Download
memory/4268-322-0x000000000B860000-0x000000000B870000-memory.dmp

Filesize
64KB

Download
memory/4268-288-0x0000000000220000-0x00000000008CE000-memory.dmp

Filesize
6.7MB

Download
memory/4268-314-0x000000000B8A0000-0x000000000B8B0000-memory.dmp

Filesize
64KB

Download
memory/4268-312-0x000000000B8A0000-0x000000000B8B0000-memory.dmp

Filesize
64KB

Download
memory/4268-307-0x000000000B640000-0x000000000B678000-memory.dmp

Filesize
224KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads