hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/000[.]exe

Resubmissions

19/08/2024, 02:23

240819-cvbd7asfkr 8

19/08/2024, 02:22

240819-ctq39ayhle 8

19/08/2024, 02:19

240819-cr16fasdrq 3

19/08/2024, 02:17

240819-cq1hhsyfrf 8

Analysis

max time kernel
24s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/000.exe

Score

8^/10

discovery evasion persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2128	000.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	000.exe
File opened (read-only)	\??\P:	000.exe
File opened (read-only)	\??\R:	000.exe
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\X:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\K:	000.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\O:	000.exe
File opened (read-only)	\??\Q:	000.exe
File opened (read-only)	\??\S:	000.exe
File opened (read-only)	\??\T:	000.exe
File opened (read-only)	\??\U:	000.exe
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\H:	000.exe
File opened (read-only)	\??\I:	000.exe
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\Z:	000.exe
File opened (read-only)	\??\E:	000.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\L:	000.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
55	raw.githubusercontent.com
54	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper	000.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5208	taskkill.exe
5288	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{E24C01BF-123D-48F3-9F6F-DA45367A947C}	000.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 710008.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
4064	msedge.exe
4064	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
3840	msedge.exe
3840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5208	taskkill.exe
Token: SeShutdownPrivilege	2128	000.exe
Token: SeCreatePagefilePrivilege	2128	000.exe
Token: SeDebugPrivilege	5288	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5512	WMIC.exe
Token: SeSecurityPrivilege	5512	WMIC.exe
Token: SeTakeOwnershipPrivilege	5512	WMIC.exe
Token: SeLoadDriverPrivilege	5512	WMIC.exe
Token: SeSystemProfilePrivilege	5512	WMIC.exe
Token: SeSystemtimePrivilege	5512	WMIC.exe
Token: SeProfSingleProcessPrivilege	5512	WMIC.exe
Token: SeIncBasePriorityPrivilege	5512	WMIC.exe
Token: SeCreatePagefilePrivilege	5512	WMIC.exe
Token: SeBackupPrivilege	5512	WMIC.exe
Token: SeRestorePrivilege	5512	WMIC.exe
Token: SeShutdownPrivilege	5512	WMIC.exe
Token: SeDebugPrivilege	5512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5512	WMIC.exe
Token: SeRemoteShutdownPrivilege	5512	WMIC.exe
Token: SeUndockPrivilege	5512	WMIC.exe
Token: SeManageVolumePrivilege	5512	WMIC.exe
Token: 33	5512	WMIC.exe
Token: 34	5512	WMIC.exe
Token: 35	5512	WMIC.exe
Token: 36	5512	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5512	WMIC.exe
Token: SeSecurityPrivilege	5512	WMIC.exe
Token: SeTakeOwnershipPrivilege	5512	WMIC.exe
Token: SeLoadDriverPrivilege	5512	WMIC.exe
Token: SeSystemProfilePrivilege	5512	WMIC.exe
Token: SeSystemtimePrivilege	5512	WMIC.exe
Token: SeProfSingleProcessPrivilege	5512	WMIC.exe
Token: SeIncBasePriorityPrivilege	5512	WMIC.exe
Token: SeCreatePagefilePrivilege	5512	WMIC.exe
Token: SeBackupPrivilege	5512	WMIC.exe
Token: SeRestorePrivilege	5512	WMIC.exe
Token: SeShutdownPrivilege	5512	WMIC.exe
Token: SeDebugPrivilege	5512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5512	WMIC.exe
Token: SeRemoteShutdownPrivilege	5512	WMIC.exe
Token: SeUndockPrivilege	5512	WMIC.exe
Token: SeManageVolumePrivilege	5512	WMIC.exe
Token: 33	5512	WMIC.exe
Token: 34	5512	WMIC.exe
Token: 35	5512	WMIC.exe
Token: 36	5512	WMIC.exe
Token: SeShutdownPrivilege	2128	000.exe
Token: SeCreatePagefilePrivilege	2128	000.exe
Token: SeIncreaseQuotaPrivilege	5672	WMIC.exe
Token: SeSecurityPrivilege	5672	WMIC.exe
Token: SeTakeOwnershipPrivilege	5672	WMIC.exe
Token: SeLoadDriverPrivilege	5672	WMIC.exe
Token: SeSystemProfilePrivilege	5672	WMIC.exe
Token: SeSystemtimePrivilege	5672	WMIC.exe
Token: SeProfSingleProcessPrivilege	5672	WMIC.exe
Token: SeIncBasePriorityPrivilege	5672	WMIC.exe
Token: SeCreatePagefilePrivilege	5672	WMIC.exe
Token: SeBackupPrivilege	5672	WMIC.exe
Token: SeRestorePrivilege	5672	WMIC.exe
Token: SeShutdownPrivilege	5672	WMIC.exe
Token: SeDebugPrivilege	5672	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5672	WMIC.exe
Token: SeRemoteShutdownPrivilege	5672	WMIC.exe
Token: SeUndockPrivilege	5672	WMIC.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2128	000.exe
2128	000.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3080	4064	msedge.exe	84
PID 4064 wrote to memory of 3080	4064	msedge.exe	84
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 3372	4064	msedge.exe	85
PID 4064 wrote to memory of 2580	4064	msedge.exe	86
PID 4064 wrote to memory of 2580	4064	msedge.exe	86
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87
PID 4064 wrote to memory of 636	4064	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/000.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fff6c0f46f8,0x7fff6c0f4708,0x7fff6c0f4718
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2268,13849842372644944847,77264608736844003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5288
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5512
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5672
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /f /r /t 0
      4⤵
      PID:6088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4352

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3969055 /state1:0x41c64e6d
1⤵
PID:6100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
996bc79fc2ede0f44aca0b3918889a85

SHA1
9146e717f47d0739041ab81a81f3cd7d96d382b6

SHA256
b2b180aeb2ec899e1cff504f2fd6710449dbbcf80bab9e4f7023a6e21ef88d02

SHA512
f30a0495cb3fe8456282b7d10ce6b157b3fe9eb66520c30e1ca9fb45dece5b4881df91c04cbc5e134d67aa415481d9d90d9801ca8e80472b943f3d34a99656ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
042881126237e9016e8cc38615eece04

SHA1
474c5ee80e3328da12623757e809717ec26b3844

SHA256
46b94768bc7c313a52bad73fcaa5b04fccf269722dcdfce5bf04514540187322

SHA512
3c7b1ae30ff2cee7a47bb949c804e0c514222a34e4d3861b3a1c4bf1ee17d90c0c50e330211f12493e62514393a833b0deedeabe053abfcf51c9777234f7e851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f3d7aef9c37c2bc9fd32db735b6bff4

SHA1
b5d20c62d6b639968a826ee310704c0f132631c6

SHA256
b14abe160931bfa41a7984461deeb5e0071876cdc8db4d7b5fc3275907379fb3

SHA512
6443ee5bf4cb5867881dedecaca282c4ae128e75fab631ea4b58bfed2d73d12c73edea02fa640484bc0c6bcd0ec903db2c13aa597a7602c92283dc51249457f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6779977f0721c36ef98fb4c29f33e071

SHA1
9c1fca3a76ca6c05195eaefcc52e85e4a33761d2

SHA256
4e12244a9320ba0d7f104145f79156797b6532e2384f3d6d44fe073c623012dd

SHA512
a74a96cf5a0b20e5432a1641df0315192d90b1c12f7c55bf6e94226400bd3c2862872afb7940b502b921399b9910eb51b0001d3c0f876a75891daf1d0b4fdd26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0a2b558384953906cbbe67a814e23299

SHA1
a960c084cdaab69fdcd2a7542ebb4cb95a7c009a

SHA256
f7ec9bc4340a8777fce628f24799c46997a7e0527647339c673c44a9970632b9

SHA512
cea5900491c2eb5595022d1e6e7421704332253225119adb83c361c709979bc9b5065cd92fd089e9de494ef2f70374d3ef78f6c47c7fae8a888b97a1250b5e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eb89.TMP

Filesize
1KB

MD5
2e58a8959a8b6adc3413597aa30f060d

SHA1
a56ca7faff6eadb21a6e0c9e3a538c778537baee

SHA256
d5881d8b234f6f534ee271aa8d3b0de5c200d10b1ffd4cfa14918b1a94edaf94

SHA512
abc07618846b7274f20cd52090997612c478b923ffa809ce681dd9b41c79160448f710617adf6abdfcbbf9e921e942b7f5ff877d011c631e37a849e647766db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c55c39e088857ecf102ca2294eb7f97c

SHA1
232ca86e01f05cdd885c9fc1498b06c4a74954c6

SHA256
f1d113c156cfd68c77b27915d14a2863d2b1cacb78293f21d942458e99cb3b6a

SHA512
2ce91c53db69ec063559a27f483a5c00927aaa28185346ceb4ca97afcca84b0af05907867f00d58a4591cbb3c7ed271750485ea2f34b53083a8bbc011f6bf25b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9c4390d502534f40de287d2879cce42

SHA1
9504aa5d3bfecbac21465ad614f947c8c825a6f1

SHA256
8f8aad101106df2bf3ca4706a1c46dcdcea9e98fb91c4e0a727e534a230bb093

SHA512
ab68a45c9cc5ebdd9cadb475485721fc98b0e3c36a0277adb50c72e4ecfe2fb77e94952e4713e3396bcbf5ca36baba90ac969facfb1ef7b890c37e488cdcf2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
810ec618390f80c4731c3183454fef0e

SHA1
66ae5d0de8fd82cfbb35dd30b09217f4ec196fac

SHA256
f0757fe17bc53bf782ef5f9a6fce4fcdba20236f764f723b551f27c09872213c

SHA512
4a6723c3b5934cab9571673d145f8d8e62a824fbb9aff37611e84c9f9ae481a43e5982d3aecb59140d7af9b244942f9cc9e0e549d49f957405f9d90e08ff3b3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\one.rtf

Filesize
403B

MD5
6fbd6ce25307749d6e0a66ebbc0264e7

SHA1
faee71e2eac4c03b96aabecde91336a6510fff60

SHA256
e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

SHA512
35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

Download Submit
C:\Users\Admin\AppData\Local\Temp\rniw.exe

Filesize
76KB

MD5
9232120b6ff11d48a90069b25aa30abc

SHA1
97bb45f4076083fca037eee15d001fd284e53e47

SHA256
70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

SHA512
b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

Download Submit
C:\Users\Admin\AppData\Local\Temp\windl.bat

Filesize
771B

MD5
a9401e260d9856d1134692759d636e92

SHA1
4141d3c60173741e14f36dfe41588bb2716d2867

SHA256
b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

SHA512
5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

Download Submit
C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 710008.crdownload

Filesize
6.7MB

MD5
f2b7074e1543720a9a98fda660e02688

SHA1
1029492c1a12789d8af78d54adcb921e24b9e5ca

SHA256
4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966

SHA512
73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

Download Submit
memory/2128-251-0x000000000C960000-0x000000000C970000-memory.dmp

Filesize
64KB

Download
memory/2128-255-0x000000000C960000-0x000000000C970000-memory.dmp

Filesize
64KB

Download
memory/2128-256-0x000000000CB20000-0x000000000CB30000-memory.dmp

Filesize
64KB

Download
memory/2128-253-0x000000000CB20000-0x000000000CB30000-memory.dmp

Filesize
64KB

Download
memory/2128-252-0x000000000CB20000-0x000000000CB30000-memory.dmp

Filesize
64KB

Download
memory/2128-250-0x000000000C960000-0x000000000C970000-memory.dmp

Filesize
64KB

Download
memory/2128-249-0x000000000C960000-0x000000000C970000-memory.dmp

Filesize
64KB

Download
memory/2128-248-0x000000000C960000-0x000000000C970000-memory.dmp

Filesize
64KB

Download
memory/2128-241-0x000000000C900000-0x000000000C938000-memory.dmp

Filesize
224KB

Download
memory/2128-242-0x000000000C8C0000-0x000000000C8CE000-memory.dmp

Filesize
56KB

Download
memory/2128-223-0x0000000006770000-0x0000000006D14000-memory.dmp

Filesize
5.6MB

Download
memory/2128-222-0x0000000000FE0000-0x000000000168E000-memory.dmp

Filesize
6.7MB

Download
memory/2128-254-0x000000000C960000-0x000000000C970000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads