hxxps://drive[.]google[.]com/file/d/1FIpHm1dxG2bMfqj7lQI68XysszxDFeMW/view?usp=sharing

Analysis

max time kernel
80s
max time network
82s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21/08/2024, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1FIpHm1dxG2bMfqj7lQI68XysszxDFeMW/view?usp=sharing

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1316	Main.exe

Loads dropped DLL 1 IoCs

pid	Process
1316	Main.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
4	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1316 set thread context of 1980	1316	Main.exe	115

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2842058299-443432012-2465494467-1000\{9FCA6312-5D47-4318-8367-7A3A651BA3A7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
72	msedge.exe
72	msedge.exe
852	msedge.exe
852	msedge.exe
3352	identity_helper.exe
3352	identity_helper.exe
4604	msedge.exe
4604	msedge.exe
992	msedge.exe
992	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4484	7zG.exe
Token: 35	4484	7zG.exe
Token: SeSecurityPrivilege	4484	7zG.exe
Token: SeSecurityPrivilege	4484	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
4484	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2280	852	msedge.exe	81
PID 852 wrote to memory of 2280	852	msedge.exe	81
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 3100	852	msedge.exe	82
PID 852 wrote to memory of 72	852	msedge.exe	83
PID 852 wrote to memory of 72	852	msedge.exe	83
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84
PID 852 wrote to memory of 3608	852	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1FIpHm1dxG2bMfqj7lQI68XysszxDFeMW/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc369a3cb8,0x7ffc369a3cc8,0x7ffc369a3cd8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,1957242263660501218,9323283358842838188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1652 /prefetch:1
  2⤵
  PID:976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3052

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap22278:70:7zEvent27997
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4484

C:\Users\Admin\Downloads\Main\Main.exe
"C:\Users\Admin\Downloads\Main\Main.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
9a25111c0e90867c7b8f41c5462abfaf

SHA1
0619625d479f31cf145c2e3714de0df4a69169d1

SHA256
41bb42020f1beabc9e72913ef6a33aa264556ec829ac70fd92c9c9adfb84803d

SHA512
0fbc3c64d6f5acc2c0dab67924b0c669fefa994f449240d1f6b78dcac3538343938a4fae972726156189f05806d3aae0e333035df52605ffe28886b82f31ccdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
222dd5298b478d171da3d96219d002cc

SHA1
830e817dba8b4453c73682d38181af842d22c998

SHA256
77ee4c51e498b12367509159aaba73df78efe8cae23b161805404b2d51b84643

SHA512
8303a1d9ab8d899c2417f5b26e6d162d30d93112b22d55ee8cfc9c18af4fdee2e0ae02e50a70f2324b33477bab4fb39e18caee6f90ebfc426d872a0d6837d670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
8162e74c557a1da95767d67c27b4ed2c

SHA1
707b5ad322e4deb9c63c23bd08dc1e934f3f16cd

SHA256
6b22c54a5464be17872b0bd6b5f67e8d29529f45184a2276538bdc414a54649f

SHA512
c29388b1a65e97e3c639d2112b82fb8754a0c8fccea827241eca820bd962e026cb9f6bc97e98b80d3536aa8ca2ae37cb685cb05f84cca12fdf7ce3d9fbd61304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
87daad8b4e44ca941e9467702356ad1f

SHA1
c37e87535b315aa1007f9911b5fd2b3da0a2ea83

SHA256
e8556be0acc87207c4f97b97b24af4678549b0baab3e603661374200affd233b

SHA512
c277dceb68d0c02e2d0e81638f19c96b2975d95b627df21f408ae52f42290eec1eba90e6a7d1d399529bd7d81363ec17abf8f4d5b80a88b2ed02c2d5dccfe692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3fdcad4611f8fb9d89fa601626095faa

SHA1
a7308257334a3c817a2038220180e17e24fdf2b1

SHA256
b6c289a76bf62378ee6cd4bfa090c64b73fd30117d9f3365c0aa57e8ebd59f90

SHA512
0bcc022677eb6e43121493e9eeee7d7fa0ca9c7aeeb64b529e28c9efdad673bc16280beba9e6317d5f0673c04abc138140ea6e1341b1534189f0a21f8a1935bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05d908c7a114171a36d5561a4b22bc83

SHA1
42f3cbaaa0b95fb603f568bfff96136253a7d7fe

SHA256
a0105da19c9ce80334885764898ed49ba8457a6aca564b8ff67ead1dd18a95f9

SHA512
55aa7911c92edcab197a553a5f742f1b60d334725d344e7c6b8c14fb6a96400dc5b93e9cc4a3ec6343b024381a43e2f6c99e771fa06afd948c2106319e7b00a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1f5a936878d1249bc0db14baf8d7af2

SHA1
40f78266f86b2f02ea1b431075e700e1fb02e910

SHA256
6de25c16cc7f871e20b3b7ae1d5e4a80b4a1a3386683a2a826a234ff175754ed

SHA512
951d6c31d96cc1c464593760bc09d4fab9b3e5ec33608d0fc4a299c107a34c7f5defa13f2ea4a248c95575ed1ef953010ccac60ab35bed26ab48b350a97c92a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2752e0bcadcb70657680ece2346bb532

SHA1
1c9f8399ba7ad07bad125280f5a541335a5846b4

SHA256
7994784b1b2f3796aa5276e7415ef2f1c9dbe28942637523bff3bbb52bd218d1

SHA512
0de33cccea64b39c8de57b4ac08da94ffed3f058d767474cc6ca75fc943dc19d09ab17dc18f084f73ec252835ff7bef26048768936a26366ab33e3a40b9b7c55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
23676aaa03e0d723a15071e615872376

SHA1
24fa9d80cbd74740fd3c6794f251370664c422aa

SHA256
f68801bd58ea5dc30eb555ee9b8adc2758a221926e9ab2e798ebd034faed1944

SHA512
af4ed3a1ece57e6c29c8150ec346c6ae8fd9d2ecf4840e6fe6c840f2aa22bfaca87b5613f1681c9d6c564c6a09bdbc6bc9acd5aedf9f210f02efad12c69673bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e973174be575c186041decacdff0480f

SHA1
2684409f2f813a92ffe6d6f2b73c49800265285c

SHA256
9ee5a7337e6c5a4f4527ed32e308f39ba688035f1e13395df6b3308faceeeee3

SHA512
3adde48a854d8b73bafa1564a5c77a68efb1ba62fd3cbcfae553b72808cca6a7f04df066bcd220780478aa8c89e3e369f1e3518265a4465a500fa93809c0a25a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581160.TMP

Filesize
1KB

MD5
632cf9135756cbf1e3b2f25335d2cd0c

SHA1
2b0514eeabf8050234ad6b6e961f1cc1bfabff67

SHA256
2ca53670eabac9191e088b9c51ab546c12d418375ea0e3226d92da8f16ed9776

SHA512
6b889407ad723aea6bfc3b269d0a226f259203585d7da1f7efcbffdfab861eae0590e190f0084c765646572b8aed22d95085532396b70b54f355e65103c83218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2990d55e0c9f1627fd1325347ba2f1c0

SHA1
d9fd703feab5f363e1b2508239691367148c55dc

SHA256
6af669d93202b593cf0c72787908438d173bf54265b374866457ddbea82c8d17

SHA512
7f29eccc30425d6d640830b018a950e4ab7b06bcef26b2b86956ee25edf1dbc2f4016e332a0df1883db508820fe07ea1aa333d91cdeafcc08e261e93ca816f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
212c1fb542ece16e809ad1e35f9dcf54

SHA1
16388821f2e269130022f001d519a669bc1ab816

SHA256
f79878278f84d318e3599427598bce9d388fd3e3dcda7c8568b67e0a9fe39c78

SHA512
e24eb9dbdc66be70346032e1c5b097e5709fae5979c6bd62c319acdbea50c5c344751e2f8b55bacad47cbba6891e79719041502eda2e6a2ad80c34065f2f3332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f3e577f84e500e16e59ccafc223c36e7

SHA1
53ffdd7ec74598c0cf784486eb11f19238acddba

SHA256
fe3fb578c54e7ddc1942a78f47e6f33e8c8907c75757afbada100ae19c9886a7

SHA512
e95e9f775b7b76d4bc0b16276570816cb0c458f92ef8ea5b9188fa004da19209177a48f095b7d102b6baa31090fba2381b3b00940b9962a4f41fe82fcea3bb7b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
41ce6cd728e8893a0387cd1d5aaf201d

SHA1
c6c5257c73d52968b03fa7a332f61f050229999c

SHA256
c6ff6212cd4c01ff44605a8339568c3ed2b9dd85c7956873ee9db592e24b654d

SHA512
73c40effe3fa0c521cdd5347e85ac142666a5a7b982d96c80f4c08c079d2f5a8d58c12644af20f27b8480040eb74b28d0696be16fc9566c02bf2d60d08839c27

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
9bef7c41d0bb3a44a18c637e03b43e7e

SHA1
f093796be97df77af8a2595d56816f813d2f6558

SHA256
ffb02e89bbf055faff78823c2dfff35172c48a095d8f698bcdb447a86408ebf8

SHA512
7f543a259b79eb4ac25db95bd1059d746acfc192f3d5ddb44d3a63990a2cd31d6b404c0ec3b659457de58a5bad5254680764eaa6a7f6dc35076971f2542750fa

Download Submit
C:\Users\Admin\AppData\Roaming\d3d9x.dll

Filesize
472KB

MD5
8ee22e5eed62160bbd73486515444675

SHA1
2e4a73f154b8fa0c6c5ad4dc9eb39a42374cd8d9

SHA256
cc1cdd0247e83886a1b014a5048e2a920b92d1cc7e82f23a93cf51c56bc72e5f

SHA512
9ba3e72705e02c21f70cb6172a0833e14e70c96ebb63722763fdb69de179126d1232740c7646209628104b5e8f514556a98761f770cbb21c1cb2bd3a0cc2bdaf

Download Submit
C:\Users\Admin\Downloads\Main.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Main\Main.exe

Filesize
678KB

MD5
8420aa3e4c994b17e2c002217731642b

SHA1
e4a698d615cf7fc6b79d3e4c01e724a63eab2481

SHA256
b0a1383874ecbd60ffc63d78c9ae35b972c1f07d73f7ce61ad0fc1302e83058d

SHA512
603b66b68af4b212886dee102f54e88a1c1a13e17ed7915bae8d8c7ff3fdff35da4d2b44bc7d26c553f85d61436e6a5b73e0dcb3c5ee217515ea98b9b6f6fc86

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 690316.crdownload

Filesize
459KB

MD5
7195af62b3759e6be253dd70439b5140

SHA1
eabc4b74e35440bb81d516047d9cfbda012d2191

SHA256
62fa84dd433bdb0df7e0557696e85ceb43a5e32e166ef05ffda740f1e0c58015

SHA512
5aba510a4af1df154b84d6f54c4b3f821ec621664c2a3c962197ea034e31ac4d7b9af8f3bfe3564a5f0c1d98a93de302e631527e58e9f4da87c62bd5558d382f

Download Submit
memory/1316-435-0x0000000000D10000-0x0000000000DC0000-memory.dmp

Filesize
704KB

Download
memory/1980-442-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1980-444-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download