hxxps://github[.]com/enginestein/Virus-Collection

Analysis

max time kernel
202s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
22/08/2024, 14:57

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/enginestein/Virus-Collection

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1300	Hydra.exe
3236	GoldenEye (5).exe
3636	logman.exe
3600	GoldenEye (5).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
26	camo.githubusercontent.com
26	raw.githubusercontent.com
47	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	logman.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Hydra.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\GoldenEye (5).exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoldenEye (5).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	logman.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 11 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 88033.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{81387f43-166f-4126-a6ff-84d70e87d179}\logman.exe\:SmartScreen:$DATA	GoldenEye (5).exe
File opened for modification	C:\Users\Admin\Downloads\GoldenEye (5).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 992630.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Hydra.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 706801.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 740112.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 641370.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 861534.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 38877.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{81387f43-166f-4126-a6ff-84d70e87d179}\logman.exe\:Zone.Identifier:$DATA	GoldenEye (5).exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
4988	msedge.exe
4988	msedge.exe
1648	identity_helper.exe
1648	identity_helper.exe
3736	msedge.exe
3736	msedge.exe
3520	msedge.exe
3520	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3636	logman.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2292	4988	msedge.exe	81
PID 4988 wrote to memory of 2292	4988	msedge.exe	81
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 1084	4988	msedge.exe	83
PID 4988 wrote to memory of 2300	4988	msedge.exe	84
PID 4988 wrote to memory of 2300	4988	msedge.exe	84
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85
PID 4988 wrote to memory of 2288	4988	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/enginestein/Virus-Collection
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xb8,0x10c,0x7fffa0813cb8,0x7fffa0813cc8,0x7fffa0813cd8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1652 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3520
- C:\Users\Admin\Downloads\Hydra.exe
  "C:\Users\Admin\Downloads\Hydra.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,11259329987147097140,3664747664545526428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Users\Admin\Downloads\GoldenEye (5).exe
  "C:\Users\Admin\Downloads\GoldenEye (5).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:3236
- - C:\Users\Admin\AppData\Roaming\{81387f43-166f-4126-a6ff-84d70e87d179}\logman.exe
    "C:\Users\Admin\AppData\Roaming\{81387f43-166f-4126-a6ff-84d70e87d179}\logman.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3636
- C:\Users\Admin\Downloads\GoldenEye (5).exe
  "C:\Users\Admin\Downloads\GoldenEye (5).exe"
  2⤵
  - Executes dropped EXE
  PID:3600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
254KB

MD5
e3b7d39be5e821b59636d0fe7c2944cc

SHA1
00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88

SHA256
389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97

SHA512
8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
67cb91002356c8f5d3f3e53d376b8815

SHA1
578c32dcb73c45ae1ad4d248b50a92fa5ea0a057

SHA256
843dde459105158f04e89d455749a5ea32a154e5a3b328024b07ece19e000baf

SHA512
fac7c2ada309b95689674d73289c1fdd3c648f28ebf42b03694a8d05a064d9fa536b7ee331ba2cd216e0f16fbc6aa96039dd1d36960fc0c8285db613fc9546e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
ed5f4213c17629776cd75510648fc019

SHA1
ebfa685dca9b7c920cd5ad521c03e4ad0ce435b9

SHA256
e969795f0e63ec8a35cdf34d5bc43867ca0825bebfed9734943e69b34ed2ad87

SHA512
71bcc166ae5a48f7a79aa5de7ecc7e10dce22c39240ca9ffe9d0f9340f40fc2a2429529cfee8b2b5d7082efe94921fa7df3454852d5313ff4093bfdffc189627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7e145c41a63943ae4647245438b14d8

SHA1
c80c39880462f861947d38f1ed8095e647376ff6

SHA256
2b16888e0a0f8fa184536be0c5886b992cf23f3fddfb8be4ba1753a6752b3677

SHA512
f40c4249686ebb236865f6a5684000235720a4028760eb96aa1a3e6029689c16499ef9f9b6b1d322259d2afe8e3e332a4d17e05347ac30a37c635b0fed023bc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5225fa1228ab3d420344780202546178

SHA1
bd1adae4cdfe33eeb55974d31187cf728d671260

SHA256
c0edd304d5a8d884495b3f53392185aa3129d2164587e936cfe5adaeccc4df27

SHA512
0753a89314be2fe02d484909507f31689974d4bf2023669ade1c004fb7c71948605593829230ec1df567d83a4d5454cbf34a4afcaf721d33bb4d4b5b18726f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcfe4747d6358506f52bfe5d07891f07

SHA1
364ca2f76003adb049c4197de06e1636f3e208b8

SHA256
e29eacf5ccb87679dc9d21b176d64bf7edbc306e6f2e493b42b25a847452fe4f

SHA512
d2c6d4cdd2cd4c8c79e5f985433999c41b42ed1757995a89c511981f0575ccd10eee47c5f9c8d406b25a49556c0cf4982e647497eff4ed29d694b5f83ca5de86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a7764f8ff141423c2c85170211ca07f

SHA1
4130d0fcc207e799545f5fbc2c0f47c884c01df2

SHA256
87d2865cce7081863628b6e35f803c9630f47f8f2aea2edc740280b4e1662601

SHA512
1b9e76c15479daff907b63d64f98fc29dd3a60e35cf76fa5685b85c17bac37109d8a4f727b85520fdce18007757d11fe3b4e6597d92a72b1ce86626d3cc80693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cbb3b80aea74ade2e8acbc0eca200843

SHA1
b6ad191bd76ff9ccc0073195a93d5df5ce725bc3

SHA256
d1396f429abdd3c371158d10239b17b25ed3c8b2d2ce58e47ac28406823b22a4

SHA512
7d47e9445c744a91a2bb09bc95067e237d3187fdd02fb204071c5e0ae552d10b79b5fb8d2ed3001d1c717e75fa7990a39105b2bff55bac5d59570cfa5ae2e356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
da188db751be676926a64f83b59cd6e1

SHA1
b43a7ce35951559e89a13586aa12d5f0cbecbc6a

SHA256
f3c0a836d197dbbcfd9dc41badaa77e7605c2235fa4b40d72a41b8c49d335458

SHA512
8ab359c5d6a571cd123560395a64e4a5ce96fb50a46732b7f6e87d2414b75d1823ead73a835371e31b6eb4dcc09d0c4304e4fa197277c3ff8acf01ead7898e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
72277646774d2b899c97b3a936023f30

SHA1
469a0ab357c1d3198153124556ec385d5e6c5645

SHA256
19815bf166cfd6cab90ab52d02540829263841b25dd5fbe9f01e09d585d8b596

SHA512
3ea1d817498138fa8846368c1515a0ac233443cb835ae719a56a52a399051d7ed829ea977fee1664fe253a87c2bdd94433a853497c4faf6a6ff045053494adc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c248beb6f323b180557a951af56b7de

SHA1
7149a4759ff7cde1eda5b88627038357be51e9ed

SHA256
e611d115d0ce53e2fb2a11a4e8e6353d4133f282a20c1defdbcacca407c351e2

SHA512
7c64310eb4cc14bbda633c29d4f081bc4aebc0cdcca2970093328faf933aaf0f05c60549bb7abc5eb08668ee6f75a1047d2359d4fd6007333347a1da3c2f5ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9421b6ad80539a4358d80e751b4ed1e6

SHA1
130ca26ba43bc8b473b529a6fba1f290ea5a3bbe

SHA256
69a5568c744e1f687d94847792504df26c42d62a5288fac3333474e9a567ef41

SHA512
4df82cf69d7e0c70d92c3a3c4fd58389cfeb733eda9d039026554b341c1d81b84dc71fc350be38b254dd32e1b1bbf0adabbd1bce3cdd4881035e36a104c1d8a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a92c.TMP

Filesize
874B

MD5
99d62293a2f8f9696019b10fb7322eb3

SHA1
99eaa0e4dc1303c9b6b6be9acc86e5ed23f6e99d

SHA256
ac5884269894f2eb3928173651e8b132dac9d5043387ebc2661befecb27478fe

SHA512
56731729fd7c536eeb412a35d52748d9fe9cf4d7611646cb44b71c72fec522a56e4c7345cc09d7b7a4ce2f88be4fb113e2038c5d44a5f70ee2196c500228c7dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5647dc86a71602d7b8293f140353f2db

SHA1
030cc6c31083f355c79ad82b3c28f66dc3ca239c

SHA256
c13345a5fa912c60e79eafd407e7f1c2ec3400b1f41a43b2c54eebea92b607e3

SHA512
9d468c3c0ef36325d477106cdea890b9c1672781df8c02ca091716988949c056dacfe7c93c99e4776c2689567b87f21315977bd88f4cc3b0aeccc151e4e39460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
44a990ff97e2826cc70d20efb998d1c4

SHA1
c844467a3c6b6d273d7da72acebd74819a51fb75

SHA256
a14acb715c463c37958b9ce342d841cffac0862e35969f0792deace4cb3f6b79

SHA512
8aba86593e80cdd747a6b728f5abba7e988d87da29ead50ccb8a3db0f3353a2180fae85e5adce0ad5959d79a64124e13f3c23f56875c6743e3547e0761e9f340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d1a0206049e93f598eccec762e238f30

SHA1
a3e1f2126d5d24aaa65d5f0c1d4b2b08073584b8

SHA256
5a52fd651ae9f1ab7ef16df1af77300167f631ba223ab689662525a48a7544d1

SHA512
ba25968fba42ac8eec23075ab515aecb7f9cd770d762cff3a3fedea34d417152ce206bdd89d6f8ab32c05c97e7d1302084070a397e03b9291e096410d0c0194e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b532a2a755fdb1cf70e88561729390e

SHA1
b3e851cba7aa8029587577ae01f257825a6698c9

SHA256
2ffe427c02d6ea6ee150af65d8d3cc122e5cfe41adc6677423578dba2b5c55dc

SHA512
9356dabc8d7c5d812517716f1c9b735bbdd0d917bba1704ad033dd731fcb764e75c9d896af551e35f571404917651f05fbdfc710911f83a32d7435b1590481f7

Download Submit
C:\Users\Admin\AppData\Roaming\{81387f43-166f-4126-a6ff-84d70e87d179}\logman.exe

Filesize
255KB

MD5
469eb75787d2e4d075952678eaaf85f4

SHA1
1a1af9b5e3441129ed41b52ea927708b277a02b0

SHA256
57512586d24e169eadafe9690bd95772f143f6ec963fca3afe16ce6cd2179c90

SHA512
7f89d4cc341408cf3074533a2ba52e311c61645db5478d60257773f9c5428483017fcbd505714e388bfc0c6b35df93c762df4d2e3936a0c30d795c7e17cf483b

Download Submit
C:\Users\Admin\Downloads\GoldenEye (5).exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Hydra.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 861534.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 992630.crdownload

Filesize
43KB

MD5
b2eca909a91e1946457a0b36eaf90930

SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

Download Submit
memory/1300-320-0x0000000005910000-0x0000000005EB6000-memory.dmp

Filesize
5.6MB

Download
memory/1300-319-0x00000000009B0000-0x00000000009C0000-memory.dmp

Filesize
64KB

Download
memory/1300-322-0x0000000005500000-0x000000000550A000-memory.dmp

Filesize
40KB

Download
memory/1300-321-0x0000000005450000-0x00000000054E2000-memory.dmp

Filesize
584KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads