af8b500428ae1502c2b6c3ed6f91714b873f8c4f418847cd234fb2b9e2b5a0c2

Analysis

max time kernel
113s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdba0935f95f8e97ffadb50d510ace60N.exe
Size

482KB
MD5

cdba0935f95f8e97ffadb50d510ace60
SHA1

22940e1590aaa949c23faeaf02c46c0e1c8c9d6a
SHA256

af8b500428ae1502c2b6c3ed6f91714b873f8c4f418847cd234fb2b9e2b5a0c2
SHA512

d6428c70a44b77ad441ecd806a80e5c4f56400cc41e6675598f86d467b3ec6870787d0304dbe183a6e7f510e869f54c12081db67d58f685d62e11cd8c0565f2e
SSDEEP

12288:ZpG3lMqLngPixjkRGAy4EkqDkJE+FUsr0v:ZSMqLgPilOytc2cLr0v

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	genupdater.exe

Executes dropped EXE 6 IoCs

pid	Process
3944	gentray.exe
964	genupdater.exe
2056	genupdater.exe
884	updater_uninstall.exe
4524	Au_.exe
4604	gentray.exe

Loads dropped DLL 7 IoCs

pid	Process
4064	cdba0935f95f8e97ffadb50d510ace60N.exe
4064	cdba0935f95f8e97ffadb50d510ace60N.exe
4064	cdba0935f95f8e97ffadb50d510ace60N.exe
4524	Au_.exe
4524	Au_.exe
4524	Au_.exe
4524	Au_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GenieoUpdaterService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Genieo\\Application\\Updater\\bin\\genupdater.exe\" -wait 5"	cdba0935f95f8e97ffadb50d510ace60N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GenieoSystemTray = "\"C:\\Users\\Admin\\AppData\\Roaming\\Genieo\\Application\\TrayUi\\bin\\gentray.exe\""	cdba0935f95f8e97ffadb50d510ace60N.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater_uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gentray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdba0935f95f8e97ffadb50d510ace60N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gentray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	genupdater.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000002344b-128.dat	nsis_installer_1
behavioral2/files/0x000700000002344b-128.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\Main	gentray.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes	gentray.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4064	cdba0935f95f8e97ffadb50d510ace60N.exe
4064	cdba0935f95f8e97ffadb50d510ace60N.exe
4064	cdba0935f95f8e97ffadb50d510ace60N.exe
4064	cdba0935f95f8e97ffadb50d510ace60N.exe
964	genupdater.exe
964	genupdater.exe
3944	gentray.exe
3944	gentray.exe
1500	msedge.exe
1500	msedge.exe
3048	msedge.exe
3048	msedge.exe
4252	identity_helper.exe
4252	identity_helper.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
4524	Au_.exe
4524	Au_.exe
4524	Au_.exe
4524	Au_.exe
3944	gentray.exe
3944	gentray.exe
4524	Au_.exe
4524	Au_.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3944	gentray.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3944	4064	cdba0935f95f8e97ffadb50d510ace60N.exe	86
PID 4064 wrote to memory of 3944	4064	cdba0935f95f8e97ffadb50d510ace60N.exe	86
PID 4064 wrote to memory of 3944	4064	cdba0935f95f8e97ffadb50d510ace60N.exe	86
PID 4064 wrote to memory of 964	4064	cdba0935f95f8e97ffadb50d510ace60N.exe	87
PID 4064 wrote to memory of 964	4064	cdba0935f95f8e97ffadb50d510ace60N.exe	87
PID 4064 wrote to memory of 964	4064	cdba0935f95f8e97ffadb50d510ace60N.exe	87
PID 964 wrote to memory of 2056	964	genupdater.exe	90
PID 964 wrote to memory of 2056	964	genupdater.exe	90
PID 964 wrote to memory of 2056	964	genupdater.exe	90
PID 964 wrote to memory of 4512	964	genupdater.exe	101
PID 964 wrote to memory of 4512	964	genupdater.exe	101
PID 964 wrote to memory of 4512	964	genupdater.exe	101
PID 4512 wrote to memory of 3048	4512	rundll32.exe	102
PID 4512 wrote to memory of 3048	4512	rundll32.exe	102
PID 3048 wrote to memory of 3904	3048	msedge.exe	103
PID 3048 wrote to memory of 3904	3048	msedge.exe	103
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1304	3048	msedge.exe	104
PID 3048 wrote to memory of 1500	3048	msedge.exe	105
PID 3048 wrote to memory of 1500	3048	msedge.exe	105
PID 3048 wrote to memory of 3644	3048	msedge.exe	106
PID 3048 wrote to memory of 3644	3048	msedge.exe	106
PID 3048 wrote to memory of 3644	3048	msedge.exe	106
PID 3048 wrote to memory of 3644	3048	msedge.exe	106
PID 3048 wrote to memory of 3644	3048	msedge.exe	106
PID 3048 wrote to memory of 3644	3048	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\cdba0935f95f8e97ffadb50d510ace60N.exe
"C:\Users\Admin\AppData\Local\Temp\cdba0935f95f8e97ffadb50d510ace60N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe
  "C:\Users\Admin\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3944
- C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe
  "C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe
    "C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe" -wait 360
    3⤵
    - Executes dropped EXE
    PID:2056
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" url.dll,FileProtocolHandler http://userfeedback-genieo.appspot.com/installfail.jsp?errcode=14000007
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://userfeedback-genieo.appspot.com/installfail.jsp?errcode=14000007
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1e3c46f8,0x7ffd1e3c4708,0x7ffd1e3c4718
        5⤵
        
        PID:3904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        5⤵
        
        PID:1304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
        5⤵
        
        PID:3644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:3176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
        5⤵
        
        PID:2500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
        5⤵
        
        PID:1628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
        5⤵
        
        PID:3992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
        5⤵
        
        PID:4524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
        5⤵
        
        PID:2432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6769181990650855722,6633789523481109780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
        5⤵
        
        PID:4980
- - C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\uninstall\updater_uninstall.exe
    "C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\uninstall\updater_uninstall.exe" /S -skip_check true
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:884
  - - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" /S -skip_check true _?=C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\uninstall\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4524
    - - C:\Users\Admin\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe
        
        "C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\..\TrayUi\bin\gentray.exe" -kill
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2934c24b6108859438c34e4e8fd85bcd

SHA1
251251ab11a6ca71ae3f4c5716ba01303105577a

SHA256
1f4ee82c82141f73d39b22b41104d5cd5267ee7386870a5145127264d4c2a474

SHA512
fff190645dabe8841600e6999e5f57c259a65a6b61ddc50a5c0190f7e782351b979982b2f44b677cc67f3aec33f17088a417785a7334a70c2d3fee31d05e20ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
305abcb2ec1ae1359c641733515a53f6

SHA1
30387380fcd9ff3712ac04267d0f939d1a6a6ab4

SHA256
97727d8f3a2e29e72e1729018d97e41bd43c5c430c18e691eef5b311035682b6

SHA512
f29469777d86b17d9d0a33aa107c5726f3fbf4f68044805acee7906456578a570bc81fc660ef0ab8106c7b27a761ec2a11875cfa3a27651c162fd9e878fa8e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
56ba606d8f3760aee00457488c742436

SHA1
3602352f2ffbe47ebcbd32a4a12b27edc29b5702

SHA256
27361a3e131bb31abf450f4235185b79ce1d9837756760e0b372fd36c0eadcb5

SHA512
fc0a9baec072b5ad7b950c6400ba6c3e3616321d1d9feb468a3ec0fe7d99f26ce4c8d08b0397ae17f3d0ece7247b905a20cd290837c1e598646d822b082e9bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso832C.tmp\KillProcDLL.dll

Filesize
32KB

MD5
83142eac84475f4ca889c73f10d9c179

SHA1
dbe43c0de8ef881466bd74861b2e5b17598b5ce8

SHA256
ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

SHA512
1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso832C.tmp\fct.dll

Filesize
4KB

MD5
e3f3809f51c7982d96aaf9c090f7d176

SHA1
7494daa8000c0b31c58d94edc509232569a4606f

SHA256
010f5e0c69b4a630b08b2551e03d8044a33350f151848dcf50953407012fab29

SHA512
3fca284e384abc95201dc73f19bd9d75413e8890e819967070b9d9991115be2a8c17e07bd1aaaffcbc770b393bf9a2af253100ac4d9efba8d21110bac97737fc

Download Submit
C:\Users\Admin\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe

Filesize
550KB

MD5
7103eddedf089adaff84539585df19af

SHA1
a4cbef70b9233956bcfeccff176ae971fb16b73e

SHA256
41e09d91850d85cf97ba5cef2936cf9bda879595694b1457e27c9aecad1ac349

SHA512
38fd37ce6e3a72cd350dc6535222dffc011d0c66dfb09ce4adb3cb2ed1eb1834b7444172500e7e2062b8660b0c61925fbb2d249b5fced9166c7da7c49b93e191

Download Submit
C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\bin\genupdater.exe

Filesize
274KB

MD5
986cc427326543cb6428895c9d18285f

SHA1
29f9700c639df045b7959aada45654f27a200e1c

SHA256
9f4a160ad96e6b2ebc8312a9d7883493bbeb474432565dedc33541f8758812eb

SHA512
272d40369d636bb8753afce3336691014f8648601b466a73768f1b66da89b2b0ca23c6bcadd1a4d5e6069432b0a333cbb1e2d37005a08310ede655fa57ec6e4d

Download Submit
C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\conf\conf.ini

Filesize
227B

MD5
08e88b4716a7dc0a6530d85491d19736

SHA1
f56f189e549770ad693a26cac7e4dfa1e628adf9

SHA256
9fa119137767b82d3f79ef819004b9a5288a9f244202cb43a07deb77a17fe260

SHA512
22573165e1a7952bbccc4f3e3df11581bdec3da26f36a253aed3896a1127174b6bc7855086bae191ace660757f69a8ca79ddbbcaf6b242ae4b1fb0155fa8e2f1

Download Submit
C:\Users\Admin\AppData\Roaming\Genieo\Application\Updater\uninstall\updater_uninstall.exe

Filesize
71KB

MD5
9c492d2dbc8f61f7bb6d8f49e2665222

SHA1
1d8dfd0f61bf4adb1e23760ab5ceabf4db584800

SHA256
2f43535d9f670760fbf5e47aaa15e019ba72e2ffc8ecb79f4db89ab8ce867335

SHA512
dd090d999e87cad30138f1febb7e8c1a2f061f67c4c320d254894fabedddbb40791312854f47ed52a95c62754939c2ee33b84939f5edf1b32a698af93655fb80

Download Submit
C:\Users\Admin\AppData\Roaming\Genieo\Data\log\Updater.log

Filesize
4KB

MD5
cfc10b407aea647d6ab9395eec299fc1

SHA1
30bcf6b7dd2ed254381a8113e81c51bd8ac55b31

SHA256
df84954b701521fb3925070a3bc967bdb164a35e9fdf4566d7554228faa2e585

SHA512
6f16cd8fd9e4b0651e5130d412625a7b9211e107964a8aff1eb499b14f905225afec6664caddcdec6da95694faa7b77f04690ce8a8d0e6066f2fcc8f56b8b6e1

Download Submit