badrabbit | hxxps://anonym[.]ninja/download/ADMDlW32LcA6P6M

Analysis

max time kernel
264s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 15:24

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://anonym.ninja/download/ADMDlW32LcA6P6M

Score

10^/10

badrabbit mimikatz discovery evasion persistence ransomware trojan

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x001200000001db38-834.dat	mimikatz

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
3132	CSGhost-v4.3.1.exe
3772	BadRabbit.exe
5012	69A8.tmp
3400	BadRabbit.exe
3408	BadRabbit.exe
4588	BadRabbit.exe
4812	7ev3n.exe
4796	system.exe

Loads dropped DLL 4 IoCs

pid	Process
876	rundll32.exe
1464	rundll32.exe
2116	rundll32.exe
3604	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
149	raw.githubusercontent.com
150	raw.githubusercontent.com

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\69A8.tmp	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSGhost-v4.3.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ev3n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{2A4616C4-14E2-4E99-B49D-CDBC6B8CA46B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 370549.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 210355.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\system.exe\:SmartScreen:$DATA	7ev3n.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4920	schtasks.exe
3944	SCHTASKS.exe
3464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
4040	msedge.exe
4040	msedge.exe
5024	identity_helper.exe
5024	identity_helper.exe
2388	msedge.exe
2388	msedge.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeRestorePrivilege	2628	7zG.exe
Token: 35	2628	7zG.exe
Token: SeSecurityPrivilege	2628	7zG.exe
Token: SeSecurityPrivilege	2628	7zG.exe
Token: SeShutdownPrivilege	876	rundll32.exe
Token: SeDebugPrivilege	876	rundll32.exe
Token: SeTcbPrivilege	876	rundll32.exe
Token: SeDebugPrivilege	5012	69A8.tmp
Token: SeShutdownPrivilege	1464	rundll32.exe
Token: SeDebugPrivilege	1464	rundll32.exe
Token: SeTcbPrivilege	1464	rundll32.exe
Token: SeShutdownPrivilege	2116	rundll32.exe
Token: SeDebugPrivilege	2116	rundll32.exe
Token: SeTcbPrivilege	2116	rundll32.exe
Token: SeShutdownPrivilege	3604	rundll32.exe
Token: SeDebugPrivilege	3604	rundll32.exe
Token: SeTcbPrivilege	3604	rundll32.exe
Token: SeShutdownPrivilege	4400	shutdown.exe
Token: SeRemoteShutdownPrivilege	4400	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
2628	7zG.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3132	CSGhost-v4.3.1.exe
1320	OpenWith.exe
4288	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 696	4040	msedge.exe	83
PID 4040 wrote to memory of 696	4040	msedge.exe	83
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 2144	4040	msedge.exe	85
PID 4040 wrote to memory of 2144	4040	msedge.exe	85
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://anonym.ninja/download/ADMDlW32LcA6P6M
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee2f446f8,0x7ffee2f44708,0x7ffee2f44718
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5868 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:4356
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:876
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:2288
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1854166917 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4848
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1854166917 && exit"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3464
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:45:00
      4⤵
      System Location Discovery: System Language Discovery
      PID:536
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:45:00
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4920
  - - C:\Windows\69A8.tmp
      "C:\Windows\69A8.tmp" \\.\pipe\{A3E64255-3D78-4AFF-81A1-0E8303D5E5C2}
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5012
  - - C:\Windows\SysWOW64\cmd.exe
      /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
      4⤵
      PID:3932
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN drogon
      4⤵
      PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4240

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\" -ad -an -ai#7zMap3886:114:7zEvent7422
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2628

C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\CSGhost-v4.3.1.exe
"C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\CSGhost-v4.3.1.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2cc
1⤵
PID:4240

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3400
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1464

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3408
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2116

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3604

C:\Users\Admin\Downloads\7ev3n.exe
"C:\Users\Admin\Downloads\7ev3n.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:4812
- C:\Users\Admin\AppData\Local\system.exe
  "C:\Users\Admin\AppData\Local\system.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3576
- - C:\Windows\SysWOW64\SCHTASKS.exe
    C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3944
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4340
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Modifies WinLogon for persistence
      System Location Discovery: System Language Discovery
      PID:3528
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4540
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3704
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:3104
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:5036
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3464
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:1724
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5084
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:692
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -r -t 10 -f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3909855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_EFB75332C2EEE29C462FC21A350076B8

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
41KB

MD5
58756d99d2376dcfbede6057dd25a745

SHA1
76f81b96664cd8863210bb03cc75012eaae96320

SHA256
f5d0da7b010b28a7fe2c314724a966c44068a8c8fa7e9a495e1284aa501067fa

SHA512
476e35c3da0cf223e773c2d26403c12f8c8d034273cca9e3c4cba9359f8506159c2a5267793c8bd9982b636191ddda62e9119593f5599053894c7027a58acc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
1.2MB

MD5
3bab2651eb0e5c503c207d912da8b901

SHA1
16e69b1aa350548dd0398e40ff0d7dbefeb998d4

SHA256
1236a39237e0f535fb0029f8dcd89ec3f3142b17589a56a614fdee13708ac30c

SHA512
8dec3a0f0a882cbcfe69a48aa02b6695c22cc7270395d06eea1c441dce953407a5e1c26171750938c8d6f79292160342352c59cf5c6afb3bc3f55c1ea5d253ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
92853595abf3f133b7b674c8097546c3

SHA1
7b1572dc0c752c66ea410deabe89f3159c300379

SHA256
5f41e0e8a4fdd7c4e9db5ee26a504f1716eedd093cfcee7b11d31de84ae407d6

SHA512
262720b28303c3fd97c9454e10a07f4cb440166d92a7bb5cae636d9f7348b96bca48653d9b08f93bc198ac8f5ced0e0ee6209bd48de725f3dea4a1025d78935a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
077e0702a02d9e3e7404411a7e268740

SHA1
58d7fc994105880ecb7ac391b003db2ac5a71419

SHA256
cceef6d164f86885f2dde8ebfc2b70ecbccbc53837ac43fd454c7c7d35f66d7b

SHA512
e9503f12132d4fe19d499cf009bfcf10fb59e2a3b03afbeea5d7f7901e130a64084dbf3c3d0d112ba5bc01077b71978c0531f749134287f1b4568fefea84be05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a2c4d38c57fbfa3f3b4f212ca37e0b36

SHA1
bc4b3bb4472080d2ce596d1ab6a75225f621d556

SHA256
9b79a36d23a51be9d45130bff8a8f98a4484aebadfa75bd713597de7f024d679

SHA512
3b4daaa998d10b5e826d5176180241c7e5b783c83254ff3e69ad5583937f88772487c56d537ecf1afb00a49b0672e3c508121dabd782c008489b21b0d0c770bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
de56f2a92980e565168eef40ee572f06

SHA1
0c64f0cf7904edc169103f6235f20d3eb76d6b1f

SHA256
1a0a6ab4b84a1e2f76fb879a970f4d9d5ae248883ccf56e1a5f3b6de921c0005

SHA512
f536acd0564c3287f1708e1b9066924861da022dc6c057081342232ef7fccbc10c2529e0cd9f199076f130d1f29dd21545ec61e935b5c07f28fed2238251084f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8bbb7f3f0bce6f9bbb4687b00e7f4c38

SHA1
f99891f15ad31c8d4c2d5ff334adeebb8a7f1a4e

SHA256
b1290b94e1389bb92563fa32c0f930fc206cde6659394df9ac14554d93d6fafa

SHA512
47f42f9d8b741f6c33c4781df648fc666104792b48c428a7a0bd4b86ee877e8b63960c47ca6787f01124ff8ed6008b86c6b50ff18a76ff031613c6e78f4c768b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c03bd34e083edd38ca500ef0e6631f6f

SHA1
398aae453812ccf38cf2c3c201ae3b8a4e3da6ef

SHA256
e75b902f624f41a5bb835b96167b368b1e72823deff95169ba65bcb0a710bbe0

SHA512
d3b1069d0864d62c7e4a7bc7c5eeb31314b15391beb86d10c5a9f2e68a7441b11101d39b78f8da0950a1a8c2fe8e7277a4d51d43f6b71d86b70fc0b5028e6d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
078a7452d9e19d05fa49537403d3abcb

SHA1
200c22c49db90d1277d74ae198abc1a7c3a8e06b

SHA256
fd6b5efaece8562dee5c3eb8fa836b7570f8cc19e40010958685e35bf4e4a187

SHA512
059d2524e3dcdaa2841583e1851142a760bd709d7bf08c06381f522b154cf9a9e1d20f3e3cf33cff2228206b8417ae4a4558eec3a4e7709fa6f09ecc6b6c4812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1a4f9a126226f71c1806fe41e0dce278

SHA1
0fa9ca7d9d7f9f7d44b45be090711f202e682ef5

SHA256
d719e2d6ef970d2353721077b0fc39b4201a0f6cc5ba282dbbec5921bc881ba2

SHA512
519379808c220ebf2e4e091d2a849425fdd39f9eb573aab1ab121991e91e00531bcf7d06becc304c2294246443712f35bd63ecb48a01226f53adad72fc2e680c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a336e2a82652081daecad5f5b5f63c76

SHA1
3b8c770d7fefcf91a7250dbfa07b8442dd75c57c

SHA256
7629ff054b590deea774a679bdf25d0955c19e77de0074656ce8f6c6dece8c76

SHA512
dc780161e2ff1f08c31a219cdfa41a1dd86522465b9a55cc4fcf4be0e48ab68bd85053333cc6657cd981d7863847836ab187005085574bfc7d48b75f3f147fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5ca865123f6206b4f266e7c7333ca58

SHA1
1a66ddcd4e202e4249a1e57edce738dd0bdc8300

SHA256
adf18d885027dddb0588a8577de15c5b7fc5bc81596a440b5338ff3065fc38f2

SHA512
c4604c581b8f552ba84b8b8a6298ea73d266c696badb599c921a7d9f1ea3877e45a2bcde9af1aa9685b3770777f39a0dc64463a12356085c820b8f8f4ec002ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcd0f72c9a7ca0b8fcf949695d417174

SHA1
d9871397b74d329e6b2d559336b16c4ee9a54ebc

SHA256
fb06091bb968a4e6602324e85b892826c8e4ac2bc6aa48294031aef3bb3a9e0e

SHA512
e1fe4b7593269b4c0400c1a2744ce7d8545ef2a625d6870d11e7dca7acf3217adb64940f0193d5a9af96d3c4def7ecffa407d2564a94c83f2ae048f5645eff0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
82a70766878d587c0e6180a3c911f7e0

SHA1
6238b3f79e2929577591a73b4b215adeb5b531f3

SHA256
37211dd52f8f5149cdcf45be71abb98de121fb509b987d9c9658138d4a6f7b5e

SHA512
7f21a51ab48341630c73b3660fb1ef3e7e12bcdfc543a109fdbe986a932866e78d1115b5df0e52f1c4dcce08df0613fac4d10029a449c65e6b5e109ef1281261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
869B

MD5
c0ee762f5ccb39db3caa204c499f0b67

SHA1
16fa80882a868ef5e85085b5f012de206467c2c3

SHA256
0d4a42b354e594043ec0b22a4fd52447ea12e86303d8ba94433ce247bec0a7e3

SHA512
7fcd65cc2e02239a3dd39a4d0966eec366c6a71a20b09b7dc90ce3f19dcafbb921e4a00076599f920c7fdafe32faf5bfac511995cacdf897461b105a17be2c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3c2acf293ec2acbfdaba151366d66283

SHA1
73e258872ac8b784b387cdf3c23c6f842161b7e4

SHA256
be84eb289ef5fade9dcf27efd39c041d2ddf2d563c53fa8d9014669fa69bc1dc

SHA512
78b2b6b096f925f851ea5da30e0972eff3d5cab559602c22a0e3999cd25f9659581935f9a282d35e9b26fc59492a1201a5bc767ca73f95a77cc7e6e50a907160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cb463be47fe9e4efb928925f307deb08

SHA1
1307aa4edd574e4fc2cbc4a5a62b38ebe3d03bf7

SHA256
a2dcf48b7a705bbb93eee4d00a5222ec843ae14c80bd6cf4abcf7decef1855a1

SHA512
9ef5bac7f5216e7b42b20ba0dffcfac4dfd68236922d7dc4f6b603336aed821ae858cc614a02775cbb41573f97c21749abaf6ed1e7ac883c2632969aba87b496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8c6790688d73994703fa75a289956427

SHA1
be65d95e68d169902dcea78daf4997c727c58e50

SHA256
b10fb3eae95375f8d82ab3a1583f1ff1c163036a24e6e4c1fc52fa2e14b77235

SHA512
80f4060540580e2c1695b5c30f8edb4b3d5f562138ef788a1c9585e110466d6191a72d8e7c819826bef125c4d676c834589eb0b7d1dfaaf9d7f2a6ea4f9c7212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
37cb8c2ea2bcb8bf62de286c13067aa6

SHA1
7fbda7cdd383130654088b30420406390566cc25

SHA256
7fad7be2d76be06606e4390c5e1df438613ce3492f15ef1e3473869e815544b9

SHA512
2324ed97c51c2cef4692eea6193b9dc15133ff56d99307a460ddbdcc59aef2d99938b7c44f50e8702a4652fc3670c39b8e82368b6e5b40b77369e7f82ee74e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
113cac6e418a61de329df78f952f05ab

SHA1
03c1a90ffdd26a1182f83b8b4bfb0625363155c2

SHA256
1a85a02bcf66e2037da7df7e825b85c2513c5edd04f7df6fda62d1d65d699971

SHA512
55dd2654a63412b1dbc78118b6aaf0a5e7feaa8e9541c273fd491613d51a22c381c1dfada113f39a1016d747ce653206415f21608db468f01df8fa96896ba9a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a19ff5d2be38713fba5dd83aefde639e

SHA1
7f0f7238dbd48454d07013f81b469f4cbb0459bb

SHA256
d116694db65918cef1a6ee9741ac34bbb373525549ea549b7e7938608684e9c0

SHA512
d68c42fb2d7f1106c91552e44e827bfdbcc81a2e5565d3fceb8a4186a39e031e639e1ec188899ad8075167d45bbfac1774f828da4f8b28a5dac5f39d57c01a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598a06.TMP

Filesize
371B

MD5
59b461e2f4ed698250e404bf27eab52e

SHA1
6fff865163b2e23bc784fbeec3607a65e402a728

SHA256
132aaa8d3b56c79eeb7e8da105b8096c308aedf5ee007a25dc1162ab1d6e5fa7

SHA512
ab112b69439e63f9f376f39df408c1b236258ab1370b6653ba7ab6bcdab4b069d58392b948f1e84f8e4d643a0e95d59552c976464f4e2046c0cb1f4fef504ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ee3a305aa71a6344fe64f35f77692f6

SHA1
a9dadec03966c7c23fd5830b994cf7f5f5c2a405

SHA256
6a565c6acea9c1624b93604b0c467af2f5bd2791a9c82206057b1bc2cc058ed2

SHA512
6376b58b57d58deddfcecd046fd933f0dd2cbd7d086eaa5b54730e6fc01fefda526b2b2e89e099a82729c31b4fd83fb883882a672960bfd4f0d45fe1931209c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9a1635219c101914911f3bbaa88d0d73

SHA1
9e4d3ccc7323863240118af6d0272460fa74f260

SHA256
859ac30e97834853354ccac18e70cdaebdc4cf87a55a2c2f6471a871d9ab09ba

SHA512
ccfb82e47ec3e69f174965ea3e580690916066b0d3fc800ca601ef345ff15216a8cdb89e78871ed08e9a8f6341c2b5434918d51d318d6f3a0e831b16c922676f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d097a7a3843f2472fceb17bf71689169

SHA1
c94733cd24cfd0a3405307c8dd94108266fef060

SHA256
06b062c14739c443a0f682c0643cb0a0302ede0c62058dffd2e1eb0e532da936

SHA512
731b6deab01be0562137570c2de8a1b509defc777fe6e4741f6fbf53fa043033ded96b8025259fac25c0c6717bb890717f1525253d026f8e13fbd3ab0a1f122b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
efbf4d71c331fe9182fb1ada6597ccf4

SHA1
fbbb3d6e6d58648d940462d12ee66d98df5e80df

SHA256
68150d00e82594aec268d5e9215561c45e6422383bbe80013b93c649e136000a

SHA512
e793bcc5eaed22858137c5861d11c0491f43f4954471f284a9c44f0c81b15c4134762bce3f164d0d53631f327b0d38a9feea4fc1033099c99e08b4d0200fefe5

Download Submit
C:\Users\Admin\AppData\Local\del.bat

Filesize
56B

MD5
f62904abb27a3574e2e6121349ab4955

SHA1
35b3504f1d6bc88638a0721cf3d898eb0f95092a

SHA256
d31225722321313554e736bcd9debc4cb4c5ed6dce3921fa7839162fede832b6

SHA512
e8d1cf4c6a745790b2eaf4b3618703337313e3f561ba88982bc1a139aa4b5b29fd5f78f925e5bd12669eed74ca78510f6d6b1ce091bc55299057d2b2e867fb4e

Download Submit
C:\Users\Admin\AppData\Local\system.exe

Filesize
315KB

MD5
95db66b4cf190550785c9f9f3fdd7274

SHA1
b9d81ff4cf3068d144f3c8ac98e7682eeaea9ee8

SHA256
18301a46ced0b00d751d38d3aff0470428654415e85f04e1f63110e440cd7562

SHA512
176aa778f20c438928589a95dc1aaad3a14064d2687f1d1902460eeac151c5ac1a3189be1eed50e98992cb77959363d11f0abc379627bb2a402095c08b397f0a

Download Submit
C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\CSGhost-v4.3.1.exe

Filesize
110KB

MD5
5b7c939e660af3a678af8c48d416f3fd

SHA1
b751c3ed92f2b33693c63610a27f57616c59b6c6

SHA256
4d512dec8b02a8779f892ed6a07d6464625fd0ebce4ff1a0c1cb356784dd2d9c

SHA512
3f56222100b2decef5cb1022d446ce2ab9b282473ef51b8044b377e02b7907116c2790f08a154d4859d52827ceeed8b2adef519b0f9d193f4a488a4c7ee5ef55

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 210355.crdownload

Filesize
315KB

MD5
9f8bc96c96d43ecb69f883388d228754

SHA1
61ed25a706afa2f6684bb4d64f69c5fb29d20953

SHA256
7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5

SHA512
550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 370549.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 566534.crdownload

Filesize
51KB

MD5
43fb6444809e84db7c2f4ddf904aa9d3

SHA1
e9d5e258fbe7add705248360ec7ad6bab892b185

SHA256
8b3fcb0fe72dc394d77bd2aa46994888167862cffd7e58d018450717a61a20ab

SHA512
6a97840321beb8dc3800402a67a6208afda5ca71ce2bd6f29d706e919e6168602f07b370b5cadf3948c1e06ca53700133c46d88df61716c4d58475efa9c43286

Download Submit
C:\Windows\69A8.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
c4f26ed277b51ef45fa180be597d96e8

SHA1
e9efc622924fb965d4a14bdb6223834d9a9007e7

SHA256
14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958

SHA512
afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e

Download Submit
memory/876-814-0x00000000025A0000-0x0000000002608000-memory.dmp

Filesize
416KB

Download
memory/876-822-0x00000000025A0000-0x0000000002608000-memory.dmp

Filesize
416KB

Download
memory/876-828-0x00000000025A0000-0x0000000002608000-memory.dmp

Filesize
416KB

Download
memory/1464-867-0x0000000002450000-0x00000000024B8000-memory.dmp

Filesize
416KB

Download
memory/1464-874-0x0000000002450000-0x00000000024B8000-memory.dmp

Filesize
416KB

Download
memory/2116-879-0x0000000001040000-0x00000000010A8000-memory.dmp

Filesize
416KB

Download
memory/2116-887-0x0000000001040000-0x00000000010A8000-memory.dmp

Filesize
416KB

Download
memory/3604-910-0x00000000006B0000-0x0000000000718000-memory.dmp

Filesize
416KB

Download
memory/3604-918-0x00000000006B0000-0x0000000000718000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads