badrabbit | hxxps://anonym[.]ninja/download/ADMDlW32LcA6P6M

Analysis

max time kernel
264s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://anonym.ninja/download/ADMDlW32LcA6P6M
Sample240913-ss7mlsware

Score

10^/10

badrabbit mimikatz discovery evasion persistence ransomware trojan

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x001200000001db38-834.dat	mimikatz

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
3132	CSGhost-v4.3.1.exe
3772	BadRabbit.exe
5012	69A8.tmp
3400	BadRabbit.exe
3408	BadRabbit.exe
4588	BadRabbit.exe
4812	7ev3n.exe
4796	system.exe

Loads dropped DLL 4 IoCs

pid	Process
876	rundll32.exe
1464	rundll32.exe
2116	rundll32.exe
3604	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
149	raw.githubusercontent.com
150	raw.githubusercontent.com

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\69A8.tmp	rundll32.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSGhost-v4.3.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ev3n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{2A4616C4-14E2-4E99-B49D-CDBC6B8CA46B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 370549.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 210355.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\system.exe\:SmartScreen:$DATA	7ev3n.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4920	schtasks.exe
3944	SCHTASKS.exe
3464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
4040	msedge.exe
4040	msedge.exe
5024	identity_helper.exe
5024	identity_helper.exe
2388	msedge.exe
2388	msedge.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe
3132	CSGhost-v4.3.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeRestorePrivilege	2628	7zG.exe
Token: 35	2628	7zG.exe
Token: SeSecurityPrivilege	2628	7zG.exe
Token: SeSecurityPrivilege	2628	7zG.exe
Token: SeShutdownPrivilege	876	rundll32.exe
Token: SeDebugPrivilege	876	rundll32.exe
Token: SeTcbPrivilege	876	rundll32.exe
Token: SeDebugPrivilege	5012	69A8.tmp
Token: SeShutdownPrivilege	1464	rundll32.exe
Token: SeDebugPrivilege	1464	rundll32.exe
Token: SeTcbPrivilege	1464	rundll32.exe
Token: SeShutdownPrivilege	2116	rundll32.exe
Token: SeDebugPrivilege	2116	rundll32.exe
Token: SeTcbPrivilege	2116	rundll32.exe
Token: SeShutdownPrivilege	3604	rundll32.exe
Token: SeDebugPrivilege	3604	rundll32.exe
Token: SeTcbPrivilege	3604	rundll32.exe
Token: SeShutdownPrivilege	4400	shutdown.exe
Token: SeRemoteShutdownPrivilege	4400	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
2628	7zG.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3132	CSGhost-v4.3.1.exe
1320	OpenWith.exe
4288	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 696	4040	msedge.exe	83
PID 4040 wrote to memory of 696	4040	msedge.exe	83
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 1620	4040	msedge.exe	84
PID 4040 wrote to memory of 2144	4040	msedge.exe	85
PID 4040 wrote to memory of 2144	4040	msedge.exe	85
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86
PID 4040 wrote to memory of 5052	4040	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://anonym.ninja/download/ADMDlW32LcA6P6M
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee2f446f8,0x7ffee2f44708,0x7ffee2f44718
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5868 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:4356
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:876
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:2288
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1854166917 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4848
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 1854166917 && exit"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3464
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:45:00
      4⤵
      System Location Discovery: System Language Discovery
      PID:536
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 15:45:00
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4920
  - - C:\Windows\69A8.tmp
      "C:\Windows\69A8.tmp" \\.\pipe\{A3E64255-3D78-4AFF-81A1-0E8303D5E5C2}
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5012
  - - C:\Windows\SysWOW64\cmd.exe
      /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
      4⤵
      PID:3932
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN drogon
      4⤵
      PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,11196442884227451169,5249077860912090054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4240

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\" -ad -an -ai#7zMap3886:114:7zEvent7422
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2628

C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\CSGhost-v4.3.1.exe
"C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\CSGhost-v4.3.1.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x2cc
1⤵
PID:4240

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3400
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1464

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3408
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2116

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3604

C:\Users\Admin\Downloads\7ev3n.exe
"C:\Users\Admin\Downloads\7ev3n.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:4812
- C:\Users\Admin\AppData\Local\system.exe
  "C:\Users\Admin\AppData\Local\system.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3576
- - C:\Windows\SysWOW64\SCHTASKS.exe
    C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3944
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4340
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Modifies WinLogon for persistence
      System Location Discovery: System Language Discovery
      PID:3528
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4540
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3704
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:3104
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:5036
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3464
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:1724
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5084
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:692
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -r -t 10 -f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3909855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CDE89F9DCB25D8AC547E3CEFDA4FB6C2_EFB75332C2EEE29C462FC21A350076B8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CDE89F9DCB25D8AC547E3CEFDA4FB6C2_EFB75332C2EEE29C462FC21A350076B8
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 67KB
SHA256 965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074
MD5 929b1f88aa0b766609e4ca5b9770dc24
SHA1 c1f16f77e4f4aecc80dadd25ea15ed10936cc901
SHA512 fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07
SSDEEP 1536:BFKn5MdbB2jIr0YtX309Y7eliuwqmVWtmXMF:inMtLbnqoehAW9F
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 41KB
SHA256 f5d0da7b010b28a7fe2c314724a966c44068a8c8fa7e9a495e1284aa501067fa
MD5 58756d99d2376dcfbede6057dd25a745
SHA1 76f81b96664cd8863210bb03cc75012eaae96320
SHA512 476e35c3da0cf223e773c2d26403c12f8c8d034273cca9e3c4cba9359f8506159c2a5267793c8bd9982b636191ddda62e9119593f5599053894c7027a58acc10
SSDEEP 768:Yo/fQpcxRxUbbYGmbbaL5gbgsB4WO36a5pIvG6EGATAROhdZVxdUDXcLn:YoApiaE3bbaVgJB6395pIe6EGnROhT6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 1.2MB
SHA256 1236a39237e0f535fb0029f8dcd89ec3f3142b17589a56a614fdee13708ac30c
MD5 3bab2651eb0e5c503c207d912da8b901
SHA1 16e69b1aa350548dd0398e40ff0d7dbefeb998d4
SHA512 8dec3a0f0a882cbcfe69a48aa02b6695c22cc7270395d06eea1c441dce953407a5e1c26171750938c8d6f79292160342352c59cf5c6afb3bc3f55c1ea5d253ca
SSDEEP 24576:xetMGF63Gvw9v3urkX2/p6OMme/Xqp76zbSouCCfTluXWtRG6ZO:4joZ3kD/I/XqpAwdfB5tRVO
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5f41e0e8a4fdd7c4e9db5ee26a504f1716eedd093cfcee7b11d31de84ae407d6
MD5 92853595abf3f133b7b674c8097546c3
SHA1 7b1572dc0c752c66ea410deabe89f3159c300379
SHA512 262720b28303c3fd97c9454e10a07f4cb440166d92a7bb5cae636d9f7348b96bca48653d9b08f93bc198ac8f5ced0e0ee6209bd48de725f3dea4a1025d78935a
SSDEEP 96:1blQYQU1CHIxrn12sztKNm24ZuXjuyNqDmxfrMyKVvApZFX45Smm30kfvKa+36aT:1/nba1E1OkuTgxlf
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 cceef6d164f86885f2dde8ebfc2b70ecbccbc53837ac43fd454c7c7d35f66d7b
MD5 077e0702a02d9e3e7404411a7e268740
SHA1 58d7fc994105880ecb7ac391b003db2ac5a71419
SHA512 e9503f12132d4fe19d499cf009bfcf10fb59e2a3b03afbeea5d7f7901e130a64084dbf3c3d0d112ba5bc01077b71978c0531f749134287f1b4568fefea84be05
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 9b79a36d23a51be9d45130bff8a8f98a4484aebadfa75bd713597de7f024d679
MD5 a2c4d38c57fbfa3f3b4f212ca37e0b36
SHA1 bc4b3bb4472080d2ce596d1ab6a75225f621d556
SHA512 3b4daaa998d10b5e826d5176180241c7e5b783c83254ff3e69ad5583937f88772487c56d537ecf1afb00a49b0672e3c508121dabd782c008489b21b0d0c770bf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 1a0a6ab4b84a1e2f76fb879a970f4d9d5ae248883ccf56e1a5f3b6de921c0005
MD5 de56f2a92980e565168eef40ee572f06
SHA1 0c64f0cf7904edc169103f6235f20d3eb76d6b1f
SHA512 f536acd0564c3287f1708e1b9066924861da022dc6c057081342232ef7fccbc10c2529e0cd9f199076f130d1f29dd21545ec61e935b5c07f28fed2238251084f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b1290b94e1389bb92563fa32c0f930fc206cde6659394df9ac14554d93d6fafa
MD5 8bbb7f3f0bce6f9bbb4687b00e7f4c38
SHA1 f99891f15ad31c8d4c2d5ff334adeebb8a7f1a4e
SHA512 47f42f9d8b741f6c33c4781df648fc666104792b48c428a7a0bd4b86ee877e8b63960c47ca6787f01124ff8ed6008b86c6b50ff18a76ff031613c6e78f4c768b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e75b902f624f41a5bb835b96167b368b1e72823deff95169ba65bcb0a710bbe0
MD5 c03bd34e083edd38ca500ef0e6631f6f
SHA1 398aae453812ccf38cf2c3c201ae3b8a4e3da6ef
SHA512 d3b1069d0864d62c7e4a7bc7c5eeb31314b15391beb86d10c5a9f2e68a7441b11101d39b78f8da0950a1a8c2fe8e7277a4d51d43f6b71d86b70fc0b5028e6d14
SSDEEP 96:n1kmsQ/lK1lfTNwpvWMoiVmdeku21fb2gGKlyq44YOaFwUWQyV+VD7AiEwb:n1kIIrRGWMUu2d2kyq4vmrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 fd6b5efaece8562dee5c3eb8fa836b7570f8cc19e40010958685e35bf4e4a187
MD5 078a7452d9e19d05fa49537403d3abcb
SHA1 200c22c49db90d1277d74ae198abc1a7c3a8e06b
SHA512 059d2524e3dcdaa2841583e1851142a760bd709d7bf08c06381f522b154cf9a9e1d20f3e3cf33cff2228206b8417ae4a4558eec3a4e7709fa6f09ecc6b6c4812
SSDEEP 96:n1k8sQ/OK1toTNwpa/WMoiVmdeku21guH1fb2gGKlyq44YOaFwUWQyV+VD7AiEwb:n1kiZXIR/WMUu2auHd2kyq4vmrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d719e2d6ef970d2353721077b0fc39b4201a0f6cc5ba282dbbec5921bc881ba2
MD5 1a4f9a126226f71c1806fe41e0dce278
SHA1 0fa9ca7d9d7f9f7d44b45be090711f202e682ef5
SHA512 519379808c220ebf2e4e091d2a849425fdd39f9eb573aab1ab121991e91e00531bcf7d06becc304c2294246443712f35bd63ecb48a01226f53adad72fc2e680c
SSDEEP 96:n1k8sQ/7K1tBTNwpO5WMoifR5mdeku212b1MFqb2gGKlyqfwS4YcaFwUWQyV+VDp:n1kiWXrN5WMfmu2Qb172kyq4SFmrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7629ff054b590deea774a679bdf25d0955c19e77de0074656ce8f6c6dece8c76
MD5 a336e2a82652081daecad5f5b5f63c76
SHA1 3b8c770d7fefcf91a7250dbfa07b8442dd75c57c
SHA512 dc780161e2ff1f08c31a219cdfa41a1dd86522465b9a55cc4fcf4be0e48ab68bd85053333cc6657cd981d7863847836ab187005085574bfc7d48b75f3f147fb1
SSDEEP 96:n1kR0K1lHTNwpvWMoiVmdeH44YAEFwUWQyV+VDCziEwb:n1kRfr5GWMX4hmro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 adf18d885027dddb0588a8577de15c5b7fc5bc81596a440b5338ff3065fc38f2
MD5 b5ca865123f6206b4f266e7c7333ca58
SHA1 1a66ddcd4e202e4249a1e57edce738dd0bdc8300
SHA512 c4604c581b8f552ba84b8b8a6298ea73d266c696badb599c921a7d9f1ea3877e45a2bcde9af1aa9685b3770777f39a0dc64463a12356085c820b8f8f4ec002ce
SSDEEP 96:n1k8sQ/eK1lfTNwpvWMoiVmdeku21fb2gGKlyq44Y9EFwUWQyV+VD7AiEwb:n1kiJrRGWMUu2d2kyq4Smrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fb06091bb968a4e6602324e85b892826c8e4ac2bc6aa48294031aef3bb3a9e0e
MD5 dcd0f72c9a7ca0b8fcf949695d417174
SHA1 d9871397b74d329e6b2d559336b16c4ee9a54ebc
SHA512 e1fe4b7593269b4c0400c1a2744ce7d8545ef2a625d6870d11e7dca7acf3217adb64940f0193d5a9af96d3c4def7ecffa407d2564a94c83f2ae048f5645eff0b
SSDEEP 96:n1krsQ/eK1lfTNwpvWMoiVmdeku21fb2gGKlyq44Y9aFwUWQyV+VD7AiEwb:n1khJrRGWMUu2d2kyq40mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 37211dd52f8f5149cdcf45be71abb98de121fb509b987d9c9658138d4a6f7b5e
MD5 82a70766878d587c0e6180a3c911f7e0
SHA1 6238b3f79e2929577591a73b4b215adeb5b531f3
SHA512 7f21a51ab48341630c73b3660fb1ef3e7e12bcdfc543a109fdbe986a932866e78d1115b5df0e52f1c4dcce08df0613fac4d10029a449c65e6b5e109ef1281261
SSDEEP 96:n1krsQ/7K1tBTNwpO5WMoifR5mdeku21UcsXAb1MFqb2gGKlyqfwS4YMaFwUWQyu:n1khWXrN5WMfmu2mcsQb172kyq4Slmrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 869B
SHA256 0d4a42b354e594043ec0b22a4fd52447ea12e86303d8ba94433ce247bec0a7e3
MD5 c0ee762f5ccb39db3caa204c499f0b67
SHA1 16fa80882a868ef5e85085b5f012de206467c2c3
SHA512 7fcd65cc2e02239a3dd39a4d0966eec366c6a71a20b09b7dc90ce3f19dcafbb921e4a00076599f920c7fdafe32faf5bfac511995cacdf897461b105a17be2c80
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 be84eb289ef5fade9dcf27efd39c041d2ddf2d563c53fa8d9014669fa69bc1dc
MD5 3c2acf293ec2acbfdaba151366d66283
SHA1 73e258872ac8b784b387cdf3c23c6f842161b7e4
SHA512 78b2b6b096f925f851ea5da30e0972eff3d5cab559602c22a0e3999cd25f9659581935f9a282d35e9b26fc59492a1201a5bc767ca73f95a77cc7e6e50a907160
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a2dcf48b7a705bbb93eee4d00a5222ec843ae14c80bd6cf4abcf7decef1855a1
MD5 cb463be47fe9e4efb928925f307deb08
SHA1 1307aa4edd574e4fc2cbc4a5a62b38ebe3d03bf7
SHA512 9ef5bac7f5216e7b42b20ba0dffcfac4dfd68236922d7dc4f6b603336aed821ae858cc614a02775cbb41573f97c21749abaf6ed1e7ac883c2632969aba87b496
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b10fb3eae95375f8d82ab3a1583f1ff1c163036a24e6e4c1fc52fa2e14b77235
MD5 8c6790688d73994703fa75a289956427
SHA1 be65d95e68d169902dcea78daf4997c727c58e50
SHA512 80f4060540580e2c1695b5c30f8edb4b3d5f562138ef788a1c9585e110466d6191a72d8e7c819826bef125c4d676c834589eb0b7d1dfaaf9d7f2a6ea4f9c7212
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 7fad7be2d76be06606e4390c5e1df438613ce3492f15ef1e3473869e815544b9
MD5 37cb8c2ea2bcb8bf62de286c13067aa6
SHA1 7fbda7cdd383130654088b30420406390566cc25
SHA512 2324ed97c51c2cef4692eea6193b9dc15133ff56d99307a460ddbdcc59aef2d99938b7c44f50e8702a4652fc3670c39b8e82368b6e5b40b77369e7f82ee74e65
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1a85a02bcf66e2037da7df7e825b85c2513c5edd04f7df6fda62d1d65d699971
MD5 113cac6e418a61de329df78f952f05ab
SHA1 03c1a90ffdd26a1182f83b8b4bfb0625363155c2
SHA512 55dd2654a63412b1dbc78118b6aaf0a5e7feaa8e9541c273fd491613d51a22c381c1dfada113f39a1016d747ce653206415f21608db468f01df8fa96896ba9a4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d116694db65918cef1a6ee9741ac34bbb373525549ea549b7e7938608684e9c0
MD5 a19ff5d2be38713fba5dd83aefde639e
SHA1 7f0f7238dbd48454d07013f81b469f4cbb0459bb
SHA512 d68c42fb2d7f1106c91552e44e827bfdbcc81a2e5565d3fceb8a4186a39e031e639e1ec188899ad8075167d45bbfac1774f828da4f8b28a5dac5f39d57c01a70
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe598a06.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598a06.TMP
Size 371B
SHA256 132aaa8d3b56c79eeb7e8da105b8096c308aedf5ee007a25dc1162ab1d6e5fa7
MD5 59b461e2f4ed698250e404bf27eab52e
SHA1 6fff865163b2e23bc784fbeec3607a65e402a728
SHA512 ab112b69439e63f9f376f39df408c1b236258ab1370b6653ba7ab6bcdab4b069d58392b948f1e84f8e4d643a0e95d59552c976464f4e2046c0cb1f4fef504ebf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6a565c6acea9c1624b93604b0c467af2f5bd2791a9c82206057b1bc2cc058ed2
MD5 0ee3a305aa71a6344fe64f35f77692f6
SHA1 a9dadec03966c7c23fd5830b994cf7f5f5c2a405
SHA512 6376b58b57d58deddfcecd046fd933f0dd2cbd7d086eaa5b54730e6fc01fefda526b2b2e89e099a82729c31b4fd83fb883882a672960bfd4f0d45fe1931209c4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0e2RUyOkInTeuLJ5cmO:A9iIxuERzA83h09RZxY6zIn7JC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 859ac30e97834853354ccac18e70cdaebdc4cf87a55a2c2f6471a871d9ab09ba
MD5 9a1635219c101914911f3bbaa88d0d73
SHA1 9e4d3ccc7323863240118af6d0272460fa74f260
SHA512 ccfb82e47ec3e69f174965ea3e580690916066b0d3fc800ca601ef345ff15216a8cdb89e78871ed08e9a8f6341c2b5434918d51d318d6f3a0e831b16c922676f
SSDEEP 192:woCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0e2RUyOkI5TeuLJ5cmO:o9iIxuERzA83h09RZxY6zI57JC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 06b062c14739c443a0f682c0643cb0a0302ede0c62058dffd2e1eb0e532da936
MD5 d097a7a3843f2472fceb17bf71689169
SHA1 c94733cd24cfd0a3405307c8dd94108266fef060
SHA512 731b6deab01be0562137570c2de8a1b509defc777fe6e4741f6fbf53fa043033ded96b8025259fac25c0c6717bb890717f1525253d026f8e13fbd3ab0a1f122b
SSDEEP 192:noCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7qY2RUcteV10uErkIbTeue:/9iIxuERzA83h09RZxY7M8qIIb7JC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 68150d00e82594aec268d5e9215561c45e6422383bbe80013b93c649e136000a
MD5 efbf4d71c331fe9182fb1ada6597ccf4
SHA1 fbbb3d6e6d58648d940462d12ee66d98df5e80df
SHA512 e793bcc5eaed22858137c5861d11c0491f43f4954471f284a9c44f0c81b15c4134762bce3f164d0d53631f327b0d38a9feea4fc1033099c99e08b4d0200fefe5
SSDEEP 192:MgoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7qY2RUcteV10uErkIpTeb:R9iIxuERzA83h09RZxY7M8qIIp7JC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\del.bat
Size 56B
SHA256 d31225722321313554e736bcd9debc4cb4c5ed6dce3921fa7839162fede832b6
MD5 f62904abb27a3574e2e6121349ab4955
SHA1 35b3504f1d6bc88638a0721cf3d898eb0f95092a
SHA512 e8d1cf4c6a745790b2eaf4b3618703337313e3f561ba88982bc1a139aa4b5b29fd5f78f925e5bd12669eed74ca78510f6d6b1ce091bc55299057d2b2e867fb4e
MD5 SHA1 SHA512

Submit Download

system.exe

Path C:\Users\Admin\AppData\Local\system.exe
Size 315KB
SHA256 18301a46ced0b00d751d38d3aff0470428654415e85f04e1f63110e440cd7562
MD5 95db66b4cf190550785c9f9f3fdd7274
SHA1 b9d81ff4cf3068d144f3c8ac98e7682eeaea9ee8
SHA512 176aa778f20c438928589a95dc1aaad3a14064d2687f1d1902460eeac151c5ac1a3189be1eed50e98992cb77959363d11f0abc379627bb2a402095c08b397f0a
SSDEEP 6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXv+:BswRSslz0P1OdFXJlJ8buXv+
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSGhost-v4.3.1.exe

Path C:\Users\Admin\Downloads\13-09-2024_ADMDlW32LcA6P6M\CSGhost-v4.3.1.exe
Size 110KB
SHA256 4d512dec8b02a8779f892ed6a07d6464625fd0ebce4ff1a0c1cb356784dd2d9c
MD5 5b7c939e660af3a678af8c48d416f3fd
SHA1 b751c3ed92f2b33693c63610a27f57616c59b6c6
SHA512 3f56222100b2decef5cb1022d446ce2ab9b282473ef51b8044b377e02b7907116c2790f08a154d4859d52827ceeed8b2adef519b0f9d193f4a488a4c7ee5ef55
SSDEEP 3072:PYMEWromwPS5jVRhR6O0XnoCDj2W6EWNfynxjpY0DLIS3JT:PFSPw6roCPAOLII
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 210355.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 210355.crdownload
Size 315KB
SHA256 7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5
MD5 9f8bc96c96d43ecb69f883388d228754
SHA1 61ed25a706afa2f6684bb4d64f69c5fb29d20953
SHA512 550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6
SSDEEP 6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXv:BswRSslz0P1OdFXJlJ8buXv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 370549.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 370549.crdownload
Size 431KB
SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
MD5 fbbdc39af1139aebba4da004475e8839
SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 566534.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 566534.crdownload
Size 51KB
SHA256 8b3fcb0fe72dc394d77bd2aa46994888167862cffd7e58d018450717a61a20ab
MD5 43fb6444809e84db7c2f4ddf904aa9d3
SHA1 e9d5e258fbe7add705248360ec7ad6bab892b185
SHA512 6a97840321beb8dc3800402a67a6208afda5ca71ce2bd6f29d706e919e6168602f07b370b5cadf3948c1e06ca53700133c46d88df61716c4d58475efa9c43286
SSDEEP 768:ZknDX7DW0UZk7Y5oV6nm0L/4f6ud1a5if0BLMiPSI9TEzgrZM0pXQIXEZUyrA:Qu0C5ijdNd1a5mgLHSIdlrhhhWA
MD5 SHA1 SHA512 SSDEEP

Submit Download

69A8.tmp

Path C:\Windows\69A8.tmp
Size 60KB
SHA256 301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
MD5 347ac3b6b791054de3e5720a7144a977
SHA1 413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA512 9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
SSDEEP 1536:QeRCKjey4TTGLeBYEUW1SIUDoCB449rHUV:KKjey4TTmeBZUGSIUDoCq49oV
MD5 SHA1 SHA512 SSDEEP

Submit Download

infpub.dat

Path C:\Windows\infpub.dat
Size 401KB
SHA256 579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
MD5 1d724f95c61f1055f0d02c2154bbccd3
SHA1 79116fe99f2b421c52ef64097f0f39b815b20907
SHA512 f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113
SSDEEP 12288:GtDjvhNTc/cq4RKZZKfArRuSA80m+/6sXRnfPGp:IjTc/cq4RUZaArbInfPGp
MD5 SHA1 SHA512 SSDEEP

Submit Download

infpub.dat

Path C:\Windows\infpub.dat
Size 401KB
SHA256 14d82a676b63ab046ae94fa5e41f9f69a65dc7946826cb3d74cea6c030c2f958
MD5 c4f26ed277b51ef45fa180be597d96e8
SHA1 e9efc622924fb965d4a14bdb6223834d9a9007e7
SHA512 afc2a8466f106e81d423065b07aed2529cbf690ab4c3e019334f1bedfb42dc0e0957be83d860a84b7285bd49285503bfe95a1cf571a678dbc9bdb07789da928e
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/876-814-0x00000000025A0000-0x0000000002608000-memory.dmp

Download

memory/876-822-0x00000000025A0000-0x0000000002608000-memory.dmp

Download

memory/876-828-0x00000000025A0000-0x0000000002608000-memory.dmp

Download

memory/1464-867-0x0000000002450000-0x00000000024B8000-memory.dmp

Download

memory/1464-874-0x0000000002450000-0x00000000024B8000-memory.dmp

Download

memory/2116-879-0x0000000001040000-0x00000000010A8000-memory.dmp

Download

memory/2116-887-0x0000000001040000-0x00000000010A8000-memory.dmp

Download

memory/3604-910-0x00000000006B0000-0x0000000000718000-memory.dmp

Download

memory/3604-918-0x00000000006B0000-0x0000000000718000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads