njrat | 4fa081be390756bb8302090c083fa8fd7e11bf5b0982060a231e5748b3ba2cdc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2Cheat Loader.exe
Size

754KB
MD5

6f5d3bff7d5d614175bfdde78cbf88ee
SHA1

ace1d0db2171b3498888a128bcb2f7c02c39e7b4
SHA256

efd666d0509a8f5a3c480af0348c59a2a9079b89d3ca3f991239648fcdac6d26
SHA512

9babe57e2a6f53329e1084079d682ebe3800bc27c7a9fbaca4d6c1b8b95824cb0bdc01aa113f7f096785d60b183c5fdee4231fc442e08b711911fda0518f1d35
SSDEEP

12288:5hxp3lZnT9bDN2cF3jGZprjKh2VyYpriiCxppEnqYW8qJ6fgRat2KEtfMK:5Jlh9bDN2cF+uhojprYGnO8qJygRhKcF

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2316	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	2Cheat Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	2Cheat.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\851c1bb86c6c239085c8747c4b02db04.exe	audiog.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\851c1bb86c6c239085c8747c4b02db04.exe	audiog.exe

Executes dropped EXE 3 IoCs

pid	Process
1868	2Cheat Loader ADM.exe
1804	2Cheat.exe
4884	audiog.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\851c1bb86c6c239085c8747c4b02db04 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\audiog.exe\" .."	audiog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\851c1bb86c6c239085c8747c4b02db04 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\audiog.exe\" .."	audiog.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2Cheat Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2Cheat Loader ADM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
4532	msedge.exe
4532	msedge.exe
2944	msedge.exe
2944	msedge.exe
1524	msedge.exe
1524	msedge.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe
1868	2Cheat Loader ADM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	2Cheat Loader ADM.exe
Token: SeDebugPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe
Token: 33	4884	audiog.exe
Token: SeIncBasePriorityPrivilege	4884	audiog.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1868	1728	2Cheat Loader.exe	82
PID 1728 wrote to memory of 1868	1728	2Cheat Loader.exe	82
PID 1728 wrote to memory of 1868	1728	2Cheat Loader.exe	82
PID 1728 wrote to memory of 1804	1728	2Cheat Loader.exe	84
PID 1728 wrote to memory of 1804	1728	2Cheat Loader.exe	84
PID 1728 wrote to memory of 1804	1728	2Cheat Loader.exe	84
PID 1868 wrote to memory of 5040	1868	2Cheat Loader ADM.exe	85
PID 1868 wrote to memory of 5040	1868	2Cheat Loader ADM.exe	85
PID 5040 wrote to memory of 1500	5040	msedge.exe	86
PID 5040 wrote to memory of 1500	5040	msedge.exe	86
PID 1868 wrote to memory of 1524	1868	2Cheat Loader ADM.exe	87
PID 1868 wrote to memory of 1524	1868	2Cheat Loader ADM.exe	87
PID 1524 wrote to memory of 4988	1524	msedge.exe	88
PID 1524 wrote to memory of 4988	1524	msedge.exe	88
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4608	1524	msedge.exe	89
PID 1524 wrote to memory of 4532	1524	msedge.exe	90
PID 1524 wrote to memory of 4532	1524	msedge.exe	90
PID 5040 wrote to memory of 2128	5040	msedge.exe	91
PID 5040 wrote to memory of 2128	5040	msedge.exe	91
PID 5040 wrote to memory of 2128	5040	msedge.exe	91
PID 5040 wrote to memory of 2128	5040	msedge.exe	91
PID 5040 wrote to memory of 2128	5040	msedge.exe	91
PID 5040 wrote to memory of 2128	5040	msedge.exe	91
PID 5040 wrote to memory of 2128	5040	msedge.exe	91
PID 5040 wrote to memory of 2128	5040	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe
"C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Roaming\2Cheat Loader ADM.exe
  "C:\Users\Admin\AppData\Roaming\2Cheat Loader ADM.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/2ppsp50
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc28a346f8,0x7ffc28a34708,0x7ffc28a34718
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15969182604329319209,115210624125766601,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,15969182604329319209,115210624125766601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bit.ly/2oERYld
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xb8,0x120,0x7ffc28a346f8,0x7ffc28a34708,0x7ffc28a34718
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:3708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5653047030625286625,6994541120953721566,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
      4⤵
      PID:4572
- C:\Users\Admin\AppData\Roaming\2Cheat.exe
  "C:\Users\Admin\AppData\Roaming\2Cheat.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1804
- - C:\Users\Admin\AppData\Local\Temp\audiog.exe
    "C:\Users\Admin\AppData\Local\Temp\audiog.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\audiog.exe" "audiog.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\666b4241-c9b9-4a3b-8658-d6c133d381d0.tmp

Filesize
8KB

MD5
2a5c983e1af33e8407767e94676a2e80

SHA1
f5c3337059b54daf179025bba37d37c0b62bba05

SHA256
d577fb5bb888f41cde9273558653f268adddbe8257bd06f974991f3e2b811a43

SHA512
50185e1f59fa3bd52820c6d44ff990189cb8a794cc88e6617917e87b693acd36c99296e7a4b67470701ef0be21f74b0a24103dfce8d72ee182b1e82b5f205540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
197B

MD5
99a5f77b8f893ee1aacd29e3777e69c2

SHA1
a07e09880322c4ad678f3cb73c1817de4ac23a53

SHA256
174fba2104a61dfb183b38521f9217813ce69501e74565397062b15500495f00

SHA512
d8567a684176467ba005399423ebfbe77880d88652e0c62877b8dcdf9dd30c7ff11725098878e7fa08d1c8e92a9c4ff88f896bc266fdbd8993ed7ae235671651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5fca088ef52b52a57db72465583ce3ee

SHA1
bdd464ddb41cadd3acd07ec918cb73ce707a636b

SHA256
1c848223e77a2e48f5ebdf82049d3c9e90e1b913ee53ce337e2b848ed3d97bbd

SHA512
1dd1b07e2126d3453d3ea3bae8545055f3e66d02f5bf62b31ace06697b5a818a99730f299c1e266694d03b7fc1311883eb024c60cae383bdb3b8384f8efdbf7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33f7b862025bb21e9dcad7b0cf18b869

SHA1
df33d24df05bf654cd311add896d487bdab70376

SHA256
8a336474d91a198b332ce9b6e00e934af930a153c377ff7832b92c30cd538cc3

SHA512
cfd341a793f612eaf9a6dc17a3f56e56a1f94f198020dde0a540d04fbea25818d2a7eeecd949313d67debb5dd5c1604513b38cdc7e5971bea6072cf18b963b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
004dd64c35f019687bbc524e20bda4fa

SHA1
2d18be7fbe7101516089458bf54945fbb9f9b5de

SHA256
ff0c45c917d9561b1e5a8667e867e9e7b98a1a04ca93df986330f36bc1ce5437

SHA512
9afdac8a1a416c3c59682f6d134b0d4e4d997cfd5ba1566d6e742aaac512cef987a0dc150a54e1c7709173fcd1a87abbfdd85c446689fd080b1d63319e6f6bdf

Download Submit
C:\Users\Admin\AppData\Roaming\2Cheat Loader ADM.exe

Filesize
1.9MB

MD5
6d87dd41eba03ff1b2b0657ca61b2d83

SHA1
91370c530aa5c1eed47ed50c462232941ea302d9

SHA256
368420f2900be2d8900a57069dd2842fbf24b4dd28f6c2892209ad0ea2ac3891

SHA512
9b9126a6418f5424fd25f9c99190d270e511494b872f81eb9097d7a3a0af93b9b44037e115af30c469b8f3c8ee7da091291e072ab2b4397982a82b5b05bdcefc

Download Submit
C:\Users\Admin\AppData\Roaming\2cheat.exe

Filesize
23KB

MD5
55193f6f89f52a9388db40b0eaad58f1

SHA1
3ed413946bb837851bb0df4156ff9cdefa6a7c25

SHA256
1ab2856e37ac24ce6168914964b4d6dcbd5a71a1eda3ba5c4568e3839d4037ed

SHA512
d7159e7aba20e2ecf99a2f0d92819dc62450bbc2207714594bf5d8d59754a5a3da1072c0e6ed5415134ede2f534ce5b4cafc9028c4589f514a0b44be66c5a07a

Download Submit
memory/1804-22-0x0000000070ED2000-0x0000000070ED3000-memory.dmp

Filesize
4KB

Download
memory/1804-27-0x0000000070ED0000-0x0000000071481000-memory.dmp

Filesize
5.7MB

Download
memory/1804-115-0x0000000070ED0000-0x0000000071481000-memory.dmp

Filesize
5.7MB

Download
memory/1804-25-0x0000000070ED0000-0x0000000071481000-memory.dmp

Filesize
5.7MB

Download
memory/1868-24-0x0000000005B40000-0x0000000005BDC000-memory.dmp

Filesize
624KB

Download
memory/1868-32-0x0000000005DA0000-0x0000000005DB0000-memory.dmp

Filesize
64KB

Download
memory/1868-31-0x0000000005E10000-0x0000000005E66000-memory.dmp

Filesize
344KB

Download
memory/1868-30-0x0000000005B00000-0x0000000005B0A000-memory.dmp

Filesize
40KB

Download
memory/1868-29-0x0000000005BF0000-0x0000000005C82000-memory.dmp

Filesize
584KB

Download
memory/1868-28-0x0000000005DA0000-0x0000000005DB0000-memory.dmp

Filesize
64KB

Download
memory/1868-26-0x0000000006360000-0x0000000006904000-memory.dmp

Filesize
5.6MB

Download
memory/1868-23-0x0000000000F40000-0x0000000001136000-memory.dmp

Filesize
2.0MB

Download
memory/1868-18-0x000000007297E000-0x000000007297F000-memory.dmp

Filesize
4KB

Download