hxxps://drive[.]google[.]com/file/d/1BadFM-NjOnuotQPbotSbeGD3ZcosB_JA/view

Analysis

max time kernel
156s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24-09-2024 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1BadFM-NjOnuotQPbotSbeGD3ZcosB_JA/view

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3600	PlantsVsZombies.exe

Loads dropped DLL 3 IoCs

pid	Process
3600	PlantsVsZombies.exe
3600	PlantsVsZombies.exe
3600	PlantsVsZombies.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
6	drive.google.com
7	drive.google.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3108	GameBarPresenceWriter.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fonts\fzcq.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\.tmpIbn6wi\bass.dll	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\launcher.log	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fonts\fzjz.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fonts\fzyh.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fonts\wryh.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\.tmpIbn6wi\symbols\exe\PlantsVsZombies.pdb	PlantsVsZombies.exe
File opened for modification	C:\Windows\SysWOW64\fixes\补丁请放在此文件夹	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fonts\fzkt.TTF	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\config.toml	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\.tmpIbn6wi\PlantsVsZombies.exe	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\.tmpIbn6wi\exe\PlantsVsZombies.pdb	PlantsVsZombies.exe
File opened for modification	C:\Windows\SysWOW64\fonts\wryh+pico12num.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\main.pak	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\.tmpIbn6wi\gdi42.dll	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\.tmpIbn6wi\PlantsVsZombies.pdb	PlantsVsZombies.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	3600	WerFault.exe	102

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PlantsVsZombies Hybrid English v2.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PlantsVsZombies.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2842058299-443432012-2465494467-1000\{BC18FF45-521B-4E29-8583-FBEE1FF8817D}	svchost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Plants Vs Zombies Hybrid English v2.4 v1.2.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2004	msedge.exe
2004	msedge.exe
2840	msedge.exe
2840	msedge.exe
4576	identity_helper.exe
4576	identity_helper.exe
1868	msedge.exe
1868	msedge.exe
4540	PlantsVsZombies Hybrid English v2.4.exe
4540	PlantsVsZombies Hybrid English v2.4.exe
4540	PlantsVsZombies Hybrid English v2.4.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3600	PlantsVsZombies.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	660	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	660	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4108	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3008	2004	msedge.exe	79
PID 2004 wrote to memory of 3008	2004	msedge.exe	79
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 4588	2004	msedge.exe	80
PID 2004 wrote to memory of 2336	2004	msedge.exe	81
PID 2004 wrote to memory of 2336	2004	msedge.exe	81
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82
PID 2004 wrote to memory of 5024	2004	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1BadFM-NjOnuotQPbotSbeGD3ZcosB_JA/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4d1b3cb8,0x7ffb4d1b3cc8,0x7ffb4d1b3cd8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7530009319564563845,16167084274245543617,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\Temp1_Plants Vs Zombies Hybrid English v2.4 v1.2.zip\Plants Vs Zombies Hybrid English v2.4 v1.2\PlantsVsZombies Hybrid English v2.4.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Plants Vs Zombies Hybrid English v2.4 v1.2.zip\Plants Vs Zombies Hybrid English v2.4 v1.2\PlantsVsZombies Hybrid English v2.4.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4540
- C:\Windows\SysWOW64\.tmpIbn6wi\PlantsVsZombies.exe
  "C:\Windows\system32\.tmpIbn6wi\PlantsVsZombies.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 1476
    3⤵
    - Program crash
    PID:2496

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:660

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:3108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3600 -ip 3600
1⤵
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\689a8359-e66b-4687-8eca-27eaae9bc6ee.tmp

Filesize
3KB

MD5
635381964523b932a265ac49d76d91fd

SHA1
79062bc1692a2bfb9b306e4f64f54a0ee4c3c8b7

SHA256
8bfc5ca4ba5e134d21ad89bb764944bac4fd18e74a92421cbf0fdc4b54e469a5

SHA512
3891a6745ecc1421b17e3c8c672d568131f5ce7abeab7c433b31a89aea15ebdbcd4d07a03e5271a994371944d587e2d72691f13d244c05a202d3bc25a3bcfc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
9e0e3e36162d7c46cc35be4e3a5ea0b3

SHA1
8fb01ae92158d9a80968a0d406090ab86b24d327

SHA256
0fddd4c47d926f476edaed59875d4ce7c29dbc57ad6d8a83c3b5132b31ea87bc

SHA512
84c806b3412769d3c4ca42df5e67558342670c38645c90bca7e5ccd597d99571e18ec49935e25f6d6f9f042ac35a79ef8f8cdbe2e444c73c006188a543164d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dd6981678866667593eec708d79da3d7

SHA1
9f27012642770dae8c55c0df8afcc5548e7fd311

SHA256
8ab67112327f2b3cfe30c7ba3f87ed431cc43f5e2b6533bc5a2535f240f57df9

SHA512
d9711823009dd1ad5720177906c9176640d11777429629364434cf96bee4e476077f04a1ebfbfe7e106ac9b9ab3a74d400a22d379f7595216a5a5165f24da5e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
553213d626847d7b7521478beb832664

SHA1
189d2a3acf935e669414b68f181f550616f9126c

SHA256
8e391ca1b350bba1ea3c3737af2b27e0b727369ee8c2d420d2f0d41cb68e7ff6

SHA512
2d58e72e68599617bb173c842fe24a8dad2956c424bf799ff04dfb05f57c5a2db45a8856b95d58c2291ec13af14ab88eec68d868f331f8924963b6aa6c849da6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
775aa4d418ab5696c4efdd6e416f6651

SHA1
ab2924c5787173d1245ed39fe67513cd71014cec

SHA256
7c46331382ebd3cc5cefd5e9020d404f77dc7edd824dbe55663154520f861ed5

SHA512
40aea081fbc19184fe1dec3d8d0f8c627c7f40ed943e546496b5b50c7de5e9d2b5c44168732118afd055418dd0189923183f56a6b6c32d5cc1e2bca2394d49bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d78d3ef95ddf62574361ff273091a4d3

SHA1
96768c355107574387852c2cadadf63040bd6a4e

SHA256
44ef74da6939435f9bb1c8a7aca4e1f961e43dcfd95f637a6a984fa76d70b76a

SHA512
3aa5f7d03d106121dc73628e592366abc6ddc5e07e435e612819efc8df293cf5b0ed7eb7b7dbd8647434da77356a560dae61e43a81c68fdf8da8d1afce87661f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a820d80ce212de4063fd16e7d24cf09c

SHA1
5a7602b6aaffc7ba5caea5ff4f8db2a77f83fde6

SHA256
80255fe2624b507e4e7688c0204186a2846c93859c93aea16454291c9303c7af

SHA512
a1568aefad0478669333a81f91c7d9b016ecf3d37f2f009cbf3e176448d01d2197651525a6620ce6aa19619cc645c77cd85b62cafaa8d554df13d5f562b12254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
872f8e73386e5ea553c1a9c7358b3b20

SHA1
691f427b5d4a3d61b924ce9c0b71096994cedded

SHA256
1c1450d7926af959572ee6274977f402c96ed5b24f4b0fdd3f6d0cd4445aaa3c

SHA512
df8d3fd0ace6fd611b22272bf845b7217583cec88356ae485eb3d37b83c1047756075b1b4201a8ff69f34bfdf3564cd50a215b2ddc0196af7afba57e6f595ee8

Download Submit
C:\Users\Admin\Downloads\Plants Vs Zombies Hybrid English v2.4 v1.2.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\SysWOW64\.tmpIbn6wi\PlantsVsZombies.exe

Filesize
10.6MB

MD5
b61afdfe704a5eeb15f7b77fcd0554c8

SHA1
a03f159eba7d5b98af5716aecc6072e45c249ef0

SHA256
c015a10172d3f879c9af8233653021ca01282820d2eb9ba0cd9cf9fa0c02d42b

SHA512
eabd128fa0a381032fd428e623d8f9c7f328726032e2c5d972cde1c0fde6ecacd29db1f662dafc2c9ce801ad1ea22bc6d1d160049f7f95e23330b73dd95d9877

Download Submit
C:\Windows\SysWOW64\.tmpIbn6wi\bass.dll

Filesize
90KB

MD5
6731f160e001bb85ba930574b8d42776

SHA1
aa2b48c55d9350be1ccf1dce921c33100e627378

SHA256
3627adef7e04dd7aa9b8e116d0afc11dcee40d0e09d573210a4f86bdc81a80b6

SHA512
07ae0cb85464b015b35e6157228775a6ac66e5e62a1b47f9395307b61176b6df835e00a1518846507718acffc271263008cc8a9b2c1e8a0192c5438774e12437

Download Submit
C:\Windows\SysWOW64\.tmpIbn6wi\gdi42.dll

Filesize
2.4MB

MD5
925373c5522569c053ae3ff9a8879a40

SHA1
8e18a8dea1add62d9fb56414dfe42fc1c04b2505

SHA256
57d7f0a0290fbf80d2b3399ba102df384fbc27edaee77fec86a5c106f4bf8429

SHA512
2e239ba0fbab72d7bfef07746e287ac359341b5f96d14b754e8a16165da542ddb5431feb044ebb6b7084a06a33e65ff964b1cc2da9a6f2be0eb4a9a38b39278b

Download Submit
C:\Windows\SysWOW64\fonts\fzcq.ttf

Filesize
2.4MB

MD5
2167a0f0bf3f1cb718f2683d13a4c887

SHA1
bb9c3bdafa5a0032ae2fa4e1b90c08c153a40026

SHA256
5b7d4a996fc1077774a5a37c3dce400d6c7af152c95c17e80a257fdfa01b299d

SHA512
9b18e693ba428a464abfaf482559b7e602339ce2125eac06a0127f9735aece5b593329591e4f33bf3b1d609b394949ebfde6270bd68ee8efd36900d449d70403

Download Submit
C:\Windows\SysWOW64\fonts\fzjz.ttf

Filesize
1.4MB

MD5
b020f94b37feaebe8827cbe20574f3fe

SHA1
0909fab3388b8c5f0af1a88bb0ca63e825ba89b9

SHA256
d6e6bfaf209c2e6536b7fc91e73cfd0c65320913775bdd2c552b34cc6a4e3ad3

SHA512
a282e437fac567d7f27f6a1f6e99e9a37d5e5f2512c5e2f45534c5116a9e06e545dd6197367dd1c300cdfcefdbe2be3552ee4c136063f188f93f6d01225ccbd2

Download Submit
C:\Windows\SysWOW64\fonts\fzkt.ttf

Filesize
3.9MB

MD5
d8d4f4cd37f444e0d4a32e7f8d429b1f

SHA1
ffa5c01deeb65d36ffdb118e24351e958775b425

SHA256
ca830a3680be9a70c8a661d5f7327b6d24c7059ca783ad7eb6d75be7919326fb

SHA512
9577b0444fc6aebb5d7b902317d22d8a7fd39fd1fcdc7698f40d35e94905fbb3091ac536c2ca3789e9a9913f73908b756a4489b10fcb42727d93bd2eba55fbd4

Download Submit
C:\Windows\SysWOW64\fonts\wryh+pico12num.ttf

Filesize
13.7MB

MD5
ee6f32d05c738b25d7b8476f09d2a4e2

SHA1
cec7dcaa5219a47826cff8b9d35a55fe8eb23c64

SHA256
04242d27b05860c07906fbf0d5276b25e5951f892be898c59d4c9b755d79f52c

SHA512
62b72347513ec2b9d78e8f13ffe0a11433c4a288fb10ff02849d4a48c005bc28f5f6f220916fddf01d28a4e238a75860f35ba924fd93efa628812873fc173b7d

Download Submit
C:\Windows\SysWOW64\fonts\wryh.ttf

Filesize
14.3MB

MD5
c2db9c4749c6ecf521ffca0dd8f62752

SHA1
b65631674c73acb0c5b3f40b0e4cb875c15ce377

SHA256
c3c0e7bbcec69ee4765a53831c7be310acaca1ec1b408974ca4f4c73c1aa400c

SHA512
cd49890025a987d9a1754156d036b8c337c6ad50f1504c1ddbd23c50ce5a622cf0cf51784f5c99eae8e6b8f1f0f8a6f70be064a0cc731064f8aa643bb252d5fe

Download Submit
memory/3600-193-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-391-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-392-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-400-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-381-0x0000000000400000-0x0000000000F4D000-memory.dmp

Filesize
11.3MB

Download
memory/3600-424-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-425-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-426-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-427-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-428-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-431-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-188-0x0000000000400000-0x0000000000F4D000-memory.dmp

Filesize
11.3MB

Download
memory/3600-443-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-453-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-456-0x0000000010610000-0x0000000010651000-memory.dmp

Filesize
260KB

Download
memory/3600-457-0x0000000000400000-0x0000000000F4D000-memory.dmp

Filesize
11.3MB

Download