hxxps://drive[.]google[.]com/file/d/1BadFM-NjOnuotQPbotSbeGD3ZcosB_JA/view

Analysis

max time kernel
281s
max time network
272s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24-09-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1BadFM-NjOnuotQPbotSbeGD3ZcosB_JA/view

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
392	PlantsVsZombies.exe

Loads dropped DLL 2 IoCs

pid	Process
392	PlantsVsZombies.exe
392	PlantsVsZombies.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
4	drive.google.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4976	GameBarPresenceWriter.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fonts\fzjz.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fonts\fzkt.TTF	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\main.pak	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\.tmpZ74RcT\gdi42.dll	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\.tmpZ74RcT\PlantsVsZombies.exe	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fixes\补丁请放在此文件夹	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fonts\fzcq.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fonts\fzyh.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fonts\wryh+pico12num.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\fonts\wryh.ttf	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\config.toml	PlantsVsZombies Hybrid English v2.4.exe
File opened for modification	C:\Windows\SysWOW64\.tmpZ74RcT\bass.dll	PlantsVsZombies Hybrid English v2.4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PlantsVsZombies Hybrid English v2.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PlantsVsZombies.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2227988167-2813779459-4240799794-1000\{798B64BA-A7C4-44F8-9D13-5D5C5BD3403C}	svchost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Plants Vs Zombies Hybrid English v2.4 v1.2.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
2868	msedge.exe
2868	msedge.exe
1896	identity_helper.exe
1896	identity_helper.exe
1256	msedge.exe
1256	msedge.exe
4588	msedge.exe
4588	msedge.exe
748	PlantsVsZombies Hybrid English v2.4.exe
748	PlantsVsZombies Hybrid English v2.4.exe
748	PlantsVsZombies Hybrid English v2.4.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
392	PlantsVsZombies.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3892	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3892	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
992	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2920	2868	msedge.exe	78
PID 2868 wrote to memory of 2920	2868	msedge.exe	78
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 2944	2868	msedge.exe	79
PID 2868 wrote to memory of 1644	2868	msedge.exe	80
PID 2868 wrote to memory of 1644	2868	msedge.exe	80
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81
PID 2868 wrote to memory of 3000	2868	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1BadFM-NjOnuotQPbotSbeGD3ZcosB_JA/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9d7d13cb8,0x7ff9d7d13cc8,0x7ff9d7d13cd8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,1541284025230431725,13672117348901564965,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4540

C:\Users\Admin\AppData\Local\Temp\Temp1_Plants Vs Zombies Hybrid English v2.4 v1.2.zip\Plants Vs Zombies Hybrid English v2.4 v1.2\PlantsVsZombies Hybrid English v2.4.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Plants Vs Zombies Hybrid English v2.4 v1.2.zip\Plants Vs Zombies Hybrid English v2.4 v1.2\PlantsVsZombies Hybrid English v2.4.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:748
- C:\Windows\SysWOW64\.tmpZ74RcT\PlantsVsZombies.exe
  "C:\Windows\system32\.tmpZ74RcT\PlantsVsZombies.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x0000000000000420
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
a3521a62456e2be6d31685f3a2187e2b

SHA1
1045240915f25b5d054e912d5e77b9d1e99e1120

SHA256
8061780d27dde6a7eb40d2dcb698eca9bd07dff95bdbf8eefcd6e56f3d69a78e

SHA512
9835a8c1c957c53dce5cc5ca1fc62b9250b2d8994fe299fcfe4ed79b643978d15f336a4501bb1057115ed07766519ebb96cc6a82f9d3a3eecd9371b4c011ac38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0243e075ee76d64fdf30d7f8ece55ee5

SHA1
0a9e56d5585ebb1926b637111fab6d40ff4c8c95

SHA256
b49fe3fe7401643b5709103f21a45e774875bd875bb14dd528978009ead1ffd9

SHA512
235790ad211e6790483a5e3df12e0427bfdc1af84773160ee352fb2b1a53264e62e6180e3014f04c899b4e6f4423bc0f4ac4f2a3b15d75c427438f3d0436da34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f11162365d70a5fd97a195e88b615bb3

SHA1
3970f163c39d03eac899d328408ccfcf936a012f

SHA256
9637b5c7593b051786d7ab2ab46ddcffc71004e2cef9abc3de753a7153ece092

SHA512
52254c71bf8c26029977f504adc01154e582cba66e47fe841d015c0deec6ccecf1a225036a86ea45b61dbc90594cb3b741d4bba5c1564054223f61749aba9d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
62dceb887dbdd8011e89f059ce83b3f9

SHA1
f4e2263ce49a638071dedda44afb73e7a9b80d0a

SHA256
1291f264c1e82fca91e50a3dfa2d2ab66b2ac5a96f9a4fd331ff93afbbc3f7a6

SHA512
27f517b05327f804a6bec5ab0e009177af0a5556e424201e2d0536bc24dcf7c8f6039f011e9fd069ff4613200233b6d6fc9ba9926bfff69b1b03f8fdd11f695c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8851e4a86d2046519789c008b1f3cd93

SHA1
1537a5a96f6ddb21d55d27f06ec753404ca8f655

SHA256
1edc89b1ae8b51fa4adcf915aaa5e3d705059322e4c9fe9ab1f6755230acbfc8

SHA512
5cc5071a06972541d87420f3e8eafb62ff92ecd277a63364e92a5ffe457c2e2731af6fd807433a28f68643dced2976dcc56375351471f42823f27e89de1d1ac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1faeea9a574cd6b074a9d799bfb93c49

SHA1
0f8e562b71a001552458940ac3551f51410365ee

SHA256
19c91ff05d58e67dae364237009f77be76a177fc0fd162a0b09b634dd6019bd7

SHA512
b6fe3294b16ce0a603592a26a2604bba9ed337a6a75766ada2fdf79a5bc8e782a20aac5e2b6a5028efd3753c1f56832abf1e7c4a98bd43131fc32ed70623c9a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57815a92c029c924e00baaea2112e068

SHA1
087412ab6ece2f38f4628e69f42b5a008b1d64f4

SHA256
446039dabd1ea1793634b2465287e2924e110038e1e3f01276da101def153763

SHA512
5074f9b9d9334f8b0f86bb4a4b5cd7849b7b46164ec0688834f2f3190ae05417ab39ed65c0f56153c0efe2f9a2b353f6520ba8404edfd2fb8fbe9b1aecc328e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b4ef5246a3547d16d9914c85ec581cb6

SHA1
a0ddb632179488492bc27bf7936035d966340b5c

SHA256
1541fb43254d66b61e34508b9ba73eb8f826b9db00925e3556542e3a6aa235ed

SHA512
2db164fb66be69387190b841b8c5c79b1f79936d310b144ebf6d0522aff25b7436b399d5c529351d239d52ced332d8f1623480e636f4792d07e30e8752d845ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a40a18811231aeb4949d41f0d488a0c7

SHA1
5e0d454ba685ac727b87d6359305ba80b5ba7f14

SHA256
70dc1a2bc5fde124e5669cb89241568ed62a99dca5f815287cb54b7da59489c1

SHA512
f938d392ec6e351d8f9ecdf862c63fcaf7adcc79283e99b5e9f6e0e05cbb0988ee81d1bd067419ea840166f4f261c80b96b689cec5012c168f2feb336eb2b35a

Download Submit
C:\Users\Admin\Downloads\Plants Vs Zombies Hybrid English v2.4 v1.2.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\SysWOW64\.tmpZ74RcT\GDI42.dll

Filesize
2.4MB

MD5
925373c5522569c053ae3ff9a8879a40

SHA1
8e18a8dea1add62d9fb56414dfe42fc1c04b2505

SHA256
57d7f0a0290fbf80d2b3399ba102df384fbc27edaee77fec86a5c106f4bf8429

SHA512
2e239ba0fbab72d7bfef07746e287ac359341b5f96d14b754e8a16165da542ddb5431feb044ebb6b7084a06a33e65ff964b1cc2da9a6f2be0eb4a9a38b39278b

Download Submit
C:\Windows\SysWOW64\.tmpZ74RcT\PlantsVsZombies.exe

Filesize
10.6MB

MD5
b61afdfe704a5eeb15f7b77fcd0554c8

SHA1
a03f159eba7d5b98af5716aecc6072e45c249ef0

SHA256
c015a10172d3f879c9af8233653021ca01282820d2eb9ba0cd9cf9fa0c02d42b

SHA512
eabd128fa0a381032fd428e623d8f9c7f328726032e2c5d972cde1c0fde6ecacd29db1f662dafc2c9ce801ad1ea22bc6d1d160049f7f95e23330b73dd95d9877

Download Submit
C:\Windows\SysWOW64\.tmpZ74RcT\bass.dll

Filesize
90KB

MD5
6731f160e001bb85ba930574b8d42776

SHA1
aa2b48c55d9350be1ccf1dce921c33100e627378

SHA256
3627adef7e04dd7aa9b8e116d0afc11dcee40d0e09d573210a4f86bdc81a80b6

SHA512
07ae0cb85464b015b35e6157228775a6ac66e5e62a1b47f9395307b61176b6df835e00a1518846507718acffc271263008cc8a9b2c1e8a0192c5438774e12437

Download Submit
C:\Windows\SysWOW64\fonts\fzcq.ttf

Filesize
2.4MB

MD5
2167a0f0bf3f1cb718f2683d13a4c887

SHA1
bb9c3bdafa5a0032ae2fa4e1b90c08c153a40026

SHA256
5b7d4a996fc1077774a5a37c3dce400d6c7af152c95c17e80a257fdfa01b299d

SHA512
9b18e693ba428a464abfaf482559b7e602339ce2125eac06a0127f9735aece5b593329591e4f33bf3b1d609b394949ebfde6270bd68ee8efd36900d449d70403

Download Submit
C:\Windows\SysWOW64\fonts\fzjz.ttf

Filesize
1.4MB

MD5
b020f94b37feaebe8827cbe20574f3fe

SHA1
0909fab3388b8c5f0af1a88bb0ca63e825ba89b9

SHA256
d6e6bfaf209c2e6536b7fc91e73cfd0c65320913775bdd2c552b34cc6a4e3ad3

SHA512
a282e437fac567d7f27f6a1f6e99e9a37d5e5f2512c5e2f45534c5116a9e06e545dd6197367dd1c300cdfcefdbe2be3552ee4c136063f188f93f6d01225ccbd2

Download Submit
C:\Windows\SysWOW64\fonts\fzyh.ttf

Filesize
3.9MB

MD5
d8d4f4cd37f444e0d4a32e7f8d429b1f

SHA1
ffa5c01deeb65d36ffdb118e24351e958775b425

SHA256
ca830a3680be9a70c8a661d5f7327b6d24c7059ca783ad7eb6d75be7919326fb

SHA512
9577b0444fc6aebb5d7b902317d22d8a7fd39fd1fcdc7698f40d35e94905fbb3091ac536c2ca3789e9a9913f73908b756a4489b10fcb42727d93bd2eba55fbd4

Download Submit
C:\Windows\SysWOW64\fonts\wryh+pico12num.ttf

Filesize
13.7MB

MD5
ee6f32d05c738b25d7b8476f09d2a4e2

SHA1
cec7dcaa5219a47826cff8b9d35a55fe8eb23c64

SHA256
04242d27b05860c07906fbf0d5276b25e5951f892be898c59d4c9b755d79f52c

SHA512
62b72347513ec2b9d78e8f13ffe0a11433c4a288fb10ff02849d4a48c005bc28f5f6f220916fddf01d28a4e238a75860f35ba924fd93efa628812873fc173b7d

Download Submit
C:\Windows\SysWOW64\fonts\wryh.ttf

Filesize
14.3MB

MD5
c2db9c4749c6ecf521ffca0dd8f62752

SHA1
b65631674c73acb0c5b3f40b0e4cb875c15ce377

SHA256
c3c0e7bbcec69ee4765a53831c7be310acaca1ec1b408974ca4f4c73c1aa400c

SHA512
cd49890025a987d9a1754156d036b8c337c6ad50f1504c1ddbd23c50ce5a622cf0cf51784f5c99eae8e6b8f1f0f8a6f70be064a0cc731064f8aa643bb252d5fe

Download Submit
memory/392-409-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-444-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-411-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-413-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-414-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-415-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-416-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-419-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-198-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-431-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-432-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-442-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-443-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-410-0x0000000000400000-0x0000000000F4D000-memory.dmp

Filesize
11.3MB

Download
memory/392-445-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-446-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-194-0x0000000000400000-0x0000000000F4D000-memory.dmp

Filesize
11.3MB

Download
memory/392-456-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-457-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-458-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-459-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-460-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-461-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-462-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/392-463-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download