hxxps://www[.]mediafire[.]com/file/58h7dx52828frwr/NINJA_HEX_C%2523_V4[.]3[.]rar/file

Analysis

max time kernel
134s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/58h7dx52828frwr/NINJA_HEX_C%2523_V4.3.rar/file

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2092	NINJA HEX C#.exe
5840	NINJA HEX C#.exe
5448	NINJA HEX C#.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	NINJA HEX C#.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NINJA HEX C#.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NINJA HEX C#.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NINJA HEX C#.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NINJA HEX C#.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	NINJA HEX C#.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NINJA HEX C#.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NINJA HEX C#.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	NINJA HEX C#.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe
3052	msedge.exe
3052	msedge.exe
4012	identity_helper.exe
4012	identity_helper.exe
5508	msedge.exe
5508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	3372	7zG.exe
Token: 35	3372	7zG.exe
Token: SeSecurityPrivilege	3372	7zG.exe
Token: SeSecurityPrivilege	3372	7zG.exe
Token: SeDebugPrivilege	2092	NINJA HEX C#.exe
Token: SeDebugPrivilege	5840	NINJA HEX C#.exe
Token: SeDebugPrivilege	5448	NINJA HEX C#.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3372	7zG.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 916	3052	msedge.exe	82
PID 3052 wrote to memory of 916	3052	msedge.exe	82
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 4580	3052	msedge.exe	83
PID 3052 wrote to memory of 2676	3052	msedge.exe	84
PID 3052 wrote to memory of 2676	3052	msedge.exe	84
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85
PID 3052 wrote to memory of 1188	3052	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/58h7dx52828frwr/NINJA_HEX_C%2523_V4.3.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83a3746f8,0x7ff83a374708,0x7ff83a374718
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18405425699376178207,4194860182229688764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5920

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap4399:96:7zEvent23754
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3372

C:\Users\Admin\Downloads\NINJA HEX C#.exe
"C:\Users\Admin\Downloads\NINJA HEX C#.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/@ninjahex1
  2⤵
  PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff83a3746f8,0x7ff83a374708,0x7ff83a374718
    3⤵
    PID:2008

C:\Users\Admin\Downloads\NINJA HEX C#.exe
"C:\Users\Admin\Downloads\NINJA HEX C#.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/@ninjahex1
  2⤵
  PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff83a3746f8,0x7ff83a374708,0x7ff83a374718
    3⤵
    PID:4088

C:\Users\Admin\Downloads\NINJA HEX C#.exe
"C:\Users\Admin\Downloads\NINJA HEX C#.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NINJA HEX C#.exe.log

Filesize
1KB

MD5
542877595cb4b715d7cc958c41b687b7

SHA1
6b4e0a17c93506d4f86d94123c591a16df9029d8

SHA256
f8984022737d8d57f339d3e94bfa6394954b98471750ef04576fee00b7f32ca2

SHA512
a3d20ec7cd4890e523f54ddf7c845eb0dd97e0c5174d0b97fad87559ff62052ff4241782456c7d922355787bdf5fe83476d59fcb6eabd6e16d23555de8257de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6b946800ea7dfefbf03c95da8e99eb4a

SHA1
ad4cf392557f88c64e03031e5e179132fef66044

SHA256
92dbc49fdc56b7f8aa24bdd9b2949cc5decef93afce4c48eb180f2a5dc4356e0

SHA512
10063c659611db0ca0dbdf3689250da5eff31df6ab118c23b5336dbbdb003024432e9f9bfba4ede292553065b7df6bab2e75bc60c9fe6cb5de3e6946379d0259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
4824bee18d035738c5c45cd3f68f7862

SHA1
d9f4ec5bdf0437384b92fd2267eaba4f5f856225

SHA256
aaab91738a67875e16164bc5284cb9365753644bd98d6c8813f95da74d70f659

SHA512
ba7ff44f9718964a4cb499f865191429732b8746108e37b2fa32809e1fb43814ce6a34ff4f99973587062062545624fe33737d38cb8bfd2c7e319740bfca99f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f3abdbce16b6c11a365974bc682b62e

SHA1
85c1e78a0dbd437186a2453b342eda8bb17f9b57

SHA256
b180fc7f41947f1218686a38f31f4cf8bc58940f76a5c32764a1230fb966018b

SHA512
3a2a02e10e191cebcc8049cc5b6b1271c027a25eafb0e12f88a06d63fea8b70ad69f1a5ef5505197910758aedaa5435e06d5d1d557652b968c008d5eb7ee01eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
ef10dc0efeccbe0674993dbac3a8dee3

SHA1
ddd8a923d4f0d0e8bccdbef8f5e9d3ac4c1aff5d

SHA256
f25704fc6219722e24cece6b71ccb398ba4cbfac28f88ae6927124d931ef0b5a

SHA512
5b0622165e8c7f8bd4707026020ff25243437d823d2dbb38f42a9c38315d546f4680d7f2a62e542a84552caa2db90dec412fe0aaff53e68302cf2fc952029740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
49beefc5b62b30ec165571dd2bbcdd39

SHA1
0322a4e7ca697493e282dc1c03d21b221e6ec0d0

SHA256
58b1d71111ee84b617130f258e409557799f691e3d623b63204e396fe86c39e0

SHA512
5a1f9de55a5e7614f86ea595552ddd19d630c0b64c29a7d7d8557cf36cefd88eee50dd2cb6c1773f72f3559d15459c448d4ac51b077c028d046fee103f8361e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
f9d65c57ba7af02c6f33226c44487de9

SHA1
e846513826d381a5b7c5eb5331de66ac8ef8b635

SHA256
a1e3589d8c09b9cd7f9a59cc6a96d6bb4faa4ca4a4430f5681b5f99758ea52d6

SHA512
d9dca41d5a5d9a98844aecb476dd3d224edb64e64fa24424866f850cfdc55f8719d2fc26ae8fa3871dcc2cfe74fd4422d212fd26ce79daf558ecda603f7b5ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
97baf71ac3f0eefb9c58b4815d8abd80

SHA1
b407e9ca27687230ebdab549fd68fe072cb3beeb

SHA256
3c12e2da97e45280df99011a9155c9dbb7fe6b772c6a2dfe4dc2357659668372

SHA512
2280e5f0f602c1b96b4ba9b5cb3c244004cb4256d35ac49243c9fd614e6307fbd7879698a705769a986e661cf608067d197b78cad89d087f056107b342fe8c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
affd5ed7900832a1421de5ff9794d751

SHA1
493c2960dbb131cf653abb4ffe8f8681e36d36f4

SHA256
d9cf30e1e15c6d3bb65d01a6476b0db4cd0426391e8c080c06d8f9d7f11753a7

SHA512
b4cf528d1822796c7b52a378218487e193ed81b331d6a6577bf6ac5f2acab8bf4b61d96fe9dcb4a32f2e49802a6bc7626887f225219052bfb40fa057967ff6ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8dd92961fe283d63dfca1337263bd484

SHA1
248d63c46fc8e6eeeb038aa2e2a9e26970326db6

SHA256
11e53f13fa95384f25ba7f9e4e551ef33f23165b9f9ebca566d4ffad11ee251b

SHA512
728a705c5214c74c9b03def706ed6043805995453b23f94892a97244d94a81cb5565c1384f8b01a51dc00549303a69d800853d5d80904a4adf3aa94c31392fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
20b759658fb2d6f0ff3215a0f63d5a75

SHA1
3dffa913a90236378e769db37fc1764fcb8f0712

SHA256
2a6fc9df938504f62ca4486fbff274c2d06d94c1b8cb9e464e2a6ce3ec08d86d

SHA512
cb581ae49f59036e4a83b29bef6b67af5e9e0c7e0eec49f2fe0068f16d3d15de8c2772b34c9357d9ea313dbcd9516888288a413636545b41955368883b9a6077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f5ca.TMP

Filesize
1KB

MD5
36369f80e3a0ccf2b0a5e23687a6ed46

SHA1
b9e177d7d202303306ea48e528da3baa032c892f

SHA256
cf545f59e4f7db74fe396f8e5911e31d155c4807bb57f0cb052df4e9e944c405

SHA512
d4448bbaf1619485c31e797146d9ce3b248abe75562998e8a1f1a2c541ba9b6a9de239f60a3418cdf85aa83ce2721acfc41172a7cfe740be3e9edef0567b9219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2130227-147b-4e57-8fdb-c05774de63e1.tmp

Filesize
12KB

MD5
8d92f89865d5076f111e7382e9c3424d

SHA1
c23e70750836451793b15988c2b0afda681b5189

SHA256
90be2ebf3ea1f45046dff4308000b6ca561fe0aad4f304d29a68ac18c3b2cc81

SHA512
2ecb4969f577cae5ea5a2a0417c34c44c77db54ed80a3c30344cedbd21a55da6b89b63aff2b25ec9999ef4a6ef6ad2b54450e8b16c4993201042c23f35076bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1b6bba2ce81eb4bc61320c935e4fd494

SHA1
bdbe603ed8a88e2c1104079299ed2ec413316d44

SHA256
67597cbc1082989b7e0c85a2bd58a2ba947a709f53d7e9099417fb7147bd1e7f

SHA512
acabd6a1293643bb104bf52b3c54a8a547e5a9118b036e0bf5447ac94c15f94101f61508ed5c4633437b584298e734beea7db238e7528ea0792e77c2484aed67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b0b05bb340346de3dc8cafebc5ded7ad

SHA1
aab11d19c8e6e0d0b2eb648ae603d4c8c48b7540

SHA256
87b7d93f14094ebb3ceb944bbee593246f355670cbcc6d06204f3c11ea429032

SHA512
2a7eb4ad29b55c860b05dfb63b5bb435df612920826b8a3bb34e51d19467f1c959fba5b656e35b99b8b69f281afb99dae2a0a53b0b57dd8ed8c5bbc82757d0e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
565ba7256f9d781cc76df88eb3f727df

SHA1
cec90d34b149e915653e736d00a9f0dc46323c52

SHA256
92c8f2388a8fe9b3e354855297f4ef1fd81cbdef48f8e3a7a1d7b395ba5f88c9

SHA512
922066e435437456784741d4d3978330c8df5243fd417e19dc3d5689eb0765b00205f7b0ef11c1f8ebfde5d0801247ec2942558df660a3677602814ab1fe26d8

Download Submit
C:\Users\Admin\Downloads\NINJA HEX C# V4.3.rar

Filesize
4.3MB

MD5
63677d4c625ba65a4995618af47fb69e

SHA1
a738db48682317a41e6cee99eafda10ac50e77e6

SHA256
cd92ce75d5ff0da610f818c458c03c93bd61c0101f58a0730b436f7f7eec51dc

SHA512
5d5e71b696222a22f6347c05d2bb446b222413123310a7629d087fa21491003e96f0a550193be16b1a5849e460c48f9109de91af1ce6f7f922fe2f98a94d3a03

Download Submit
C:\Users\Admin\Downloads\NINJA HEX C#.exe

Filesize
8.5MB

MD5
eb600f7ccb97014a2c1f3a3d190dbf0f

SHA1
646ba9e1f7b50b4fa1744b6209b3bde851325fd7

SHA256
680201c674cd93a7e2aac74798b3a9e7931ece5d8dc521421868f842ac61f7d5

SHA512
b24baabe9929cc77caab342e9bf537906f2afbd8df5cb08eb2e9e2c93e5b8e67a0834d873436d8e5a236c23da4dae64b673233c94e27e60483947b8cbe601497

Download Submit
memory/2092-248-0x00000230D2290000-0x00000230D22CC000-memory.dmp

Filesize
240KB

Download
memory/2092-247-0x00000230CD700000-0x00000230CD914000-memory.dmp

Filesize
2.1MB

Download
memory/2092-244-0x00000230B4BE0000-0x00000230B4BF2000-memory.dmp

Filesize
72KB

Download
memory/2092-243-0x00000230B26A0000-0x00000230B2F22000-memory.dmp

Filesize
8.5MB

Download