78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe
Size

7.7MB
MD5

58509394a423edb98b0b1be7f18551ab
SHA1

4b7a8ff6ec8bd5908e306cb23d2b84ce3ff03ec3
SHA256

78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc
SHA512

41ec27bb184d55d84b3e7150df35d2229cf93ae389fc4f8b9f8bded29fb730661ddc3a21d6d926f6d98cc169e851e44928fb2058bd898d96924f69e301350b9a
SSDEEP

196608:GPtx5dUAuaAxSTZLvD6/x1R92cJUMo7xS6:ctx5dUARAh5n9/GMolS6

Score

10^/10

discovery persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\7.0.16\\es\\lsass.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\7.0.16\\es\\lsass.exe\", \"C:\\blockhostnet\\msedge.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\7.0.16\\es\\lsass.exe\", \"C:\\blockhostnet\\msedge.exe\", \"C:\\blockhostnet\\sihost.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\7.0.16\\es\\lsass.exe\", \"C:\\blockhostnet\\msedge.exe\", \"C:\\blockhostnet\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\7.0.16\\es\\lsass.exe\", \"C:\\blockhostnet\\msedge.exe\", \"C:\\blockhostnet\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\wininit.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\7.0.16\\es\\lsass.exe\", \"C:\\blockhostnet\\msedge.exe\", \"C:\\blockhostnet\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\wininit.exe\", \"C:\\blockhostnet\\msinto.exe\""	msinto.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	336	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	1144	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	1144	schtasks.exe	100

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	msinto.exe

Executes dropped EXE 4 IoCs

pid	Process
1684	svchost.exe
2304	explorer.exe
972	msinto.exe
3748	lsass.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\7.0.16\\es\\lsass.exe\""	msinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\blockhostnet\\msedge.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\blockhostnet\\msedge.exe\""	msinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\blockhostnet\\sihost.exe\""	msinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\wininit.exe\""	msinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.WindowsDesktop.App\\7.0.16\\es\\lsass.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\blockhostnet\\sihost.exe\""	msinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Windows Media Player\\fr-FR\\wininit.exe\""	msinto.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msinto = "\"C:\\blockhostnet\\msinto.exe\""	msinto.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msinto = "\"C:\\blockhostnet\\msinto.exe\""	msinto.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC9D28A93834924453A1D352F8D2FFD48.TMP	csc.exe
File created	\??\c:\Windows\System32\3uu4gi.exe	csc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2304	explorer.exe
2304	explorer.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\6203df4a6bafc7	msinto.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC350BEFC47204451B954EDC3ECD916B5.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\wininit.exe	msinto.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\fr-FR\wininit.exe	msinto.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\56085415360792	msinto.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\lsass.exe	msinto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4876	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	msinto.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4876	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4200	schtasks.exe
336	schtasks.exe
2268	schtasks.exe
1736	schtasks.exe
1388	schtasks.exe
3516	schtasks.exe
3040	schtasks.exe
2504	schtasks.exe
1740	schtasks.exe
1072	schtasks.exe
3404	schtasks.exe
680	schtasks.exe
2608	schtasks.exe
1532	schtasks.exe
864	schtasks.exe
1604	schtasks.exe
4720	schtasks.exe
4360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2304	explorer.exe
2304	explorer.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe
972	msinto.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	msinto.exe
Token: SeDebugPrivilege	3748	lsass.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 1684	4200	78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe	91
PID 4200 wrote to memory of 1684	4200	78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe	91
PID 4200 wrote to memory of 1684	4200	78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe	91
PID 4200 wrote to memory of 2304	4200	78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe	92
PID 4200 wrote to memory of 2304	4200	78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe	92
PID 1684 wrote to memory of 1340	1684	svchost.exe	94
PID 1684 wrote to memory of 1340	1684	svchost.exe	94
PID 1684 wrote to memory of 1340	1684	svchost.exe	94
PID 2304 wrote to memory of 4448	2304	explorer.exe	95
PID 2304 wrote to memory of 4448	2304	explorer.exe	95
PID 1340 wrote to memory of 3916	1340	WScript.exe	104
PID 1340 wrote to memory of 3916	1340	WScript.exe	104
PID 1340 wrote to memory of 3916	1340	WScript.exe	104
PID 3916 wrote to memory of 972	3916	cmd.exe	106
PID 3916 wrote to memory of 972	3916	cmd.exe	106
PID 972 wrote to memory of 2024	972	msinto.exe	110
PID 972 wrote to memory of 2024	972	msinto.exe	110
PID 2024 wrote to memory of 4708	2024	csc.exe	112
PID 2024 wrote to memory of 4708	2024	csc.exe	112
PID 972 wrote to memory of 4044	972	msinto.exe	113
PID 972 wrote to memory of 4044	972	msinto.exe	113
PID 4044 wrote to memory of 208	4044	csc.exe	115
PID 4044 wrote to memory of 208	4044	csc.exe	115
PID 972 wrote to memory of 4952	972	msinto.exe	131
PID 972 wrote to memory of 4952	972	msinto.exe	131
PID 4952 wrote to memory of 4776	4952	cmd.exe	133
PID 4952 wrote to memory of 4776	4952	cmd.exe	133
PID 4952 wrote to memory of 4876	4952	cmd.exe	134
PID 4952 wrote to memory of 4876	4952	cmd.exe	134
PID 4952 wrote to memory of 3748	4952	cmd.exe	137
PID 4952 wrote to memory of 3748	4952	cmd.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe
"C:\Users\Admin\AppData\Local\Temp\78fee239cf44c2ab923669b8ccf016ef117a9682e339d96de87fa2f0a45200cc.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blockhostnet\dbHnJe8FTGPofdGpjq0jOMhg.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\blockhostnet\iXSXm.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3916
    - - C:\blockhostnet\msinto.exe
        
        "C:\blockhostnet/msinto.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:972
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dzpkzhsc\dzpkzhsc.cmdline"
        6⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1737.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC350BEFC47204451B954EDC3ECD916B5.TMP"
        7⤵
        
        PID:4708
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aj4ksdyz\aj4ksdyz.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17C4.tmp" "c:\Windows\System32\CSC9D28A93834924453A1D352F8D2FFD48.TMP"
        7⤵
        
        PID:208
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\O4vpGs7A1d.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4876
        
        C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\lsass.exe
        
        "C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\lsass.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3748
- C:\Users\Admin\AppData\Local\Temp\explorer.exe
  "C:\Users\Admin\AppData\Local\Temp\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4440,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\blockhostnet\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\blockhostnet\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\blockhostnet\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\blockhostnet\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\blockhostnet\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\blockhostnet\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msintom" /sc MINUTE /mo 13 /tr "'C:\blockhostnet\msinto.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msinto" /sc ONLOGON /tr "'C:\blockhostnet\msinto.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msintom" /sc MINUTE /mo 7 /tr "'C:\blockhostnet\msinto.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\O4vpGs7A1d.bat

Filesize
207B

MD5
740b3b70e25cdfc12e2d9d2fa9ee90c6

SHA1
d40f9884a1985b48d7ca94b0355ca820c135408c

SHA256
a2689abaace557b67afa8b5d29b98c82515767e547a6c6c139e243c2b7e8d52c

SHA512
f0536fbbc3a2ac1c69fb7ac2e5a5c0c7f096e1c18a21c427247e982ba30c4234854b7940100493a3a12d48ee716986aac173e76e4087d0b451f77ed5469ae659

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1737.tmp

Filesize
1KB

MD5
75bea72e93e06720c3bfc3aa5a94de34

SHA1
201613d8c03f6646ad8007e21bfe7c2dbf2b61c5

SHA256
9768d95d9ba9d2e362c577777fbdff8316483c88dee5607776f4b3eab5dd0b2a

SHA512
a17ec6dcf62e2819b14a5ec98bc52ebad7247776402d2327a4797ffa7e588cb90e7e103875d4383af3974d4d0a5f89acebea939765499b23fc40fd637cea2ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES17C4.tmp

Filesize
1KB

MD5
0f82760c4d61345559093497587a38b8

SHA1
10e40b9dbdc56cfccb1f714a520b505d4cbcc0bd

SHA256
0197c2891a93731367d68e74de219f8af145c7288c7234a467d9a6ddc4cc8e97

SHA512
a20dc464355016b260df6646ab2942234ca0730ac88f2e890f0eeb49d10d75c99e88dc4a480bc31233c5745085cb6b4281491551887b91ead4c806be3e40d37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\explorer.exe

Filesize
5.5MB

MD5
52aaa8c3fd6b813b713ae05ab9e4829c

SHA1
d4ac8addbe5e15e867afe58f4bbb8319395ad38e

SHA256
0c30d4cb510304d4ce140952f8ce316056cc4bc552cef78a81fd5301aecc1fd2

SHA512
c39bba95a8554f1115d0362bad33901fd87e00d5de7671cd48d7b537c97889882b9009a83948087cf8516a32588e4ef831531977740b17a2791cec927934fdd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
2.1MB

MD5
a87cb2a1e23600c28c1a8e6a5c6a1c52

SHA1
8d8dabcca9b1265a12b4e5a00d517930305468b6

SHA256
1ba3c880a6c5d379e7257e3bb14f9aa6b2d836562e5ad0439f219fa76b3d9dca

SHA512
23a9132c0eaf6725e42a974c656a8cb5792a67f7eb7e32d33041fb72f45780f97ecfb6822c8099bd7f425fb142dfa6e0e3dbd46b1736d70551c32eb910dbd280

Download Submit
C:\blockhostnet\dbHnJe8FTGPofdGpjq0jOMhg.vbe

Filesize
196B

MD5
8f9afb736d7dcaf92555a19215fa5c7b

SHA1
f735f020e772ac67b5ed87c15d110973980e271b

SHA256
d78691f9757ea266450f639553638bdb3f7383341298578a2f4096a7096b2fb4

SHA512
69d27657031b6b8c8c9d266f8498a824a13434d62d80144cb5966e26b4e2b2e2e43247af31dc5d845b1a771e267e71ba59dcbcb04f532bce8892a462c035d10b

Download Submit
C:\blockhostnet\iXSXm.bat

Filesize
71B

MD5
5b64fe1545fbf11ec2bf13e3cf7579db

SHA1
bc17a73a181ca2e2dd489173e12861416e6db274

SHA256
579e774b18b84f5d6cba055a2ed46893b438ee98317efafa9837c6e796f6496f

SHA512
8e44c179350d5554299c303d54b30c934eff8ed69f807bb810d93087085909d8306eb0f3a7476fc6707c4565c0958e720b8086e5c038e2f337b79f310203c153

Download Submit
C:\blockhostnet\msinto.exe

Filesize
1.8MB

MD5
83152560524b250c6c27561117df37fe

SHA1
f17613b0d3ec3d46a51daf0ca011ff7dc8a8d53a

SHA256
72bcbcb256f87968ad40aef6b4dac464921ce8f66cdc242b65eb6e9f23b3ca80

SHA512
7793eb5dcc26a00a0c72a07dd084a99d2b41e87e995a25040dd183bd84e94fce652eb896f0eafaa717bd97a67b8d1bb8e7a28b4c7ea4f39c15532881304a218c

Download Submit
\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC350BEFC47204451B954EDC3ECD916B5.TMP

Filesize
1KB

MD5
b5189fb271be514bec128e0d0809c04e

SHA1
5dd625d27ed30fca234ec097ad66f6c13a7edcbe

SHA256
e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f

SHA512
f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\aj4ksdyz\aj4ksdyz.0.cs

Filesize
411B

MD5
5b8e4b015c461401448533fb1a05bb8a

SHA1
fea3b2ce8e557d198dfc447a8eee1974c180ce4d

SHA256
931308151c5badadbdb613361780c57f220642f15b6a0baad85c61cac0a6fc3d

SHA512
6863a78c3b05fbe524b8ea5827a31172c73698964df4bf66b9416f173736b868ddff9a6de3ca38f7f96b2605da9bdde62e85fc90739dfc1450a8706e7e203a69

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\aj4ksdyz\aj4ksdyz.cmdline

Filesize
235B

MD5
85b9f482adf0ec89833be88143ad64b6

SHA1
ed071bbd3ed6c034c4d48eb4c718de7fc726e60d

SHA256
dcf8853a24f99177aab0249e69e4f834797528fcee5fc6366e9a57adaf4c324e

SHA512
101bc635e7b7078117d80e0a98de4e0ccd5c3d181748f449777d0340f8d43a01265aad46079fb1b0b9b8b2e556022b02b84d8921810a450e309f1f4a6886a670

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dzpkzhsc\dzpkzhsc.0.cs

Filesize
441B

MD5
c707e784e3edc380f7a819c302821fe2

SHA1
3ffb017d350e3236ecd10c01ec72288fa6fb4b61

SHA256
ababe053ef8a10e7cdeae419d9f70e995dd23189391012a6b79089c3395a27be

SHA512
96b9c2dabd23a78a2afe16a1b54a9d7792445c522bb70bd1b3f706b3661161bbec7678e405a662817eef37fc0c20ffa1e88c13011b511f6951f2ef6919fc3ae0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dzpkzhsc\dzpkzhsc.cmdline

Filesize
265B

MD5
65a68132ad2894fa18bfff59f26529f7

SHA1
df000ebd35581f3cdda8daaf2eb1d04b4c78b410

SHA256
7626894fc079a91ef06226d45990146a191aa09173edd0c96bc385ff29a6c13b

SHA512
7eafc75e6068d15148fc409517cf60ebdd89074cbb791e1fc66c2b4ef902c6aa52b1ddb8a05571172ec7b14fafb3f50c0c9f08c4c94fdd158dfffff6779609b8

Download Submit
\??\c:\Windows\System32\CSC9D28A93834924453A1D352F8D2FFD48.TMP

Filesize
1KB

MD5
defac805d7edc8907512384855c67e24

SHA1
b0b59b7f5f6b872236a383a2381fbdcc7b2b630e

SHA256
57cf2da2350701d9232969935334b4bbda42f10945aac7757c951108e0bd24fc

SHA512
5dcbdf30678b41c0916b0cf60575ea0029a0acb3ebf2f3a38019d2ce83619a007cc75c8109395d33e1c083cb10a92dc9e94b2b6208526051c0e563448eb10b1f

Download Submit
memory/972-40-0x0000000002730000-0x000000000273E000-memory.dmp

Filesize
56KB

Download
memory/972-42-0x000000001B2F0000-0x000000001B30C000-memory.dmp

Filesize
112KB

Download
memory/972-43-0x000000001B370000-0x000000001B3C0000-memory.dmp

Filesize
320KB

Download
memory/972-45-0x000000001B320000-0x000000001B338000-memory.dmp

Filesize
96KB

Download
memory/972-47-0x0000000002740000-0x000000000274C000-memory.dmp

Filesize
48KB

Download
memory/972-88-0x000000001BDB0000-0x000000001BE1B000-memory.dmp

Filesize
428KB

Download
memory/972-38-0x00000000004D0000-0x00000000006AA000-memory.dmp

Filesize
1.9MB

Download
memory/2304-33-0x000000014000E000-0x0000000140347000-memory.dmp

Filesize
3.2MB

Download
memory/2304-31-0x0000000140000000-0x00000001408C1000-memory.dmp

Filesize
8.8MB

Download
memory/2304-29-0x00007FFA4DF30000-0x00007FFA4DF32000-memory.dmp

Filesize
8KB

Download
memory/2304-30-0x00007FFA4DF40000-0x00007FFA4DF42000-memory.dmp

Filesize
8KB

Download
memory/2304-28-0x000000014000E000-0x0000000140347000-memory.dmp

Filesize
3.2MB

Download
memory/3748-97-0x000000001C390000-0x000000001C3FB000-memory.dmp

Filesize
428KB

Download
memory/4200-2-0x00000000054B0000-0x000000000554C000-memory.dmp

Filesize
624KB

Download
memory/4200-0-0x00000000750CE000-0x00000000750CF000-memory.dmp

Filesize
4KB

Download
memory/4200-1-0x0000000000450000-0x0000000000C02000-memory.dmp

Filesize
7.7MB

Download