hxxps://www[.]mediafire[.]com/file/tf2nbtujgxgqbed/EXM_Premium_Tweaks_Updated[.]rar/file

Resubmissions

03/10/2024, 00:25

241003-aq13yavcrl 8

03/10/2024, 00:22

241003-anyj2aybqa 3

02/10/2024, 23:58

241002-31c33stepp 10

Analysis

max time kernel
147s
max time network
139s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
03/10/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/tf2nbtujgxgqbed/EXM_Premium_Tweaks_Updated.rar/file

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1892	venus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
260	raw.githubusercontent.com
261	raw.githubusercontent.com
262	raw.githubusercontent.com
263	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	venus.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\venus.exe:Zone.Identifier	firefox.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	venus.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0074c4d62a15db01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a22797d62a15db01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5d13e1d62a15db01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.mediafire.com\ = "111"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.mediafire.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\mediafire.com\Total = "51"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.mediafire.com\ = "51"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.mediafire.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packa = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\mediafire.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\mediafire.com\Total = "124"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{22F5B498-6CAB-4935-A79F-618917860B36} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.mediafire.com\ = "124"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\venus.exe:Zone.Identifier	firefox.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3344	MicrosoftEdgeCP.exe
3344	MicrosoftEdgeCP.exe
3344	MicrosoftEdgeCP.exe
3344	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4648	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4648	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4648	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3572	MicrosoftEdge.exe
Token: SeDebugPrivilege	3572	MicrosoftEdge.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: SeDebugPrivilege	5076	firefox.exe
Token: 33	5156	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5156	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3572	MicrosoftEdge.exe
3344	MicrosoftEdgeCP.exe
4648	MicrosoftEdgeCP.exe
3344	MicrosoftEdgeCP.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
5076	firefox.exe
1892	venus.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3344 wrote to memory of 520	3344	MicrosoftEdgeCP.exe	75
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 3148 wrote to memory of 5076	3148	firefox.exe	78
PID 5076 wrote to memory of 4208	5076	firefox.exe	79
PID 5076 wrote to memory of 4208	5076	firefox.exe	79
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80
PID 5076 wrote to memory of 4204	5076	firefox.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://www.mediafire.com/file/tf2nbtujgxgqbed/EXM_Premium_Tweaks_Updated.rar/file"
1⤵
PID:4488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3572

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4668

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4648

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.0.1042955597\1917037508" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20767 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67caf389-9cfa-45dc-8066-95e881c25723} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 1796 1a9570d7b58 gpu
    3⤵
    PID:4208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.1.547024617\467433017" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20848 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e84b778a-c8d5-4364-9730-c9e6712631b0} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 2152 1a94bf72e58 socket
    3⤵
    PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.2.526258419\1121711310" -childID 1 -isForBrowser -prefsHandle 2828 -prefMapHandle 2844 -prefsLen 20951 -prefMapSize 233414 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {232c019f-5eea-4f7c-8f22-4ee3ea4cb824} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 2820 1a95705f558 tab
    3⤵
    PID:3740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.3.1366876779\484726529" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6ff7916-7c7e-47cb-9bb2-d39081b9ea68} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 3628 1a94bf61058 tab
    3⤵
    PID:2008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.4.476249967\688529897" -childID 3 -isForBrowser -prefsHandle 4316 -prefMapHandle 4312 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d4fdd23-25cd-4a59-9980-ae3344463395} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4324 1a95cd23858 tab
    3⤵
    PID:2964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.5.850296416\221744601" -childID 4 -isForBrowser -prefsHandle 4968 -prefMapHandle 5020 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab3ce2de-a769-4387-90de-e0c2c0eb63e6} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4884 1a95cb60058 tab
    3⤵
    PID:4340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.6.814291929\1571758970" -childID 5 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {54ce2cb8-7188-4da1-98e3-3ac8dc88cf36} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4944 1a95cb61258 tab
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.7.1948090140\228288545" -childID 6 -isForBrowser -prefsHandle 5360 -prefMapHandle 5364 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a132d4fc-3816-4ef2-90ca-a80f2b964c48} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 5352 1a95cb61b58 tab
    3⤵
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.8.905804293\1144884660" -childID 7 -isForBrowser -prefsHandle 4148 -prefMapHandle 4152 -prefsLen 26433 -prefMapSize 233414 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2593bed-a2a8-41a4-b275-533b6ee590f3} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 2912 1a95dbc0f58 tab
    3⤵
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.9.1520136889\599089308" -childID 8 -isForBrowser -prefsHandle 4148 -prefMapHandle 1572 -prefsLen 26608 -prefMapSize 233414 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0300733a-2126-4029-a6a9-93eb9ecc98c0} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 5764 1a95ee7a658 tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.10.121613546\580262942" -parentBuildID 20221007134813 -prefsHandle 4832 -prefMapHandle 4828 -prefsLen 26873 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25909e86-a539-4fd6-aeaa-ab03c9de7766} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 4808 1a95f50f258 rdd
    3⤵
    PID:4112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5076.11.251516818\795415515" -childID 9 -isForBrowser -prefsHandle 6264 -prefMapHandle 6252 -prefsLen 26873 -prefMapSize 233414 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b970f0b5-fdf4-4e71-9f27-cb550025c579} 5076 "\\.\pipe\gecko-crash-server-pipe.5076" 6272 1a94bf63558 tab
    3⤵
    PID:5392
- - C:\Users\Admin\Downloads\venus.exe
    "C:\Users\Admin\Downloads\venus.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1892

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
28KB

MD5
96956102ceca45f3b357914028eef0c2

SHA1
c82736020142c1a5756a1d68ba12527f25ee6569

SHA256
0e5fce998d40720fba69d623bab36d8e80fac620ef3a2965ef4680c8bf60c3a0

SHA512
06cd405fb3668d1b8ee71236cf1d77e3d7807a5da74924708ed324a7e15f62bf86be885574f9e9bde96bbede48e81ff8b0bf9052facf08d375f6ac66f75e6f0b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\26279

Filesize
13KB

MD5
2aacdfd9a4900340fc930a1d79b3cd2b

SHA1
7dd9eecda194b88e13f316c786faebc56a959416

SHA256
d65901aacdcaf513d27352d059a2f87d175a2a58cb8abe38531ab21e838af901

SHA512
8c7df90c881f3059ff8ce5b7d770eb1896e461d0ec39c177031258ae34cd68e2f2edaf2550fd4a9d9d1814c044b3424b3733ba458697cc86334161ccddf644fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\B422FAE3EDCF9E0613D3AD812460BCC66E95FA56

Filesize
144KB

MD5
d30a253e0c5d543edfe0c6d68ad0af33

SHA1
577e62ff6ddefbf8396c9460e765950d4d59f3f5

SHA256
ca7774f6f701e2a2b0ed1a288f5a734920368b5e6b4b20a531f43ba7099701c5

SHA512
c64483b51898e0c23971475608a54c427dd07dbe8a327b86c61bfece51e2f59b53fe30a612c231e122996fb26b3cc5be8770ef5b6c1aed825e88aa6084c3baf2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\CU5LRROO\www.mediafire[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\CU5LRROO\www.mediafire[1].xml

Filesize
246B

MD5
ce242284f7553ea83509963714342e6d

SHA1
12bd9cd126663499eb36e04213c158ed91e5bcf9

SHA256
d1acd4eef82921d622f0cd39916716428e770e29c7e39b85a112234e9c1c5669

SHA512
7a1300d1303434451b331283c33acafbd55b294af26e9ccdb2d3859b9042bf9cb4bef25234a3e4cb3ae73f74ba2bc4e488db5462952253b9e4ceab9b91ef4f3c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\FENWGYKS\favicon[1].ico

Filesize
10KB

MD5
a301c91c118c9e041739ad0c85dfe8c5

SHA1
039962373b35960ef2bb5fbbe3856c0859306bf7

SHA256
cdc78cc8b2994712a041a2a4cb02f488afbab00981771bdd3a8036c2dddf540f

SHA512
3a5a2801e0556c96574d8ab5782fc5eab0be2af7003162da819ac99e0737c8876c0db7b42bb7c149c4f4d9cfe61d2878ff1945017708f5f7254071f342a6880a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF72993B7CB9D2F25E.TMP

Filesize
16KB

MD5
8d6797a345173eeb11e9d3534c8b695e

SHA1
f075067190cd50f8e1e601dc6bc048aef0325196

SHA256
898cbdbc2d0c5c95e042b768cfbaea404523f37ddcb77525f4b7a7487d61f9e2

SHA512
1f901228904d94e060986c34087f1da4bac5c54feebdfc0f7ca9f2423af27ab7c0a96ac65ab46877007a80740f203afa754d922e138088761a1637867281b8b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
63e5fc19a0e34a0533692183397441db

SHA1
7a74c64805466ea87e35be11fdae7b993107c5be

SHA256
79cc29e45a76a176ae149640fecd1eab7dfb27939f57488e8e94c2a87882f295

SHA512
494df81ce88957d0f19cd8da811af2bc30b9360e55b85f2ec0119696b3d6eb1b430c1705982d514cd501ab0f9de2e72f8cb07b8a3c6b1524513027cbeb11c193

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\e82dbec9-0a05-41f6-b42b-49465ec31da9

Filesize
734B

MD5
cc145fe40e8c424188b1169fe7cdc2e6

SHA1
490d939ef2ffa88898615a6abe05140c591b9eee

SHA256
44bc64cc4e46096f67be235b152ecd3bc68398df569289b7d99b619551738e18

SHA512
cb1dc7368b2a2cdde4c326b6466a0fad74745fdb203bf37cfb66712daab83646f3b9bc5744850ea6f3b60a8121344d865791b305ebd7d1d148b59b2f3b3c7439

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
71a869b2358e142e1ceee97decf508e5

SHA1
b731eb3551fe6b9cb2440aa2aaf9ff336b68346c

SHA256
463da76b890be76350e50bf4a655daa14fd382266ac51a2b9eb3f7deeaa1a6e7

SHA512
a65e6ceba7af0f6a484ac65337db0a57aa814fff4e3d39b1eb7871676f23df5e680e3c19fd19b4a88a0dee701a3cc96888b5f418d559587813f9a36ac047521f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
dc3073eeb013f8ba30e13bfc8f1e47c7

SHA1
b63ac6e73c5381548fead4ae61525c821c43f81a

SHA256
8807773189a7009fc75e08d86081de4c6c53a9608234148efc36593fb10bbf15

SHA512
ac79cd8a85098042de234dc747b903a7a04e47f288aa16f34993fb7a479c6d140e60a2cab34889f24f8c612c13068ffc60259d6635e2987eae29efdca5a4acc4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
878c53a207d62c8108896425b197ba98

SHA1
311339ffa54e8e3a0e291f64dc0d3f4dc5159b06

SHA256
133fee8e346b125e84d4b227195bd4789fb61c185ceb4f6a19d1318468400b31

SHA512
2f03b83a008f619a9c4d31df998ea63ec86c434c3e1bf766219764ac3396fdd63f56d5322c59585d08e375ca379a084e13bf366e6d922902b900ecf58e4c560e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
58fc192acde07e4c7710f3e39549f885

SHA1
484874753f0320a53e2656ba0f794bb639af25a6

SHA256
8700a582de8abe74c9db570c3495a658031b24c01f532def1ad0723c68e1a921

SHA512
a4587ff5b65d5aa44f803c0e2a67e0c6ad2a0efbcb4b3c3e6c52b0509515981e967ca3e269dd8f151d286aa2e9a6569223b45003bd872618d837c0e14d9ce06c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
4cdbf1d9b5c269cf68b43e40ac2cf50b

SHA1
acecc58368ba1d4487c25ab1b7d64d956d386b18

SHA256
75bb5ff7c0f46ab98cca2db60b8cb4b317654706c7c395c3cbafb0e8ed5f515f

SHA512
40dc79db058e6398fedfe8c1cd123e9ea9acd34460a05defc81fb661da9387d95caecd15965dc045f45ac4ab33fca575675de7fb7d6840287e7fdf6b6d9d8643

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
d60c4a9c73707836819ef256eccbfc3b

SHA1
065db9abfd815d358b86aee225f21e99993b111e

SHA256
afe90913e36dddbb4ab817fa862129bca3728c9c9b9754ecec153d388c739409

SHA512
b631cb82126a44897662f561be76cacad02651b4174769724b7be2c4910222d8aa8b91218b8f003175da34a73f51df046bde84874c44877ef3069359010789a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
4548819708a438034575bbc2cb4ab781

SHA1
92512a1ffebf5ff1d8192e353208748a39399c81

SHA256
7528ecf715b8e6045a4ffb2e9e8f41888be6d3c1788fef7d39bf190b68d81174

SHA512
93824c0a643382b9cdd09d5cf91a6943b027058ca611105394d91147631ef36f219a594aa840a426920fdd479279a42b4a7fc718d5d9bfa14be0801731b63323

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
2b8a8d30e57b5cdc12029303e435621c

SHA1
bb07ef10ea04da3a179f3e4b319db44de038c7ca

SHA256
c8d78709bedb8c59b15b6d52e53bcbe6725aed216880bddbf9aca9ecb20f4d4a

SHA512
856304444f7ec2c70db5b9506bf147f825b327a311edc1925144324d45ff0b09fd1629e88ca6040fdc6f5f6d63cd402dbcfe325562ffa9102b38a01365a0d378

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
a0a19d56104200b1291fcf09b8316028

SHA1
6e1ed9555e2f3a36fce7017bea6ac4623ede2656

SHA256
bff3bbff290456017545e6e04c5c967f9a44075541ed84eabc499e020dbe4469

SHA512
c5b1925ed2cf1af846e674d9606d3c2e4653ea3474ac957e6bb42b78087e5a4c99f43e2a203fcfd62582b7f1d7c6005bf4f194f4c73143e8bd6efc7ff4f7bac4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
6fb529a6040edced72255baf206751b3

SHA1
d86a9e27b28d30d06bf0134fc1f1dbe1c8eddde2

SHA256
0854a410ae1d03645fb10f650df8a76657332b00ebb80a86b3a2167e305fa970

SHA512
b62f30ad4cd0801c044258e0c16ffce4a945f4f94b1352caa03aa5639c0d7efc971e6b32bdac81eeb79d02715dfa4deec490f2e385f00b40008edaa6addc4020

Download Submit
C:\Users\Admin\Downloads\venus.exe

Filesize
13KB

MD5
799db11cbd73e355902ca0e9611a2055

SHA1
98cdb0ecc8ea2dbba95b99bd73a6f6a357123216

SHA256
794f4075e654255924fd2c50051127786ef5fef1fb57bb7e216ade23044d9873

SHA512
5d6920fa75c2723e03cef6ee9575948fa445db6e3ea5d90ea8ae366fa9e25f31c6e44e327e0812c570fa6c31f9fe714aa5a078eddfdf0dc42dccbfb5f404e2ba

Download Submit
memory/520-186-0x000001DAF2CF0000-0x000001DAF2CF2000-memory.dmp

Filesize
8KB

Download
memory/520-191-0x000001DAF2E60000-0x000001DAF2E62000-memory.dmp

Filesize
8KB

Download
memory/520-68-0x000001DAF1810000-0x000001DAF1812000-memory.dmp

Filesize
8KB

Download
memory/520-66-0x000001DAF16F0000-0x000001DAF16F2000-memory.dmp

Filesize
8KB

Download
memory/520-335-0x000001DAF4B40000-0x000001DAF4B42000-memory.dmp

Filesize
8KB

Download
memory/520-140-0x000001DAF26F0000-0x000001DAF2710000-memory.dmp

Filesize
128KB

Download
memory/520-189-0x000001DAF2D00000-0x000001DAF2D02000-memory.dmp

Filesize
8KB

Download
memory/520-193-0x000001DAF2F00000-0x000001DAF2F02000-memory.dmp

Filesize
8KB

Download
memory/520-202-0x000001DAF2FF0000-0x000001DAF2FF2000-memory.dmp

Filesize
8KB

Download
memory/520-200-0x000001DAF2FB0000-0x000001DAF2FB2000-memory.dmp

Filesize
8KB

Download
memory/520-232-0x000001DAF4520000-0x000001DAF4620000-memory.dmp

Filesize
1024KB

Download
memory/520-224-0x000001DAF4AC0000-0x000001DAF4AE0000-memory.dmp

Filesize
128KB

Download
memory/520-198-0x000001DAF2FA0000-0x000001DAF2FA2000-memory.dmp

Filesize
8KB

Download
memory/520-196-0x000001DAF2F20000-0x000001DAF2F22000-memory.dmp

Filesize
8KB

Download
memory/520-64-0x000001DAE0EF0000-0x000001DAE0EF2000-memory.dmp

Filesize
8KB

Download
memory/520-184-0x000001DAF2C30000-0x000001DAF2C32000-memory.dmp

Filesize
8KB

Download
memory/3572-470-0x000001FC5A960000-0x000001FC5A961000-memory.dmp

Filesize
4KB

Download
memory/3572-252-0x000001FC63E60000-0x000001FC63E61000-memory.dmp

Filesize
4KB

Download
memory/3572-35-0x000001FC5A970000-0x000001FC5A972000-memory.dmp

Filesize
8KB

Download
memory/3572-0-0x000001FC5D420000-0x000001FC5D430000-memory.dmp

Filesize
64KB

Download
memory/3572-253-0x000001FC63E70000-0x000001FC63E71000-memory.dmp

Filesize
4KB

Download
memory/3572-16-0x000001FC5D520000-0x000001FC5D530000-memory.dmp

Filesize
64KB

Download
memory/3572-463-0x000001FC617D0000-0x000001FC617D2000-memory.dmp

Filesize
8KB

Download
memory/3572-466-0x000001FC5A9C0000-0x000001FC5A9C1000-memory.dmp

Filesize
4KB

Download
memory/4648-45-0x0000022D60700000-0x0000022D60800000-memory.dmp

Filesize
1024KB

Download
memory/4648-44-0x0000022D60700000-0x0000022D60800000-memory.dmp

Filesize
1024KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads