hxxps://se7en[.]ws/files/7l_elden-ring_setup[.]exe

Analysis

max time kernel
62s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://se7en.ws/files/7l_elden-ring_setup.exe

Score

8^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1988	netsh.exe
2476	netsh.exe
984	netsh.exe
2652	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	7l_elden-ring_setup.tmp

Executes dropped EXE 6 IoCs

pid	Process
2376	7l_elden-ring_setup.exe
2756	7l_elden-ring_setup.tmp
344	Run_EldenRing.exe
3880	Run_EldenRing.exe
1560	Run_EldenRing.exe
4312	Run_EldenRing.exe

Loads dropped DLL 1 IoCs

pid	Process
2756	7l_elden-ring_setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Run_EldenRing.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Elden Ring\inf.ini	Run_EldenRing.exe
File opened for modification	C:\Program Files\Elden Ring\uninstall7l\unins000.dat	7l_elden-ring_setup.tmp
File opened for modification	C:\Program Files\Elden Ring\Run_EldenRing.exe	7l_elden-ring_setup.tmp
File created	C:\Program Files\Elden Ring\uninstall7l\unins000.dat	7l_elden-ring_setup.tmp
File created	C:\Program Files\Elden Ring\uninstall7l\is-T6U8V.tmp	7l_elden-ring_setup.tmp
File created	C:\Program Files\Elden Ring\7launcher\is-5DGS0.tmp	7l_elden-ring_setup.tmp
File created	C:\Program Files\Elden Ring\is-PH00C.tmp	7l_elden-ring_setup.tmp
File opened for modification	C:\Program Files\Elden Ring\7lcfg_eldenring.ini	7l_elden-ring_setup.tmp
File created	C:\Program Files\Elden Ring\uninstall7l\unins000.msg	7l_elden-ring_setup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Run_EldenRing.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Run_EldenRing.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Run_EldenRing.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7l_elden-ring_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7l_elden-ring_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Run_EldenRing.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3996	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\	Run_EldenRing.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Run_EldenRing.exe = "11001"	Run_EldenRing.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\s7keldenring\shell	Run_EldenRing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\s7keldenring\shell\open\command	Run_EldenRing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\s7keldenring\shell\open\command\ = "\"C:\\Program Files\\Elden Ring\\Run_EldenRing.exe\" %1"	Run_EldenRing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\s7keldenring	Run_EldenRing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\s7keldenring\ = "s7keldenring URI"	Run_EldenRing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\s7keldenring\Content Type = "application/x-command"	Run_EldenRing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\s7keldenring\URL Protocol	Run_EldenRing.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\s7keldenring\shell\ = "open"	Run_EldenRing.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\s7keldenring\shell\open	Run_EldenRing.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 291135.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
2320	msedge.exe
2320	msedge.exe
1752	identity_helper.exe
1752	identity_helper.exe
3984	msedge.exe
3984	msedge.exe
2756	7l_elden-ring_setup.tmp
2756	7l_elden-ring_setup.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3996	taskkill.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2756	7l_elden-ring_setup.tmp
2320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
344	Run_EldenRing.exe
344	Run_EldenRing.exe
3880	Run_EldenRing.exe
1560	Run_EldenRing.exe
4312	Run_EldenRing.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2340	2320	msedge.exe	82
PID 2320 wrote to memory of 2340	2320	msedge.exe	82
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4416	2320	msedge.exe	83
PID 2320 wrote to memory of 4468	2320	msedge.exe	84
PID 2320 wrote to memory of 4468	2320	msedge.exe	84
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85
PID 2320 wrote to memory of 4560	2320	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://se7en.ws/files/7l_elden-ring_setup.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda94d46f8,0x7ffda94d4708,0x7ffda94d4718
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,12372444249537735877,7203261440341916238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Users\Admin\Downloads\7l_elden-ring_setup.exe
  "C:\Users\Admin\Downloads\7l_elden-ring_setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\is-04K79.tmp\7l_elden-ring_setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-04K79.tmp\7l_elden-ring_setup.tmp" /SL5="$901F6,2308482,959488,C:\Users\Admin\Downloads\7l_elden-ring_setup.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:2756
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /f /im "Run_EldenRing.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3996
  - - C:\Program Files\Elden Ring\Run_EldenRing.exe
      "C:\Program Files\Elden Ring\Run_EldenRing.exe" - forceupdate installp2p
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:344
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c netsh advfirewall firewall add rule name="7Launcher P2P In" dir=in action=allow program="C:\Program Files\Elden Ring\7launcher\tools\aria2\aria2c.exe" description="7Launcher P2P In" enable=yes profile=any edge=yes interfacetype=any & netsh advfirewall firewall add rule name="7Launcher P2P Out" dir=out action=allow program="C:\Program Files\Elden Ring\7launcher\tools\aria2\aria2c.exe" description="7Launcher P2P Out" enable=yes profile=any interfacetype=any & netsh advfirewall firewall add rule name="7Launcher - Elden Ring In" dir=in action=allow program="C:\Program Files\Elden Ring\Run_EldenRing.exe" description="7Launcher - Elden Ring In" enable=yes profile=any edge=yes interfacetype=any & netsh advfirewall firewall add rule name="7Launcher - Elden Ring Out" dir=out action=allow program="C:\Program Files\Elden Ring\Run_EldenRing.exe" description="7Launcher - Elden Ring Out" enable=yes profile=any interfacetype=any
      4⤵
      PID:2352
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="7Launcher P2P In" dir=in action=allow program="C:\Program Files\Elden Ring\7launcher\tools\aria2\aria2c.exe" description="7Launcher P2P In" enable=yes profile=any edge=yes interfacetype=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2652
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="7Launcher P2P Out" dir=out action=allow program="C:\Program Files\Elden Ring\7launcher\tools\aria2\aria2c.exe" description="7Launcher P2P Out" enable=yes profile=any interfacetype=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1988
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="7Launcher - Elden Ring In" dir=in action=allow program="C:\Program Files\Elden Ring\Run_EldenRing.exe" description="7Launcher - Elden Ring In" enable=yes profile=any edge=yes interfacetype=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2476
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="7Launcher - Elden Ring Out" dir=out action=allow program="C:\Program Files\Elden Ring\Run_EldenRing.exe" description="7Launcher - Elden Ring Out" enable=yes profile=any interfacetype=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

C:\Program Files\Elden Ring\Run_EldenRing.exe
"C:\Program Files\Elden Ring\Run_EldenRing.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1524

C:\Program Files\Elden Ring\Run_EldenRing.exe
"C:\Program Files\Elden Ring\Run_EldenRing.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1560

C:\Program Files\Elden Ring\Run_EldenRing.exe
"C:\Program Files\Elden Ring\Run_EldenRing.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Elden Ring\7lcfg_eldenring.ini

Filesize
79B

MD5
b64b5492b5281f49687afd92b8625d71

SHA1
4c09af568016a883f4acc0b652de8c548416dc58

SHA256
f9ab97f78c49f6a13f8684adf59a53f69870275540a4f18de445eb8c3d668b6d

SHA512
4b5a7f258f401e30eccbb78d4efd91c6dfcc61af5af5faf199f973038d217bc0b879fe868b912e4f072ef2036f3cdf296123f8b837123564dbda54944734256e

Download Submit
C:\Program Files\Elden Ring\Run_EldenRing.exe

Filesize
3.8MB

MD5
704d37afd796938be330767397dae59c

SHA1
b7ef2ffbde460c8397a5c7f010328967cf792b90

SHA256
944e0a5a5d5b94b016cb87bf11185d5929f7bea9648bc4e22525769f4c95ef4e

SHA512
7d04c51a06ec2535f7ad73b63cfd6c38699364768c45ad39796611d0bf0f0a2d7afdba3fb1c105ca6f576e63ec8c43f37a033315d2b90eeeb3fc114f2fc945b6

Download Submit
C:\Program Files\Elden Ring\inf.ini

Filesize
1KB

MD5
87f4870ae2e7f8529487bdb002eaa59c

SHA1
a7045fa4cf4b6b80c5f3d10b484b58bb5934b3a9

SHA256
93e25b6b16fcdddd1266c896b2b8c314286d1e5fc2de476c02d8aedc25cfe4e4

SHA512
8ffc9670b0127e06c91f60d50ae8099dffe96dd834dbf160a1b048ce42026ad420cd7012fb29aa9dd35ba2835cdfffa540cbd1c9fe1fbcff0580ebf462fe1dc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
176B

MD5
f373705580e4a9dfaf06307969729441

SHA1
2a173f163b7032f193ed0fa58c3681adf3f8d69d

SHA256
dd1330d69391952df2e0e07076642633a53dc939472a81855e49f94c2c2b9bde

SHA512
a811ab6b9a4e610fbecb21d94dcea4853fd15318f6a8a0ad38afca710d17b5f4f3b3ce69f1e532c40ce7afbd3eef95452dad66b146848589a7ba9c4d7bcfa474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c81e7ba53cd28999b4437bc159d612e2

SHA1
9f602fa69cb4c2d1e67642bd78e858749ee20d62

SHA256
f09119981e2c870a1701c35c9551fc4f534ebd8e005445a435700ea9d93bed3b

SHA512
30d42a29cde919702535a7c04e87c2c7a5681ad1818f070926890299bfba41c11629c129d4eaf8dc939cfa2086a1d40e350dcaf3ea1e0c828594fa805a7cf8ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cddfd11a07e235b1b235aa989795c833

SHA1
71cea5f0e063f684024cda52b1b9b80bce118b28

SHA256
3560d3a1082a9260f61bb653f08a0723ec97c89cf56d49d90e6ae956babed7d5

SHA512
4df7df2e6f18dcbbcfb6c9c84d774839a037e66892f03eb3e5a495d8e6287c3a3616455586c0e9223b094c20c156f3345f665fdbffc05873a947a6d06136adde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0124745e56ad88c496c713c5a57d892e

SHA1
b8e4a9348f7431aa305f40bf638a8977fa87d189

SHA256
6a8bc6b227a8fb48b0ef494c565c13de7c41cee875d5d47f535da388722afddc

SHA512
1d23ff884f7836c783b03cfdf4340f86997e8079f6ec1f104f257b8b37972054748e45e488c6acb5657bae82fc517d13e0f13ca2be6db5736b6431d2df8abe6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c2cb0ae639a6f3b47c9212f56bbbf415

SHA1
0ed8f45cb7acfa6bd84d1faf028ef985af15fb98

SHA256
5d4b635d2f325be6cff05cb07e0df3a61362eac1182faefd16a6d3a8e3786481

SHA512
fd57b92257557ed7873608e51e4847eee122f3ed2c6d04ee53bfc636001bc3272af669c0d31cc620c9455f98f83c083e7c043de1d8654939a4cb0845054bc668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4ed59c602667127102062fed6906e49e

SHA1
44ae47aa0dd7f84e1d8b8f9a0bd238bb5bad87e0

SHA256
eb4227ccd5807bee2e376492bea95506e48ec4eeaa37056d6b6d7690af465a25

SHA512
283b4bfd9b9023bc4f29817f1448dc751989afcb899988095cf5cae4793a16072d5423e5b4016919740625fb8f01adea0248a7f48f3ced9a00e3e615bdfa92cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b7e56a966c1643c539b650e5620bd8d8

SHA1
c12161fa81b1c8332f825391cc65e7195f4b8892

SHA256
993fc49cafc44799c9b827cd3ea519ec86c78f37eb31da6d7066caf55a65d690

SHA512
ad729bee9886089ad99c9a8b655ec3eecba9ca5197edfec2f2d935474d42b5ca3bdfcb8d6f277a476790e20dfd3c76487efa800f26132bb6215154d84d544aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-04K79.tmp\7l_elden-ring_setup.tmp

Filesize
3.3MB

MD5
017d6aab3be733706d19fe94e7aaba92

SHA1
a82580df3b8b4bd6a63cbfeb872bc2f217010f73

SHA256
6dc6844d3f09373a49cf5b435bdf0ce555e4f766c7c3dab5c975a6bf21fc075b

SHA512
d424fb7d0acaa7afd06bf5299ed836984815ae52f0a4a1142c21c9ff3db18cccaaea55a57726541ca6534a66ea00b4b3dee38cb900d963abbd373e3ff464db59

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PU6FJ.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 291135.crdownload

Filesize
3.5MB

MD5
4a4c44bb166fb29c151739a56bca58f7

SHA1
c9326d1d20397e98a9ae253c4c10ef8c46ef76fb

SHA256
b0ac9707d8ae944f2f1a964ddf698feb0552b0c87ed0590859faada6919f3bc9

SHA512
efc41f2ef1ba84fb9b93a150ae795397a3a9338be4f4916e8d4b82d4cc0cbe6a1c6541fdcd5ffd6eb07aa6cbb4b4bdb517c9c4f156006fe8efd8ff7ffadeb6d8

Download Submit
memory/344-273-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/344-271-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/344-276-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/1560-278-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download
memory/2376-170-0x0000000000FA0000-0x0000000001098000-memory.dmp

Filesize
992KB

Download
memory/2376-91-0x0000000000FA0000-0x0000000001098000-memory.dmp

Filesize
992KB

Download
memory/2376-145-0x0000000000FA0000-0x0000000001098000-memory.dmp

Filesize
992KB

Download
memory/2756-169-0x0000000000A60000-0x0000000000DB7000-memory.dmp

Filesize
3.3MB

Download
memory/2756-146-0x0000000000A60000-0x0000000000DB7000-memory.dmp

Filesize
3.3MB

Download
memory/3880-274-0x0000000000400000-0x00000000007D4000-memory.dmp

Filesize
3.8MB

Download