hxxps://drive[.]usercontent[.]google[.]com/download?id=1TvnG5yOCYWOrPHBn0xhbHZTcgJKAJjIk&export=download&authuser=0

Analysis

max time kernel
120s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://drive.usercontent.google.com/download?id=1TvnG5yOCYWOrPHBn0xhbHZTcgJKAJjIk&export=download&authuser=0

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
5368	Install_Xfer_Serum_121b4.exe
5368	Install_Xfer_Serum_121b4.exe
5368	Install_Xfer_Serum_121b4.exe
5368	Install_Xfer_Serum_121b4.exe
2200	Install_Xfer_Serum_Update_121b4.exe
2200	Install_Xfer_Serum_Update_121b4.exe
2200	Install_Xfer_Serum_Update_121b4.exe
2200	Install_Xfer_Serum_Update_121b4.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe

Drops file in Program Files directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Resources	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Resources	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Resources	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Resources	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install_Xfer_Serum_121b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install_Xfer_Serum_Update_121b4.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Install_Xfer_Serum_121b4.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Install_Xfer_Serum_121b4.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
1352	msedge.exe
1352	msedge.exe
4744	identity_helper.exe
4744	identity_helper.exe
5580	msedge.exe
5580	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5368	Install_Xfer_Serum_121b4.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6104	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 3584	1352	msedge.exe	84
PID 1352 wrote to memory of 3584	1352	msedge.exe	84
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3984	1352	msedge.exe	85
PID 1352 wrote to memory of 3952	1352	msedge.exe	86
PID 1352 wrote to memory of 3952	1352	msedge.exe	86
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87
PID 1352 wrote to memory of 3428	1352	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.usercontent.google.com/download?id=1TvnG5yOCYWOrPHBn0xhbHZTcgJKAJjIk&export=download&authuser=0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd38d46f8,0x7ffbd38d4708,0x7ffbd38d4718
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6220541264797744183,14907159302298057393,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5736

C:\Users\Admin\Desktop\Serum Full\Install_Xfer_Serum_121b4.exe
"C:\Users\Admin\Desktop\Serum Full\Install_Xfer_Serum_121b4.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5368

C:\Users\Admin\Desktop\Serum Full\Install_Xfer_Serum_Update_121b4.exe
"C:\Users\Admin\Desktop\Serum Full\Install_Xfer_Serum_Update_121b4.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2200

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Serum Full\Serial\Key 1.txt
1⤵
PID:4840

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Serum Full\Serial\Key 2.txt
1⤵
PID:2140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin

Filesize
3.9MB

MD5
9e37cacd94563b54fc2bdc82697c992c

SHA1
cb9b707d74b296b400a86eb2c6f926284e1b4f5b

SHA256
e639d483c8cedb7fd81639e37c4dcadc425cbb482de4c7ff9e085067e6372ec3

SHA512
1fbd0f86cc8121212c7ff683d362b3ef6dfa2f4386c4f28077b6d193280d556bd9d0bca3428119014c70e5c3e0f74e9e895d133881ad7824ad2f183b537b3ea6

Download Submit
C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin

Filesize
4.5MB

MD5
79ba13bb4e6da966511e2ecb3c6f73f4

SHA1
3f7d20d64b91df916c4b2a615a1f4ac82bc3bb94

SHA256
b4e2d5c2accf2ec7586933ae36426c4f4c4c1a8f25be8c3a3a67a513d38c0a31

SHA512
e0c8d8bd1018d113040db417b42da6ef6a235b26d6af7843dbda714de42789130045f3c7cbf8070903ca84a617e1c1d03374c1d671fac4b21a87b378e8f5593c

Download Submit
C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico

Filesize
354KB

MD5
5592ec57ec7fd6c30d5d57af0461965c

SHA1
d9fb4aa7b76f4dad1cbed20e3c94724949e50608

SHA256
a7849a94cd1a1d4a9a59e8e1351449c726fc73a8ea1ee3aed3d9d5c200131807

SHA512
524d183bc4c6b7d93a5005de7707be59680a82ddf97d4a9fdc2601dc43b341666df348bef7ab1bfdf8d5b8faaa1cee5b1b536c453cea5d88500b61841ea47b0a

Download Submit
C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini

Filesize
126B

MD5
798095cd31340606c8e81d0a5107d57e

SHA1
39d058c4d45ef84b188f7ece620106124eb3d74e

SHA256
5526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83

SHA512
9ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
602B

MD5
5bca7af131f4974ef041d38d4f3dc979

SHA1
56afafeb4d695c9d6d957908e266b9275b575010

SHA256
ec7acd24ede94e34c738e14b5aac6b1771a6dc7e5d354025fdb1755834bc1030

SHA512
2fafa862084264586948ce4c0bc3d3326c6680bce0046f9fc469abab63c38d4ee798e5e929861b35b9e2033476490a9e2581a7ae033fb02a1b2131732aacaf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
22cf697bdae8af08a98933aa879d5317

SHA1
8694f4f55325ef07a1e0e3e23a5245e7f5fc5226

SHA256
17b2d786169408ff02dc4f8500469d73e6df8df5560f2cc74a87cb770d7cd8e4

SHA512
106ca09c5b4434d644d4d0030181d519fd4334da4002123c0611b55f098b70e98250c4be06372bd09da075409a871dac89f6f05e45b428fa5e404faa0a0b6ea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77bb7c2027d4ff4edead584ee449e6d4

SHA1
f9cc789ca88b279f6bfa49c671b7c3b8633c17af

SHA256
8bb17d122f011166b6138e44589853ba986cab1ee7c30b5e028af06b0a4fedb0

SHA512
728ee84d487b1256c5716ec751f0b37b6dabcdbfedbbb250f1baf06686994adcf7a44c4ec00d5da774d9af38c6fec3ed2a8ef27bdf960ae315f9e529652cdb58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b31c6bcd571e161409983de61cc3622f

SHA1
6413e27852e2e3f9a1cda490e0182ed04f09748c

SHA256
928bf4c84ccf8b0ac29ce13862bf8c11fb58dc5236529360397a83ed3b9ba8c6

SHA512
10e4bc220464b3275d363f30bfd6ce815a4f4d1691d11937e0adc745b3fab00e3d631b164976b01d2b4e731e588d876efe028a259f327f917cab2e417dd5e524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
525721187bf9f73d9f98064413119f39

SHA1
7dffab5cf20bc0d053985907c8a62406e20c2aef

SHA256
b0bd0e6695deaccd59b042ab075cd12ea28730815fa799c8354253b760ee6858

SHA512
d0de1269752ef66b8d223e69f5d1a3fe661db46d4f357a0757bee2d2b3775482201edffe45f8c1f95c810c172f6e7361601c17678e278e3b4e5e35ac2df541b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c1edb0658f6a0919acd653e3ba86510a

SHA1
1d407f59b0bc88782162e6b7fa4626d179df4ce9

SHA256
b3fccc404289cc512bb4e02ed0eb583f801190d07cebade2621bcc96fafab368

SHA512
22b8d17f1bec8872acf657b8deab08576fdb7ab764059a01b81b435bada2e094ec705272eb5f56b7eb31bc790f98b8d559b26a25dd58ca79e0ebb40ebbc8c14c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b8cbb30e8c9d5ca0dbc30f672b534ef6

SHA1
622a9c57a0b3a9f432cacbaafdfa3b36f25379fc

SHA256
58d7c14252b6be2a9be661182fac067dcc964634d00298bb4978f8f6ad1e95d9

SHA512
8bc5eb8b6890b30a0f35f06c981df0b90ca2ef28c8ad3be50bea3377ef1ae53d30158ccf5a1afc9f77f8fbe348d29e76c6401b6868679b4e4d0dbc5cf6fb9328

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj5B7A.tmp\AdvSplash.dll

Filesize
6KB

MD5
13cc92f90a299f5b2b2f795d0d2e47dc

SHA1
aa69ead8520876d232c6ed96021a4825e79f542f

SHA256
eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb

SHA512
ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj5B7A.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj5B7A.tmp\modern-wizard.bmp

Filesize
150KB

MD5
fd944873f187518849e6e3336c45f968

SHA1
3ba4d7d455372a329eb44200ecdd2e3075869047

SHA256
54eec84988f8d5d5f1cdfefd74333dbcd85b1ff525b2b1f9cac6de9905cefe1d

SHA512
d2bbbc19e4114fc68c695664bf8c5ba4f04e96f24b002f4e37c8147f946c32c043a97723f6536c4a8895384a2c119fd2fb8042e3e27a16fdf55d4f779e0e1f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj5B7A.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEBA4.tmp\modern-header.bmp

Filesize
25KB

MD5
6a7dfbb00ffd72ef54b21f9664b67b53

SHA1
336b2cea8f8d82028e3587b6bb10ef06a2197450

SHA256
12c8ee2d311771db4e2734f25fa2edec27f57829226dff796cd61bea01c90db8

SHA512
bf5b3d24339c9f91c8d4261e1457a8e5ad4a44a0d34032e8415d636a81695fd2e3c61647e00044d61e9379bda9d1c83514cbfb1a77666cbc918d38cfc4f18763

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEBA4.tmp\splash.bmp

Filesize
900KB

MD5
237aa22aff8343665911c8615c4cbfdd

SHA1
d35067296d0fe72cb55e01793846165a0c3b9750

SHA256
ff1f661c015ff0cd9794f5b6cb81755f528c98c522203fcf69550f67d427ff4f

SHA512
6929a3230a4c3b9057ed6e3c5eac2ce9f6a2cf6c3b58bb980aed88006a014adcd591e6bccb5eacec26a016f3bf785d08527464d276d4ee314c3744f3754d3d38

Download Submit