Resubmissions
20-11-2024 21:40
241120-1jfrjaylhr 1020-11-2024 21:38
241120-1hfedavbrn 1020-11-2024 21:37
241120-1ggwtayleq 1020-11-2024 21:32
241120-1drlvatcna 320-11-2024 21:20
241120-z647zatbja 8Analysis
-
max time kernel
74s -
max time network
75s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 21:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win10v2004-20241007-en
Errors
General
-
Target
http://google.com
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe" NoEscape.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" NoEscape.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini NoEscape.exe File opened for modification C:\Users\Public\Desktop\desktop.ini NoEscape.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png" NoEscape.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\winnt32.exe NoEscape.exe File opened for modification C:\Windows\winnt32.exe NoEscape.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NoEscape.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "232" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2156 msedge.exe 2156 msedge.exe 1956 msedge.exe 1956 msedge.exe 3196 identity_helper.exe 3196 identity_helper.exe 2252 msedge.exe 2252 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
pid Process 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe 1956 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1548 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 4924 1956 msedge.exe 85 PID 1956 wrote to memory of 4924 1956 msedge.exe 85 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 996 1956 msedge.exe 86 PID 1956 wrote to memory of 2156 1956 msedge.exe 87 PID 1956 wrote to memory of 2156 1956 msedge.exe 87 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88 PID 1956 wrote to memory of 2100 1956 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb03046f8,0x7ffbb0304708,0x7ffbb03047182⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:12⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:2692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:82⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:12⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:12⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:12⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5868 /prefetch:82⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,1210817500887562405,6326034381447326690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2252
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4952
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:748
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.exe.zip\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_NoEscape.exe.zip\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4936
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38d1055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1548
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5bffcefacce25cd03f3d5c9446ddb903d
SHA18923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA25623e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7
-
Filesize
152B
MD5d22073dea53e79d9b824f27ac5e9813e
SHA16d8a7281241248431a1571e6ddc55798b01fa961
SHA25686713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA51297152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413
-
Filesize
215KB
MD5e579aca9a74ae76669750d8879e16bf3
SHA10b8f462b46ec2b2dbaa728bea79d611411bae752
SHA2566e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf
SHA512df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5b34f66d19802b532d93eb7b06a662480
SHA13c5390f6d86db170c51e29159dfcd90aa4d9473c
SHA25652976e6e4969a9db18f857cfb24bf10e7a427aaed73c7338feaa63f998d855f5
SHA51280fda0c4300f971881ad05cd270f769a6fec31eecf2cab8113f19bca6a36a1e1970a105c04e7e6bf08747e06fa58a2fdd21dd24f53bb1cecb8dd995bcc421b38
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD51595ae0b949813648484b513679978a9
SHA1a720a00509a5440410c4913f704b833474f7b496
SHA25690d73f3ef540c9eb17f8017f346879e0c8581caa9411a096e6c05143c05a4d40
SHA5124ea6a81c79a6d665f7dbb1ed3671a3a7293edf1cc9909fffef3ab465cff88bd7328b6f571cd03760ee1f1df7606ed2cb97f6d5d3a82e86bcf839eb53fa45f75c
-
Filesize
5KB
MD5d167071ecb1bba1c2cea10548376173a
SHA1a475f443f0ccf2285b89c7e06051d4779fd1c8ea
SHA256abf374c50d38aa859a3b9d680246fc20fc873cd07958308a21eb7c20d119eca2
SHA51278589fb64ee213fbecf51c8c36b7c10ac3e789dda72bdfd093f5315819f2d49029333d8ec053ad48f9f042ed5e413bd56cf93c29164b0df32bc5a19ef8e5d269
-
Filesize
7KB
MD5a6b4d88fe1f643bfb690d397a2118a36
SHA11cf415611dc8bb720d175dcafa4aaef1f0a11b30
SHA2561de6fcebb490501dd2cb061fdcbf15dedbebb1eeaca95e70b6123cca10724369
SHA512a6375cd00adce89507eaa2ab09ec1c13b718eef3c233af3efa071c9f213a4fbaa83b0f39b7d805cdb31793123ac52f5d3a0f70e9918ad213944f60ceecb3dda2
-
Filesize
7KB
MD586c04b55b40b0ebc99a8d42675d2f82e
SHA1bc401f9acd94185b9a1a1b51cd984299f96c8b8d
SHA2568aa5939a413fc3ef0a7499f61146272f5ced42d55a730cd067f6521463f39c03
SHA51268c1b879e8f842408ebe80013e644852c6856b2ec7894f61b608122e1970dbdb68b9cec79d892ad3478a76fbd1f08f7bf5ccc92e0e576ec82a8999d0bafb3c44
-
Filesize
6KB
MD562f39318cd0c3efb9d8b2c65ed8e5431
SHA1d060a2facb2e3f49f8fb5fe0aae5df9cb3d7207a
SHA256b1086a4fdbfe6fd374df3882dc807865a910fb65e2a5119936d27bed56ba0337
SHA512960ec3bdd32fd151243e6cb8a651b5fd6024fe198c6b64e6e440b3ea6b9a0cc095ac21781a0f0686f2f5d9075def15b81fe75cf234a3c8c6461bcbf61f56991f
-
Filesize
1KB
MD555c487916f981eb600870a88f068bbd3
SHA1fe0bf6a86dbfd645c81f4cb9b32fb91c7a3c7e64
SHA256260401cc039c30d384db30fd7d7f260265be83cfba6dcdc3cccdb2cad7594cdc
SHA5123f2c94a296e8ce4be2d2990798685c07a490141fda2ffd951db73fd06c8edbaf623b1042a3ac292c7c061dae2263bcfd478f724c1336ff224379ffc1d885fbd8
-
Filesize
1KB
MD5d88570aa08bac2d8f64203c0e1444e7b
SHA10f80d02f29ebe62650a4cd9419047448d0a5a9ea
SHA2562e292086fbf353964eb250a4d39d537f25fb685b26377fc408f0f0b4151a8d2b
SHA512e0bf0398aca7d3a07b263540366ebbf9138d87cb7fc449f84898a90380b33359dbb6712bf83f2faf2b4e1f4b6d386f7e055181b02a984a0a8ff2e84bcde6869a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a5c81441c0fba0011fa7244761b70611
SHA1b916951c4ae0c9eecfeef0eb761de2e45dafa748
SHA2560fcb3b8e38d8f3932aeb0a04cac0523e22f08cb1c6279304a1ea4d41bc839de4
SHA512d3822d141836228fc64442875a8905a792c77af124a1428553861f9b0a5880163afb344486f1765cce7cffc4f6269228f8c918ece3ca73e81103571b82a9f12d
-
Filesize
10KB
MD5716c7872ebf31b4299eb01b2940acc0e
SHA1706e4607998d1e2ccdb7c3dd42b492810bd5307b
SHA2566b11b1ecd6e3b936895bd2a383b663b63e75c975b4c9dbcd62013cb013fd76ef
SHA5129df51cb6bf0b129a3cc7db250a2f714f18a94c308d49d0eca67c87b1f63efa578c8c54b5227e46459f5f03817dbcdb805e02104f09e8a884d27a5fbf84ce2112
-
Filesize
13.5MB
MD5660708319a500f1865fa9d2fadfa712d
SHA1b2ae3aef17095ab26410e0f1792a379a4a2966f8
SHA256542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c
SHA51218f10a71dc0af70494554b400bdf09d43e1cb7e93f9c1e7470ee4c76cd46cb4fbf990354bbbd3b89c9b9bda38ad44868e1087fd75a7692ad889b14e7e1a20517
-
Filesize
666B
MD5e49f0a8effa6380b4518a8064f6d240b
SHA1ba62ffe370e186b7f980922067ac68613521bd51
SHA2568dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
SHA512de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4