bdaejec | d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
Size

2.7MB
MD5

37b5c009c69a10a13cc9a566bfd59207
SHA1

9d5fb6faa35f0ebeea941e2f206fa463a73fd1b5
SHA256

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3
SHA512

b008c035c3db830143d702f719001436c137d90a330c4666171173ec839c177b5eacb62cdc158287c0df14f58b22d902bd5090eb0c4bbc6179f1f3584a69216a
SSDEEP

49152:K5yaUm6/qD9dDqnroHO0ksLzZmLXpO9q+0Ollh1d2HObA3:K5zX9cnsHXLzZcZy0Orhf2Hv

Score

10^/10

bdaejec aspackv2 backdoor discovery spyware stealer

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Bdaejec family
bdaejec

Detects Bdaejec Backdoor. 3 IoCs

Bdaejec is backdoor written in C++.

Processes:

resource	yara_rule
behavioral2/memory/608-50-0x0000000000760000-0x0000000000769000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/608-141-0x0000000000760000-0x0000000000769000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/3896-167-0x0000000000C10000-0x0000000000C19000-memory.dmp	family_bdaejec_backdoor

Drops file in Drivers directory 1 IoCs

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

QFHoBh.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exeMicrosoftWindows.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	QFHoBh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	MicrosoftWindows.exe

Executes dropped EXE 6 IoCs

Processes:

MicrosoftWindows.exeQFHoBh.exeMicrosoft Windows.exeQFHoBh.exeMicrosoft Windows.exeMicrosoft Windows.exe

pid process

3580 MicrosoftWindows.exe
608 QFHoBh.exe
408 Microsoft Windows.exe
3896 QFHoBh.exe
3188 Microsoft Windows.exe
4812 Microsoft Windows.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
3580	MicrosoftWindows.exe
608	QFHoBh.exe
408	Microsoft Windows.exe
3896	QFHoBh.exe
3188	Microsoft Windows.exe
4812	Microsoft Windows.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

description	ioc	process
File opened (read-only)	\??\H:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\I:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\L:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\N:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\T:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\W:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\G:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\B:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\J:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\M:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\P:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\V:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\Z:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\A:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\S:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\E:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\O:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\Q:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\R:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\U:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\X:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\Y:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\K:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

Drops file in System32 directory 10 IoCs

Processes:

QFHoBh.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k1[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\MicrosoftWindows.exe	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	QFHoBh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	QFHoBh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k2[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k3[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k4[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k5[1].rar	QFHoBh.exe

Drops file in Program Files directory 64 IoCs

Processes:

QFHoBh.exeQFHoBh.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	QFHoBh.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	QFHoBh.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	QFHoBh.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	QFHoBh.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	QFHoBh.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	QFHoBh.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

736 408 WerFault.exe Microsoft Windows.exe

pid	pid_target	process	target process
736	408	WerFault.exe	Microsoft Windows.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exeQFHoBh.exeMicrosoft Windows.exeMicrosoft Windows.exeWScript.execmd.execmd.exeMicrosoftWindows.exeMicrosoft Windows.exeQFHoBh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QFHoBh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QFHoBh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

QFHoBh.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	QFHoBh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	QFHoBh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	QFHoBh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	QFHoBh.exe

Modifies registry class 1 IoCs

Processes:

MicrosoftWindows.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings MicrosoftWindows.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	MicrosoftWindows.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exeMicrosoftWindows.exeMicrosoft Windows.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4900	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
4900	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
3580	MicrosoftWindows.exe
3580	MicrosoftWindows.exe
408	Microsoft Windows.exe
408	Microsoft Windows.exe
3580	MicrosoftWindows.exe
3580	MicrosoftWindows.exe
4444	msedge.exe
4444	msedge.exe
2920	msedge.exe
2920	msedge.exe
4208	identity_helper.exe
4208	identity_helper.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
2920 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Microsoft Windows.exe

description pid process

Token: SeDebugPrivilege 408 Microsoft Windows.exe
Token: SeDebugPrivilege 408 Microsoft Windows.exe

description	pid	process
Token: SeDebugPrivilege	408	Microsoft Windows.exe
Token: SeDebugPrivilege	408	Microsoft Windows.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exeMicrosoftWindows.exeMicrosoft Windows.exemsedge.exe

description	pid	process	target process
PID 4364 wrote to memory of 4900	4364	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
PID 4364 wrote to memory of 4900	4364	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
PID 4364 wrote to memory of 4900	4364	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
PID 4900 wrote to memory of 3580	4900	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	MicrosoftWindows.exe
PID 4900 wrote to memory of 3580	4900	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	MicrosoftWindows.exe
PID 4900 wrote to memory of 3580	4900	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	MicrosoftWindows.exe
PID 3580 wrote to memory of 608	3580	MicrosoftWindows.exe	QFHoBh.exe
PID 3580 wrote to memory of 608	3580	MicrosoftWindows.exe	QFHoBh.exe
PID 3580 wrote to memory of 608	3580	MicrosoftWindows.exe	QFHoBh.exe
PID 408 wrote to memory of 3896	408	Microsoft Windows.exe	QFHoBh.exe
PID 408 wrote to memory of 3896	408	Microsoft Windows.exe	QFHoBh.exe
PID 408 wrote to memory of 3896	408	Microsoft Windows.exe	QFHoBh.exe
PID 408 wrote to memory of 3188	408	Microsoft Windows.exe	Microsoft Windows.exe
PID 408 wrote to memory of 3188	408	Microsoft Windows.exe	Microsoft Windows.exe
PID 408 wrote to memory of 3188	408	Microsoft Windows.exe	Microsoft Windows.exe
PID 408 wrote to memory of 4812	408	Microsoft Windows.exe	Microsoft Windows.exe
PID 408 wrote to memory of 4812	408	Microsoft Windows.exe	Microsoft Windows.exe
PID 408 wrote to memory of 4812	408	Microsoft Windows.exe	Microsoft Windows.exe
PID 3580 wrote to memory of 2548	3580	MicrosoftWindows.exe	WScript.exe
PID 3580 wrote to memory of 2548	3580	MicrosoftWindows.exe	WScript.exe
PID 3580 wrote to memory of 2548	3580	MicrosoftWindows.exe	WScript.exe
PID 4900 wrote to memory of 2920	4900	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	msedge.exe
PID 4900 wrote to memory of 2920	4900	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	msedge.exe
PID 2920 wrote to memory of 508	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 508	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe
PID 2920 wrote to memory of 1688	2920	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
"C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
  "C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe" Master
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\MicrosoftWindows.exe
    "C:\Windows\System32\MicrosoftWindows.exe" C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe
      C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:608
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\787b0a90.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1164
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\2724.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.35my.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1b3546f8,0x7ffa1b354708,0x7ffa1b354718
      4⤵
      PID:508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4984823508169304878,8162105673261527104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5572 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2772

C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe
"C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\TEMP\QFHoBh.exe
  C:\Windows\TEMP\QFHoBh.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\TEMP\3bad4940.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2088
- C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe
  "C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe" Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3188
- C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe
  "C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe" Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 556
  2⤵
  - Program crash
  PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 408 -ip 408
1⤵
PID:2480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\2724.vbs

Filesize
500B

MD5
db6d4ab31c682c46ff351e92753a8a09

SHA1
99e4945e61c87d7b547f65e9001265ec9a55aa7d

SHA256
ede31ad2241c0a027f9b4296a9181862782b54a93ff47357725e66cd6f9a6312

SHA512
1f72e46ef5414d08e137e7cd6a482099e1a5e3c540dfccedfa214e188474929b4e535c39f39ccfb5ca958d218ba0a02f4dd45b288f4ea905cd22be6f063aa06d

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
31KB

MD5
f531d705cf2c4732d5f67f5ea7dfb116

SHA1
cc1ec661e439f0458d5f5238efb86d3159e1f48d

SHA256
2b958557a31aee706af160a59166fa6d10e716bbbde90e8fc6499103e01e9aa0

SHA512
bb2970abd6cb4e9efc8ab60ad5f6d1f2dac2511c9ccd2b506e031880a73999c3d3cc734491b4e6f7baa8d9c4d5c992a055ee26896377b475f465618e1597c5ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b445ffd66b1110c38549544f8b18f9eb

SHA1
a15412de16be5a7c8e890ea7fe1f68152b8e0cea

SHA256
3e99a9fe5bd99ab6c29e62f826c9c0f59e716a55777a7e39ad80577a9adecee7

SHA512
49f2ba67bd4bccbcbe95e038b5c51dc1da62452f9ddd60ec9c77a7e794e7c3f09e1195589ab21cc3a26508cb5000452e4d6391ac2efa622d13b54c33c19726e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
386B

MD5
f3757ca8815ab2725c18a6e7bef6c629

SHA1
43111a4af9e602c072c441e38cefaa4ba829016c

SHA256
f229a42480bd2ea78995e68920dc7b406cb16cf6794ec593b98007117aeaa864

SHA512
cdbb4fbf56237c1db8923c560f3683a41eb6f04437dc416fd0cba1a9c3384c21158249e705c93535ac12e842bb18b5822c681b16c4dc44ba76b10fa1220c60bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d23f36359fe97319cc68c44d7d671ca5

SHA1
07af3fd39ad67e9060d9abcd8c6710e55278f566

SHA256
179036382e23e1c8d96dcd9d79d353a8a820c7b38d10f20781be8e5ad0ad7008

SHA512
ff1d5c95e38b2ea76ec48c79ed689a10a940c1206c82c0733cb3e478e1e2c10b4baf1e810e50cf3dc9f6e0ca1b93d36c09b2909091ce71edb654128781116973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
91d73c36717e7ebc4e3386c690f5ad67

SHA1
5ac0cf55d2652066f8ee257dc0dd7606914cb85c

SHA256
34f3c9feffff10ab10ca6279aa36edd4618dca06a3e600d0fe9eb2fa6c61c05d

SHA512
6fd85bc7d30d8f30c1fe58c797228bf62983e9ada8de6477c67916f0c259afff0852c30a834e3c9b04782b9f38bab9ed220a5c922adc145d16dfc10dd3db8887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
002b4c506b424c8d50fd7a419c9370c0

SHA1
584461dbe685d5a2876028ae8e04a73b3d79bc97

SHA256
c2e0d273614513bd08ea2dc3162593893998bd4c3463cf8115f75bbb0b3a0893

SHA512
302fdeb304ec8b21a407b4c8cd3ff751fb5198bf55bcf2d3d3e9fc54eab05a474d98f193bd0ef5c5fa8e6631daf83b99f81c710e73b3f26b51cb8709455db9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dc022cba30971b985a15b875d935588d

SHA1
1b744f32efd41d6e06d3e52351a5d79b0f5854f5

SHA256
4b787797da2fbf9b0f54d687d360b11ed074b1c9bcea05db35265dc9952f7337

SHA512
481a3aadbb701b11add0b5dc81f4a449f5dded01286d0bafb7ae8b91ec4748deebef7c34582744dde3f67c279c34f8e7e431a93d72f553de1ebe23a055492a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\787b0a90.bat

Filesize
187B

MD5
ef9a681601cae14cce68f3a4099d5bf6

SHA1
ef8eda998732ed55ff42206e344457411b7626c8

SHA256
e1575eefdb943b6f54c678b1612d7f0bc0cf510986d24a6a0aa467da0ef96bca

SHA512
4929ca2dd878a992782fefc34ec5f2b660841b441eab7b39e1726b3c4d7c256f66614a285394845b693e4eb876f4de8e3c0c8c5003b2927f934f738bd2c75b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe

Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Windows\SysWOW64\MicrosoftWindows.exe

Filesize
203KB

MD5
44ac4d8a1dd1c157c2cc064df56c1708

SHA1
ec82794ec83453d400a79df923a1b65a5507d243

SHA256
3b5acacb66902a70cdd388ae3e084e1e0c3f233a2be6c5636cd143acd0f671b1

SHA512
b4bfc3775be5847c6467bb5f4630187557fc126a30686374095c0bc6a0fc93dd4cfd9739f02ac8af260f1e84c4d6174d7dfa36df56ba6b7d13af189b799b04e9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k1[1].rar

Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Windows\TEMP\3bad4940.bat

Filesize
133B

MD5
ef20195e83884195a0b14623b2df258a

SHA1
061837a4b32cdcce9c4e35a02cafe3e66e6a7dad

SHA256
2722f11487ff164bf6bc0445fe22f5672aa76691a0f9d1db60d392298eebbde5

SHA512
230433c0c94cc35f893d72039a0b56069dfeef63647d515be2424151ff0c75f72268cb71aa7b05656c3c28553cbd29b55f7ac0b446d3c9a53dc59f559d5854c9

Download Submit
C:\Windows\Temp\401C02C2.exe

Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
7777f28ae3ef3aa14cccc1cc0be67e61

SHA1
d2c759e3b1a8547c8bbc736902e4b0f767a23aae

SHA256
9f57bd820aaaf6361970c355b1c2288bcb07cd71e7fc66e7847919ebc58779c5

SHA512
31f6a224b3a35c2b7c9e89cd43b53e537a9a731740a590d8631d37ef9cf2d95c5cc71040806d616f4143ce1f078f27f7cd917e2dd646332b31fe18b5a8b951cd

Download Submit
\??\pipe\LOCAL\crashpad_2920_BMRYNOTQQRUPGBOI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/408-40-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/408-137-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/408-41-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/608-50-0x0000000000760000-0x0000000000769000-memory.dmp

Filesize
36KB

Download
memory/608-141-0x0000000000760000-0x0000000000769000-memory.dmp

Filesize
36KB

Download
memory/608-24-0x0000000000760000-0x0000000000769000-memory.dmp

Filesize
36KB

Download
memory/3188-69-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/3188-70-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/3580-19-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/3580-93-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/3580-16-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/3580-17-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3580-38-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/3580-18-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/3896-167-0x0000000000C10000-0x0000000000C19000-memory.dmp

Filesize
36KB

Download
memory/3896-46-0x0000000000C10000-0x0000000000C19000-memory.dmp

Filesize
36KB

Download
memory/4364-0-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/4364-2-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/4812-149-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4812-73-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4900-49-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/4900-30-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/4900-102-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/4900-1-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download