bdaejec | d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
Size

2.7MB
MD5

37b5c009c69a10a13cc9a566bfd59207
SHA1

9d5fb6faa35f0ebeea941e2f206fa463a73fd1b5
SHA256

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3
SHA512

b008c035c3db830143d702f719001436c137d90a330c4666171173ec839c177b5eacb62cdc158287c0df14f58b22d902bd5090eb0c4bbc6179f1f3584a69216a
SSDEEP

49152:K5yaUm6/qD9dDqnroHO0ksLzZmLXpO9q+0Ollh1d2HObA3:K5zX9cnsHXLzZcZy0Orhf2Hv

Score

10^/10

bdaejec aspackv2 backdoor discovery spyware stealer

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Bdaejec family
bdaejec

Detects Bdaejec Backdoor. 4 IoCs

Bdaejec is backdoor written in C++.

Processes:

resource	yara_rule
behavioral2/memory/2244-26-0x00000000007F0000-0x00000000007F9000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/2336-48-0x0000000000A30000-0x0000000000A39000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/2244-125-0x00000000007F0000-0x00000000007F9000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/2336-138-0x0000000000A30000-0x0000000000A39000-memory.dmp	family_bdaejec_backdoor

Drops file in Drivers directory 1 IoCs

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftWindows.exeQFHoBh.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	MicrosoftWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	QFHoBh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

Executes dropped EXE 6 IoCs

Processes:

MicrosoftWindows.exeQFHoBh.exeMicrosoft Windows.exeQFHoBh.exeMicrosoft Windows.exeMicrosoft Windows.exe

pid process

2016 MicrosoftWindows.exe
2244 QFHoBh.exe
1688 Microsoft Windows.exe
2336 QFHoBh.exe
4436 Microsoft Windows.exe
4824 Microsoft Windows.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2016	MicrosoftWindows.exe
2244	QFHoBh.exe
1688	Microsoft Windows.exe
2336	QFHoBh.exe
4436	Microsoft Windows.exe
4824	Microsoft Windows.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

description	ioc	process
File opened (read-only)	\??\T:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\E:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\G:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\N:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\O:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\Q:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\R:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\Z:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\I:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\K:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\L:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\P:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\U:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\Y:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\B:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\H:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\S:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\V:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\W:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\A:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\J:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\M:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened (read-only)	\??\X:	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

Drops file in System32 directory 10 IoCs

Processes:

QFHoBh.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k1[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k2[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k5[1].rar	QFHoBh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	QFHoBh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	QFHoBh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k3[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k4[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\MicrosoftWindows.exe	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	QFHoBh.exe

Drops file in Program Files directory 64 IoCs

Processes:

QFHoBh.exeQFHoBh.exeMicrosoftWindows.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	QFHoBh.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	QFHoBh.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	QFHoBh.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	QFHoBh.exe
File created	C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe	MicrosoftWindows.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	QFHoBh.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	QFHoBh.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe	QFHoBh.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4912 1688 WerFault.exe Microsoft Windows.exe

pid	pid_target	process	target process
4912	1688	WerFault.exe	Microsoft Windows.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exeMicrosoft Windows.exeMicrosoft Windows.execmd.exeMicrosoft Windows.exeWScript.execmd.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exeMicrosoftWindows.exeQFHoBh.exeQFHoBh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QFHoBh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QFHoBh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

QFHoBh.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	QFHoBh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	QFHoBh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	QFHoBh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	QFHoBh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	QFHoBh.exe

Modifies registry class 1 IoCs

Processes:

MicrosoftWindows.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings MicrosoftWindows.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	MicrosoftWindows.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exeMicrosoftWindows.exeMicrosoft Windows.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3436	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
3436	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
2016	MicrosoftWindows.exe
2016	MicrosoftWindows.exe
1688	Microsoft Windows.exe
1688	Microsoft Windows.exe
2016	MicrosoftWindows.exe
2016	MicrosoftWindows.exe
3676	msedge.exe
3676	msedge.exe
452	msedge.exe
452	msedge.exe
484	identity_helper.exe
484	identity_helper.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

452 msedge.exe
452 msedge.exe
452 msedge.exe
452 msedge.exe
452 msedge.exe
452 msedge.exe
452 msedge.exe
452 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Microsoft Windows.exe

description pid process

Token: SeDebugPrivilege 1688 Microsoft Windows.exe
Token: SeDebugPrivilege 1688 Microsoft Windows.exe

description	pid	process
Token: SeDebugPrivilege	1688	Microsoft Windows.exe
Token: SeDebugPrivilege	1688	Microsoft Windows.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exed9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exeMicrosoftWindows.exeMicrosoft Windows.exeQFHoBh.exeQFHoBh.exemsedge.exe

description	pid	process	target process
PID 4852 wrote to memory of 3436	4852	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
PID 4852 wrote to memory of 3436	4852	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
PID 4852 wrote to memory of 3436	4852	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
PID 3436 wrote to memory of 2016	3436	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	MicrosoftWindows.exe
PID 3436 wrote to memory of 2016	3436	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	MicrosoftWindows.exe
PID 3436 wrote to memory of 2016	3436	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	MicrosoftWindows.exe
PID 2016 wrote to memory of 2244	2016	MicrosoftWindows.exe	QFHoBh.exe
PID 2016 wrote to memory of 2244	2016	MicrosoftWindows.exe	QFHoBh.exe
PID 2016 wrote to memory of 2244	2016	MicrosoftWindows.exe	QFHoBh.exe
PID 1688 wrote to memory of 2336	1688	Microsoft Windows.exe	QFHoBh.exe
PID 1688 wrote to memory of 2336	1688	Microsoft Windows.exe	QFHoBh.exe
PID 1688 wrote to memory of 2336	1688	Microsoft Windows.exe	QFHoBh.exe
PID 1688 wrote to memory of 4436	1688	Microsoft Windows.exe	Microsoft Windows.exe
PID 1688 wrote to memory of 4436	1688	Microsoft Windows.exe	Microsoft Windows.exe
PID 1688 wrote to memory of 4436	1688	Microsoft Windows.exe	Microsoft Windows.exe
PID 1688 wrote to memory of 4824	1688	Microsoft Windows.exe	Microsoft Windows.exe
PID 1688 wrote to memory of 4824	1688	Microsoft Windows.exe	Microsoft Windows.exe
PID 1688 wrote to memory of 4824	1688	Microsoft Windows.exe	Microsoft Windows.exe
PID 2016 wrote to memory of 2432	2016	MicrosoftWindows.exe	WScript.exe
PID 2016 wrote to memory of 2432	2016	MicrosoftWindows.exe	WScript.exe
PID 2016 wrote to memory of 2432	2016	MicrosoftWindows.exe	WScript.exe
PID 2244 wrote to memory of 3396	2244	QFHoBh.exe	cmd.exe
PID 2244 wrote to memory of 3396	2244	QFHoBh.exe	cmd.exe
PID 2244 wrote to memory of 3396	2244	QFHoBh.exe	cmd.exe
PID 2336 wrote to memory of 2608	2336	QFHoBh.exe	cmd.exe
PID 2336 wrote to memory of 2608	2336	QFHoBh.exe	cmd.exe
PID 2336 wrote to memory of 2608	2336	QFHoBh.exe	cmd.exe
PID 3436 wrote to memory of 452	3436	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	msedge.exe
PID 3436 wrote to memory of 452	3436	d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe	msedge.exe
PID 452 wrote to memory of 3928	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 3928	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe
PID 452 wrote to memory of 4404	452	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
"C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
  "C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe" Master
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\MicrosoftWindows.exe
    "C:\Windows\System32\MicrosoftWindows.exe" C:\Users\Admin\AppData\Local\Temp\d9a4f54c662d3aec62bb01cde6af3f54c0a028add5bd3200543f085f771e00b3.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe
      C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\496c5e8b.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\6824.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.35my.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfdd846f8,0x7ffdfdd84708,0x7ffdfdd84718
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2648 /prefetch:8
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2648 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11089195994026790104,6544266315298364512,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3268

C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe
"C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\TEMP\QFHoBh.exe
  C:\Windows\TEMP\QFHoBh.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\TEMP\3b3b457d.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2608
- C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe
  "C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe" Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4436
- C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe
  "C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe" Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 596
  2⤵
  - Program crash
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1688 -ip 1688
1⤵
PID:708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\6824.vbs

Filesize
500B

MD5
db6d4ab31c682c46ff351e92753a8a09

SHA1
99e4945e61c87d7b547f65e9001265ec9a55aa7d

SHA256
ede31ad2241c0a027f9b4296a9181862782b54a93ff47357725e66cd6f9a6312

SHA512
1f72e46ef5414d08e137e7cd6a482099e1a5e3c540dfccedfa214e188474929b4e535c39f39ccfb5ca958d218ba0a02f4dd45b288f4ea905cd22be6f063aa06d

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
31KB

MD5
8c18f3d5dfacd46b7168ea39ad66838b

SHA1
95fa47ea8129ecfdcdc3a7c347c0fd467c153e26

SHA256
509ff1ba0083fa7fec21023a9400f6782f54b207c63d792e04f7990ddb7ecb0c

SHA512
078a02afe8736e49dd0e852ee94a146388f657b656f657e5f905c8693cbb4a55626f545392da45105580fdb127abdbd4a5aa5ea4f1cfac76b55e7def217d7f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
05f1e9ddcc61bae0c63f32a4e41a604b

SHA1
2574a28e4d0ac90310a404769e555067ec63be36

SHA256
976fc3f27be8d2376a8460c511aa45f8e66e8ae154394ba2cfb2a2b0a9c32a9d

SHA512
8eefbb39fec044fe06693b40b81fd0785268d9360875349eec00f75242c7edf0cf9afcf3d6bbec87325c082642b1a518874d15aec0dd13329e9aded1a239dcfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
386B

MD5
f3757ca8815ab2725c18a6e7bef6c629

SHA1
43111a4af9e602c072c441e38cefaa4ba829016c

SHA256
f229a42480bd2ea78995e68920dc7b406cb16cf6794ec593b98007117aeaa864

SHA512
cdbb4fbf56237c1db8923c560f3683a41eb6f04437dc416fd0cba1a9c3384c21158249e705c93535ac12e842bb18b5822c681b16c4dc44ba76b10fa1220c60bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95d3f88d0623d1ffbc66c233beae791a

SHA1
05bd34da4c830e57d60a0e4a7a4a736d626a61a2

SHA256
be29ac8a81d51e2b49c168387dac4915b62d29d447a92609e84aeae4183375ce

SHA512
e12ca297fec9c7221b7a13de7cd29bdb77fbb09815fae90367378bc31cb531887c9696da044a7bec1505bb2f190b871371bbcff83080f1790238f59510e722b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0675dcf32e2eefd96d9bb369f1e3c123

SHA1
2b2bbd99571ade4342be5e27d4512f23fd5819de

SHA256
32307a9dca3e1ead8536916788d8982b284b43addded8430c55a31b4819b9163

SHA512
052e7a2382a7adb5159d6fe73bb67c7994f31f3f4a5aa3aac44c69544f3b0fc72384c5edf0b51b13f841302351134d812daed2d7405d1e85863f4880f572a974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4add1e57e3a8e9cd1977c39097336811

SHA1
427a9aac7dd9a450a98a8e7c4bbd3ca4948b8853

SHA256
eec9136465c436e404370f6cab905e5b17ac3c8c9d625caa5af464c6e1f978e3

SHA512
a096dc95e5930e07e7574c04e64b4afa0591e49d7270549a6078f99ebefe6c50760077d540f3a560f344cf2e4e6626c545eb7b7e4beaacc423314dc4a3ef530b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
37e60d15f09ab00cc3742548aff0739c

SHA1
a6b773e860b0ffeb3dd391366cfc9a0bc1750687

SHA256
1f2a9a41d231608199f868a1d0b708ce9bf2aae01299c838e2a2ca0042b0bd92

SHA512
c93cb578ed3ff76dcec180566f7073020d531f0f933b33f5374a5654eb735b628a3b292072e03c4a337838ef16a2585021b6498a31bb4c7313dcbc55416f40f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\k2[1].rar

Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\496c5e8b.bat

Filesize
187B

MD5
727068a251fe73b65b7694f877ecd984

SHA1
d43aac80fe701b60e7c8723145eb70a639e23c7f

SHA256
89b424fe89bce71848f363ffa091f81aee001a964776082ef91a1fb99925c4aa

SHA512
0219745da266ded7c02245b37beddccae9f6e1e16c666822b15087c7683c6a777915155a5cfbb87a3e65d368b7a9038c4d03fa00eac792eb7bec96710a27d4c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\5E934450.exe

Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe

Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Windows\SysWOW64\MicrosoftWindows.exe

Filesize
203KB

MD5
44ac4d8a1dd1c157c2cc064df56c1708

SHA1
ec82794ec83453d400a79df923a1b65a5507d243

SHA256
3b5acacb66902a70cdd388ae3e084e1e0c3f233a2be6c5636cd143acd0f671b1

SHA512
b4bfc3775be5847c6467bb5f4630187557fc126a30686374095c0bc6a0fc93dd4cfd9739f02ac8af260f1e84c4d6174d7dfa36df56ba6b7d13af189b799b04e9

Download Submit
C:\Windows\TEMP\3b3b457d.bat

Filesize
133B

MD5
20fbf471ed19c5dd4353885f2d17d1ef

SHA1
ec16e877363531e08d3bfce59c2ad64647c3c420

SHA256
11f354cc03997ee8697eb3fe3915cbcd98949c9a98e4d4f26a28c342ce67ec52

SHA512
c15beace845eab18147c97f14ab58bb68fcc96bbb56b0d830feb0c2298541d24e49f60a33aa0b23d46eb739c847961a49e4e60fd1fe99891cd1fbdabe2cc412f

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
7777f28ae3ef3aa14cccc1cc0be67e61

SHA1
d2c759e3b1a8547c8bbc736902e4b0f767a23aae

SHA256
9f57bd820aaaf6361970c355b1c2288bcb07cd71e7fc66e7847919ebc58779c5

SHA512
31f6a224b3a35c2b7c9e89cd43b53e537a9a731740a590d8631d37ef9cf2d95c5cc71040806d616f4143ce1f078f27f7cd917e2dd646332b31fe18b5a8b951cd

Download Submit
\??\pipe\LOCAL\crashpad_452_WRYRGUVPQMTJHIIA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1688-41-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1688-42-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1688-140-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/2016-123-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/2016-37-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2016-34-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/2016-16-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/2016-18-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/2016-21-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2016-17-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/2244-125-0x00000000007F0000-0x00000000007F9000-memory.dmp

Filesize
36KB

Download
memory/2244-26-0x00000000007F0000-0x00000000007F9000-memory.dmp

Filesize
36KB

Download
memory/2336-48-0x0000000000A30000-0x0000000000A39000-memory.dmp

Filesize
36KB

Download
memory/2336-138-0x0000000000A30000-0x0000000000A39000-memory.dmp

Filesize
36KB

Download
memory/3436-35-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/3436-142-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/3436-2-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/4436-182-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4436-90-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4436-89-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4824-141-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4824-88-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4824-92-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4824-93-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4852-0-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4852-1-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download