hxxps://github[.]com/maestron/botnets

Analysis

max time kernel
447s
max time network
443s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/maestron/botnets

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2384	Service pack 6.exe
4612	Service pack 6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
94	raw.githubusercontent.com
95	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service pack 6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service pack 6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5B707880-A6FF-11EF-B9B6-520873AEBE93} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Service pack 6.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Service pack 6.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 903200.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
2656	msedge.exe
2656	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	Service pack 6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
4852	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4852	iexplore.exe
4852	iexplore.exe
220	IEXPLORE.EXE
220	IEXPLORE.EXE
220	IEXPLORE.EXE
220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4360	2468	msedge.exe	84
PID 2468 wrote to memory of 4360	2468	msedge.exe	84
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4700	2468	msedge.exe	85
PID 2468 wrote to memory of 4156	2468	msedge.exe	86
PID 2468 wrote to memory of 4156	2468	msedge.exe	86
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87
PID 2468 wrote to memory of 2664	2468	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/maestron/botnets
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffec00246f8,0x7ffec0024708,0x7ffec0024718
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1292 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- C:\Users\Admin\Downloads\Service pack 6.exe
  "C:\Users\Admin\Downloads\Service pack 6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17475401753716815072,15505859276903261200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2564
- C:\Users\Admin\Downloads\Service pack 6.exe
  "C:\Users\Admin\Downloads\Service pack 6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\formbgn.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4852 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bec923da9b333ea31d48eb4704d4568d

SHA1
b501b4a9ab212cdbfbe2ed90c880b4bc2642d2af

SHA256
dde6eefdfa77686d0de0304df65530f1b38184bb8efe63fc0e87831036218ced

SHA512
b0aadf0db349758a07fc0b0e3c27d0d06b1a1f4b518e4bf7bb34f146dfbefa69165552d7fd23b9fdaa318ff4a66515cc76efc395cd8648da60b8b6e972ddb1d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d454994885cbc3366b339fec6dd0e392

SHA1
0bb70141fca9e6a8315c4d74f63d57fd2190d309

SHA256
f51f6312b8b7f18ee7a10d42bc0109d42382fa29225069a988787aa005a83e72

SHA512
fcb00a2a1fcf5ab8b8b4bc1336a8193a44c873be700ce86af61358635d774c1244ac38e5b663bd12544fe5d9c6f417e38f49bfc8cab6fc8052c8ec0c12e7090d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
406d40f57c41b87d19b999ebfe5296fc

SHA1
7d6ce47afbb25a87565cebdaf0a1a2f4af4bfc10

SHA256
0d179bd1f38ad65839441984c85dac651e393eb75c561885911cb8cce8be6974

SHA512
a763d98c4e196a8f81244761848a52ab25cf2b4dcc91ff8a977828a7f3639f05248463828221b575942a4c99dc5b720703339e4cb59e11a301fefa6236e660fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
cf9740a10e94c29c3786caf9767044e2

SHA1
c592af94d5731ef49273b29bb662e001e62e19e8

SHA256
d3d78d42ab7e0c8d860728b8c18a756de1ee14c88bcb65a55fcfeafd90124b11

SHA512
bed5f09055582df00a20a30b554ae0fffe7844dca3bb8ab93e1e80a3de9ec467aa9426f61433bde1b64da39eae99d1511bb7b4709dedbb5ae18a05f6f00010c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
474731fdda812d14c645400566fb4c2d

SHA1
df5b15b4c81de50f3caa6ec964143d1d6c3bce83

SHA256
633e8379ba4f1751d4b984ec794e6c0fe7e4225fa43913e2d79d566b49d51e27

SHA512
4eb45c723171ac4eef18155f7d8eed25cdb07294c7d3cbe1d3882aaa48f7393cf1309aa458a2ffe44ca7bba95ed6f41c05bd00fa80fb3fee9057f2ef3ee23d72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74c15d7f708c678c0060e04f07726b4f

SHA1
0c7031b230c3de30e20c25ee8fc32bc58e3b5a1f

SHA256
8ff87dadd4cf30ec0bd2eb4caad4694df3fd2e29a21aa2d512c4a1d635b6fab2

SHA512
2ac830ef5c19490577047d1850efd4de845e8c5a75c801594c2a1d36c641badff86263c1bbf2b90fe9118391b5259f10e07777ab32974b71e4dad763c393035b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
06c47b47b061f18fbcd2a31c8895f43a

SHA1
1286908a85cc500a491b00fac262891f19c599f8

SHA256
b24a0db4ac0a7615806ad5f4d42ef16bbd54718a4fd8446f7f0f372995854b49

SHA512
13032a1ae2f2f58005c965d5301529a1205b87f79861df8e1874e155323497a63032389882a205caa1d1fd5163bd787ddac0806fe1d73119b14a0d1f5de19067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55779a27291c494c66a41738e5423778

SHA1
b983261434d1ccbd78764f02adc526803c7fe165

SHA256
0a4f70b9013cfa9f06654b78434f217a738ed7162f9bebf44f234ca618abb74e

SHA512
fd2f096ebe7f33314708eee3981c20f77fee720a3a73a8cd1a7e487b40f47fb4ffaffe546dac3ec24008e465e39b2c776cba0c3ca0118ab9fe67591def1b216a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
78cc7a0c343e77d135295057b11204cd

SHA1
c35a8d8795fd04e7ef757171fedc567cbc6a8ab2

SHA256
0c3ad837b1bd30d24b43144954ce02db38aa947dd6b2e38dcdefa492ccb95087

SHA512
235f0e3c2ca700cc69c343e341e4991dd6d79775a35537e8690a195eef9c3484de87a226ab973704210f6a7f902941c868a529acc5132a0c5c98334be1db64f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
55a154e7c12d8e08dd839a986f77c2dc

SHA1
236dbd2980be8899d5ed75d92efedbf80fdf1ccb

SHA256
086c4a690621f192099da9a85f1c419faa4f9c47c330d44a886ec8c8c7108b54

SHA512
ba26f29aef43cf1267c6a5bc07580d8109489b99f8d8af3acc76ed1bcd4ff6fed22f3d9b456372495c1d46b2298a75eec69da3a9a78dd12803d03d930973e245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
3ed3d2a84294a679195cf74e2ec896f0

SHA1
47a72e25cda957bef8a3d61e9a34b512d1d35428

SHA256
4c80a38773ca79651acb019a8d9cfb4ad6345ec4507ae2f7699bb4a7b208034b

SHA512
190c098677bbf8642cdc6d1cec497618c3074b8cfc0c0e8c37f8a942e82b7dfa642e930442ee222df20767488f7f4d115c7c06c78674744d610058fdf0e58230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
912bbf4c244e8796116fe230c6d41ff5

SHA1
700f841c05a234b979c6ee6840b1eadc6f5f593b

SHA256
847a9bf8ea14253a2ae0d018671b598e28f5b86dac17d315cdab9437f64c3918

SHA512
d9adb7e5456b0fb461526267d3bc7d16e3e8c5af7261cd4cf96f1c18e1d65dad66b8749d3b136e129d48421e600d7081aec173a4b50e673b3a6dae17f5db565e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
4aff823941ab8b1603f94b58b39b4b41

SHA1
0b620cc84adb0016689e0e50f0c6a6d853e58326

SHA256
f9b4ed1cb8d70ee40946390afc246cff9b00b46f675a968aba794b90f987d306

SHA512
523ed5449fbab8c7995c854057e16b178c94d454cb5df128b0746783eb88ac57551c859a357e30e0927e81171b4c5a38e9226f5aae0b332220af4c5452447a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
a6a246bf54fa93b92a331597901212e6

SHA1
8e51b0590e59d43512d75d6d5008a983e541c0bd

SHA256
d60c80555b1c8408fdfcc65a02f192bc388ba0bf9410d50117f5eee6d1d18969

SHA512
b55a1e2dc6e4d9f1d24470d7dc8e5d7ae2a12a764dbdc8e59abc2ac514ec963d5491c8f88c264fe5f33f8c769347a8e6ae07cd22f2fcb899234e691dbef4e9fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
6f74e621176a8571a5beecbc5546e389

SHA1
affb0ee2042086633875c083071b3b43bd83eced

SHA256
df911133c71b5cbcc6c5042e995795a4010b8ca413dd8923e4e1cee18717410b

SHA512
5492c80d06118567d8a60c4e63819d85b9cdd5dd9a7c99db87e6181078444a8f29ed061911b7a2a395b14c182a0527e5361a18ebd5a145dddc605f85da5296e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b325df4081f8ecaf1c72dac0c1aa6229

SHA1
3739273e26bf60ba26916d241629dfd270e3d43f

SHA256
5cd216d671932421eca882191fde2f9e37e9fa137d64cdc0c9247edad6e4089b

SHA512
bc807406b5588d0d9dbed5e628377e125f8fde9a097521f8a261cddb347f8da7d9ffc16cabc52d599b2a279f1bb198487b9752fe285edd6a8a5cc42e93d5b81d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
872d24ddfd2ab91e78757bcea55c5b91

SHA1
801970ae6e08cc8c675569accac3f0595c27d52a

SHA256
ae1239e5bc0f96d62ab2c86ac12fdf556d40cbdac43205c6726eac8c88ab4304

SHA512
35cbab65104693ef8fe01ce1ff453d5eba5427a04149d03062b2a870808f90408ed2af67512010b3c18929c6fdd6b270b84f9873cfa2d2226a88c16a3b989eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
33fdee9d1a2398d8f613ec4d7b1cb1d1

SHA1
4a60e77b069798114785f488621887296766a9f5

SHA256
9834524d62e671fdfa382f23bbe06bd39872bc3af42e4850303c911a5d9018cf

SHA512
b4f7674285c4f50a0105405124070fd52bc99f760554e8d0db678f368062ae224bded7ddd9243d58d36ddea4eb2222968ac9708d76dd0615994bc4338e84d415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
50ae23c5bb2edf187db9efdd86e11c9a

SHA1
8adbfeb8abca6e5cf3bb8726868f79aef7a155df

SHA256
61391f973d8d24383ed9b5ecd181e9a9858f23e83f3c75b99ddf0e4922990f45

SHA512
cf74a4c534965b564e4816fe26747fddb8fe0607f5170255aa07bb5d4c8ee23c1528dfa3290cd8858146c1ec4f36bc79fe078bed16444f14e6382d2474dacec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a71b7.TMP

Filesize
874B

MD5
8b2260b93d3763d788c55d7f03103473

SHA1
a56b14ca338bd02cbe0cd374b9f046c2fbf3c150

SHA256
8a868d6ba9b273d1c40e2dbe1a66bb0092e2854cd8cc7dcf4fb1ce7cc30dbf19

SHA512
7e35cef6ee9365d58e0bf063ff14fa424135c1e9b73c522ed1e25600f639b707b9e3e1e44ce1d6d5ebcc1ce68bcb38003d55b8578cd523c589553a5383896c4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\bba0cb27-4354-4e21-964c-d524288d1a53\0

Filesize
28.7MB

MD5
1d8b7371d2588e056ecd9cb8a74c94f3

SHA1
08867edd1c43f151387b5b0b2d64408189f0fa65

SHA256
22639899d8b2908224688deee3ee016164ebbe55fc709a4ec1440b4d9bbb4947

SHA512
e8492eeb9c79d5dc8f5b3ec2b3239869b2e9e236f4d7a1e6f84f883053edf3192dd14054102f98c8845cfbf24b376222c9018ab53663779e171ac4147ebc4368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5d240311e0b50d6f4ae2a00f45ee8135

SHA1
c07b44b09f85a35f00a7a8464b0de24dc562e301

SHA256
7f61dd0db0bf8ff581816e79d0013840ef68eede2ea25a1a566350ce7d59c529

SHA512
25b9669b88c8ff4a70e3503dbb95848b4dcced6376ffb6544494ccebba3c074d5d95af1259eb3074ff82b8242957bf850ec4e340ef3bda189e02a2774d1e9554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c2ab413b1aae0e456d25b24d67f0d92a

SHA1
e19b25286bcd8ca1b541d20549c33f48f9387496

SHA256
4ef6c7fa73bfe78dc822fe647359c0f494146155698f2b55749e68469cda8447

SHA512
7d28b29c1fad58d92189c023073a2e7f217f57aa0e764ec6b9782ca1865a39de26111e7c8f5cc159ccc941f6563964878fca4507cbd73493f268df1d9f43f13b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e02fe40c-fe06-429b-9029-9fe9268da3a7.tmp

Filesize
11KB

MD5
dcb93855dcaaf1989b097d30be2c40ba

SHA1
58b8d9bfcaff068be8555964be445a38d8076227

SHA256
029449f35d79a9e411e3186acd009ca4ab11e6dff9fceca3c53966fc73201875

SHA512
34f07b70278fdd572e85a2d1ef7855bac158ff76b9192b492592323c182e56a5cb12f6d240c9fc844c5e49c72e49b999fe10fa0d559d4ed3bbef1db8251b0455

Download Submit
C:\Users\Admin\Desktop\formbgn.gif

Filesize
168B

MD5
2496f8284b3a4023c6becfe8803401e3

SHA1
420f36c6b8f24ce0adaf94831f03f0add55c2cf3

SHA256
c5ba75440fadbd5359e344fd5bbf5d37635240ada5210cb80ad6f89966d90c8c

SHA512
5c2c8971a6ec86b07d1eadef66dba09b8a1efbdf1f25a70a437c5a4e4cd3e5656b0b1ffcf7478bf1fd44eec2a9782cbeef2de4f0e134ad11e0a09d51a915194a

Download Submit