Analysis
-
max time kernel
101s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 10:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Sn8ow/NoEscape.exe_Virus/releases/download/1.0.0/NoEscape.exe.zip
Resource
win10v2004-20241007-en
Errors
General
-
Target
https://github.com/Sn8ow/NoEscape.exe_Virus/releases/download/1.0.0/NoEscape.exe.zip
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe" NoEscape.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NoEscape.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" NoEscape.exe -
Loads dropped DLL 1 IoCs
pid Process 2004 vc_redist.x86.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini NoEscape.exe File opened for modification C:\Users\Public\Desktop\desktop.ini NoEscape.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png" NoEscape.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\winnt32.exe NoEscape.exe File opened for modification C:\Windows\winnt32.exe NoEscape.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NoEscape.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "194" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 392 msedge.exe 392 msedge.exe 868 msedge.exe 868 msedge.exe 3048 identity_helper.exe 3048 identity_helper.exe 4276 msedge.exe 4276 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe 868 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4456 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 868 wrote to memory of 380 868 msedge.exe 83 PID 868 wrote to memory of 380 868 msedge.exe 83 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 1484 868 msedge.exe 84 PID 868 wrote to memory of 392 868 msedge.exe 85 PID 868 wrote to memory of 392 868 msedge.exe 85 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86 PID 868 wrote to memory of 4804 868 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Sn8ow/NoEscape.exe_Virus/releases/download/1.0.0/NoEscape.exe.zip1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5f3146f8,0x7ffc5f314708,0x7ffc5f3147182⤵PID:380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:82⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5456 /prefetch:82⤵PID:2568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:12⤵PID:2124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:12⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:12⤵PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:12⤵PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:12⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16471804563488236771,8556306543551866866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:12⤵PID:4108
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1936
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2808
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2176
-
C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe"C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3548 -
C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe"C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\vc_redist.x86.exe" -burn.unelevated BurnPipe.{201E0A2B-8857-4ABE-BA7B-7CFC883DA89B} {4DFEB00A-0A80-426E-A642-88E131990E6F} 35482⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2004
-
-
C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"C:\Users\Admin\Downloads\NoEscape.exe\NoEscape.exe\NoEscape.exe-Latest Version\NoEscape.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1600
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38da055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4456
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:5424
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
265B
MD5f5cd008cf465804d0e6f39a8d81f9a2d
SHA16b2907356472ed4a719e5675cc08969f30adc855
SHA256fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d
SHA512dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d
-
Filesize
6KB
MD590cc3256b7cda291302df84e15fccd6a
SHA109503f82f1d1ded0272888f862be3b94e170f737
SHA256a6d76e63f47c1a1703c907adc1c2d4cd74b8edb6397d303a8f574a2ca7c48dea
SHA5127b79eab1fdf3f1b35eb3d1fbc2f52f2f3bef794bca469a11c0a370012619512d919a072be8c13d9c417f5aa460d0cf1798449dd2a943a74230480682d332eaa3
-
Filesize
5KB
MD53319c596f99f799b27087c930ab66599
SHA1f02c7168e2117f71c4f68047de410c7b0c838e27
SHA256a5739a15d884de04aed8232bc8252ca53e7faa8ab3ad2421cefa181110b63dec
SHA512206a74931dc5ae9e8a4a467623472a3737c460c1c6a4fc2b2179f25b17a26f1330c94628b0da2fc429da88bd71634f8cbf25d05f1f72c8cf228abdeb44d6d59c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD58fecae93f2748e31af1f156de2f16160
SHA1536f29f7a1ec31a4eeb5b37992fd13103e6b1371
SHA256fce0357725c07e4e0c15b11db93645f5bf4a9ff3bcb7825985b50b9eeed7c4f0
SHA512c335bc286e07704ef10982eee3bfa25008d69f000f477c411fe3a77d5de9f7e10ca27945555fd78039f2ec0714dacf680dd22d56ed854271f14d0af536d50851
-
Filesize
10KB
MD549f7c2f68d1335a3eb489789bc5f5268
SHA1d635f6e142a677138da6f82f7bda1ecbf88d1612
SHA2569eff66333bdb3a57ccdf16e3b7c48dd389884f82d72c94d6de7a4adc5bebce17
SHA512e3a71955f7e0ee30d2e5c1d12530e62864cea5321f6e04405183b46657cd11a65699e487f8e118ae37c9c5f9254bad46cbd45c1a9a10770bffcc59f18673e964
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
118KB
MD54d20a950a3571d11236482754b4a8e76
SHA1e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c
SHA256a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
SHA5128b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2
-
Filesize
13.5MB
MD5660708319a500f1865fa9d2fadfa712d
SHA1b2ae3aef17095ab26410e0f1792a379a4a2966f8
SHA256542c2e1064be8cd8393602f63b793e9d34eb81b1090a3c80623777f17fa25c6c
SHA51218f10a71dc0af70494554b400bdf09d43e1cb7e93f9c1e7470ee4c76cd46cb4fbf990354bbbd3b89c9b9bda38ad44868e1087fd75a7692ad889b14e7e1a20517
-
Filesize
666B
MD5e49f0a8effa6380b4518a8064f6d240b
SHA1ba62ffe370e186b7f980922067ac68613521bd51
SHA2568dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
SHA512de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4