fd84148426c6188c0bdec2e66d1f4fda9392342adb0c225d64aaacce24ce8653

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file (2).exe
Size

100KB
MD5

947740d3bc01db29b14d1752e20775c7
SHA1

408847d6c160f4ad377a1844f88bba43ca470f82
SHA256

cd7843ba1ae94328aeecfe27eff4fc3e449f297116760a37ebb72a13525e0638
SHA512

dde21adca681cb489ac12412d41ba6ad9bd997f5ccc4f0307630373ea6c68d67596105c38446958ff0d5276159fa9e45d8e566b79f1c41ede2b7c010bab3b1c0
SSDEEP

3072:UvE3ZxbErzsP2igyL5iolnJ3F+sNYFfP:UE0rzsPLQmNE

Score

10^/10

defense_evasion discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

module.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" module.exe
Executes dropped EXE 1 IoCs

Processes:

module.exe

pid process

4144 module.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
4144	module.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

file (2).exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Module = "%ALLUSERSPROFILE%\\Media\\module.exe"	file (2).exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

module.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	module.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	module.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
defense_evasion

SIP and Trust Provider Hijacking
T1553.003

Processes:

cmd.exe

description ioc process

File created C:\ProgramData\Media\module.exe:Zone.Identifier cmd.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\ProgramData\Media\module.exe:Zone.Identifier	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.exemodule.exefile (2).exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	module.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file (2).exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\ProgramData\Media\module.exe:Zone.Identifier cmd.exe

description	ioc	process
File created	C:\ProgramData\Media\module.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemodule.exe

pid	process
4724	msedge.exe
4724	msedge.exe
1652	msedge.exe
1652	msedge.exe
4524	identity_helper.exe
4524	identity_helper.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe
4144	module.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1652 msedge.exe
1652 msedge.exe
1652 msedge.exe
1652 msedge.exe
1652 msedge.exe
1652 msedge.exe
1652 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

module.exe

pid process

4144 module.exe
4144 module.exe

pid	process
4144	module.exe
4144	module.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file (2).execmd.exemsedge.exe

description	pid	process	target process
PID 2056 wrote to memory of 3176	2056	file (2).exe	cmd.exe
PID 2056 wrote to memory of 3176	2056	file (2).exe	cmd.exe
PID 2056 wrote to memory of 3176	2056	file (2).exe	cmd.exe
PID 2056 wrote to memory of 4004	2056	file (2).exe	cmd.exe
PID 2056 wrote to memory of 4004	2056	file (2).exe	cmd.exe
PID 2056 wrote to memory of 4004	2056	file (2).exe	cmd.exe
PID 2056 wrote to memory of 4144	2056	file (2).exe	module.exe
PID 2056 wrote to memory of 4144	2056	file (2).exe	module.exe
PID 2056 wrote to memory of 4144	2056	file (2).exe	module.exe
PID 3176 wrote to memory of 1652	3176	cmd.exe	msedge.exe
PID 3176 wrote to memory of 1652	3176	cmd.exe	msedge.exe
PID 1652 wrote to memory of 652	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 652	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 3024	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 4724	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 4724	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 2344	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 2344	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 2344	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 2344	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 2344	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 2344	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 2344	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 2344	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 2344	1652	msedge.exe	msedge.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

module.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	module.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	module.exe

C:\Users\Admin\AppData\Local\Temp\file (2).exe
"C:\Users\Admin\AppData\Local\Temp\file (2).exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\cmd.exe
  /c start http://www.xxxstash.com
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.xxxstash.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff8f046f8,0x7ffff8f04708,0x7ffff8f04718
      4⤵
      PID:652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15362261244501175495,17628141899996270957,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
      4⤵
      PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\Media\rdb.bat
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:4004
- C:\ProgramData\Media\module.exe
  -wait
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Media\module.exe

Filesize
100KB

MD5
947740d3bc01db29b14d1752e20775c7

SHA1
408847d6c160f4ad377a1844f88bba43ca470f82

SHA256
cd7843ba1ae94328aeecfe27eff4fc3e449f297116760a37ebb72a13525e0638

SHA512
dde21adca681cb489ac12412d41ba6ad9bd997f5ccc4f0307630373ea6c68d67596105c38446958ff0d5276159fa9e45d8e566b79f1c41ede2b7c010bab3b1c0

Download Submit
C:\ProgramData\Media\module.exe:Zone.Identifier

Filesize
13B

MD5
38de427224a5082a04fe82e2bd4ea9ec

SHA1
7e4a53de1f83762dd2febd39b818e2258bc83bc1

SHA256
12f99f53144294750fe8713d580eda286f4bd95cd9c840db8ab957def8040028

SHA512
ec3f3c324eeaad91ab0efd47b3084493d863f969344fa1ba87ace1974908053d396673b44c33b4dceeef792a74ad9278e06acc27c83459af1153de52f83afcbf

Download Submit
C:\ProgramData\Media\rdb.bat

Filesize
77B

MD5
d10f631a08d4953930bdd79bc3ddd009

SHA1
8309a6decb6f6c8f8a2e2eea80fde3464e6aaf00

SHA256
047d32c8b8314c8b1fa11504d53ac22fa6c7f2b2e0088c0c7523e28214a78c4e

SHA512
99bd26c3450b197eb84f2ca8ad31d5b26bd9469aba83f795a01237833115522d5c96136e54ec0038ab4120e30269a13fca9f4e042ee695a34eb17d19489bf7ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
be534379dc01c3204fe04966befc1ae6

SHA1
f3eaec3c5bc53712e89c3699eed2ba48b648ff69

SHA256
e89e7a583a2a57d78dfd442432ee004f9f31f1e11e1a76bc485edf0a41418dda

SHA512
6e3f5f08ca16f1cc0e9f145320e97f6ced211dc4812b7d0a9180a1255fee8c228c950c3e5701e591ccf910bfa5533db46107947d7e62cad9d30ce56732e8e9ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1024B

MD5
4e3a4930a75194979af5bbe4e3372f6f

SHA1
dad204173031de2772138ffb63739fe932257103

SHA256
13b81e1b300f071b9b8f6b45daf3821e8d57cf8ae85a12920f9a4c6292142f52

SHA512
7ab5e9ac53cbaca8e8ce16739f6626d2d7d22b1165981e82cd227502a021d0972193ad94f16074e28c9db733fa3cef64b785a15142bdc135e656cc658395f47c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4aa647dc22321ef31aeaca8765e2a8ad

SHA1
0f073bed1bdd1d5bf1663aa1773ae3ba4764e7ed

SHA256
8939a18a6a5ff768ec20c51962dd86fa052b34c5a1c3faede67e9f0d5ccb846f

SHA512
6520e991d30c6ed9cd0a67043acb3566e82e661e8a570929b036929b348ad92865eeccf0b9d0407e16f678418f302f5f3a2e4807fc3286a4de7432a9cf205624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d4b2091bd6d44c53c334452e91efe2a

SHA1
cbb43ab5c11ba323bf065cdcc23954c6774d1319

SHA256
11095e1f3d710e3b955c5bb73f27918881dabe1685c2944f1e739c4b6bc0a74d

SHA512
9ecbaf3c554a0be8dfb6d35d00826dd0d79905a699c50bffca7f22c6b524400d66731e85cac401d73be614b177d7169f90f31f2c07973b30cb8131aa8aa699fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e90a9b918de518b7f4ee69fe573583d7

SHA1
1e8654f0a4f85948975ea31951391f1d7ead285f

SHA256
f475636b0192a98ef97feee2bed2696c68587af30947627f202af31588f97bad

SHA512
7e2d0926134f550568fb995804ee338db7e4fe3ce5aa0912cc3e29aaa3041a12ce42459e880d1912f970dbc8607b29c0f2614c8f1172b1d3ace71bc6ae636ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eaace97532e6af4448c582416fb79441

SHA1
fdbfe548d2ff04a636e3f11bcbb7edf33ef6d12b

SHA256
d409cb55c872a312ed70c117ad29c2a77865aafa33f5d2646e883c20070bb0b8

SHA512
7c423b781b06715617edca91e28693fed356490906a1d56870955cb23bb2173a7ce0d2d9a61305e979ec487e5c396f9b76448dcf792af4eed4c9ce97d1c9f074

Download Submit
\??\pipe\LOCAL\crashpad_1652_FZOAZRAAKABLPVMM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2056-47-0x0000000000411000-0x0000000000416000-memory.dmp

Filesize
20KB

Download
memory/2056-115-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2056-0-0x0000000000411000-0x0000000000416000-memory.dmp

Filesize
20KB

Download
memory/2056-2-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2056-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4144-126-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4144-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4144-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4144-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4144-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4144-182-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4144-223-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download