bdaejec | 680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
Size

2.7MB
MD5

32e14db7af2f7a7ff473562adab391dc
SHA1

3edb02ed9dfb773bb410c20aa509bcdbe6ad34ca
SHA256

680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167
SHA512

bbc85f497995f7bebb782ad2c69dc2558a10dd6276cfc1c8b305707c8f8aa6c4eac327c706d7376219dc717f6c19c9dafaf6563b16bd41db529e12c21bb98162
SSDEEP

49152:K5yaUm62qD9dDqnroHOrQhKTlh1d2HObA3:K5zA9cnsHIZhf2Hv

Score

10^/10

bdaejec aspackv2 backdoor discovery spyware stealer

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Bdaejec family
bdaejec

Detects Bdaejec Backdoor. 4 IoCs

Bdaejec is backdoor written in C++.

Processes:

resource	yara_rule
behavioral2/memory/2292-25-0x0000000000680000-0x0000000000689000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/2292-37-0x0000000000680000-0x0000000000689000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/2292-117-0x0000000000680000-0x0000000000689000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/3172-139-0x0000000000FA0000-0x0000000000FA9000-memory.dmp	family_bdaejec_backdoor

Drops file in Drivers directory 1 IoCs

Processes:

680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exeMicrosoftWindows.exeQFHoBh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	MicrosoftWindows.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	QFHoBh.exe

Executes dropped EXE 6 IoCs

Processes:

MicrosoftWindows.exeQFHoBh.exeMicrosoft Windows.exeQFHoBh.exeMicrosoft Windows.exeMicrosoft Windows.exe

pid process

4516 MicrosoftWindows.exe
2292 QFHoBh.exe
1228 Microsoft Windows.exe
3172 QFHoBh.exe
3164 Microsoft Windows.exe
2556 Microsoft Windows.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
4516	MicrosoftWindows.exe
2292	QFHoBh.exe
1228	Microsoft Windows.exe
3172	QFHoBh.exe
3164	Microsoft Windows.exe
2556	Microsoft Windows.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe

description	ioc	process
File opened (read-only)	\??\G:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\K:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\L:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\P:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\S:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\V:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\A:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\J:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\N:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\Q:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\R:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\W:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\Y:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\B:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\I:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\M:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\O:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\T:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\U:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\Z:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\E:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\X:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File opened (read-only)	\??\H:	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe

Drops file in System32 directory 10 IoCs

Processes:

680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exeQFHoBh.exe

description	ioc	process
File created	C:\Windows\SysWOW64\MicrosoftWindows.exe	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k4[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k5[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k1[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k2[1].rar	QFHoBh.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\k3[1].rar	QFHoBh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	QFHoBh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	QFHoBh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	QFHoBh.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	QFHoBh.exe

Drops file in Program Files directory 64 IoCs

Processes:

QFHoBh.exeQFHoBh.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	QFHoBh.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	QFHoBh.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	QFHoBh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	QFHoBh.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	QFHoBh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	QFHoBh.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
396	2556	WerFault.exe	Microsoft Windows.exe
3992	3164	WerFault.exe	Microsoft Windows.exe
376	1228	WerFault.exe	Microsoft Windows.exe
4948	2556	WerFault.exe	Microsoft Windows.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exe680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exeMicrosoftWindows.exeQFHoBh.exeWScript.execmd.exeQFHoBh.exeMicrosoft Windows.exeMicrosoft Windows.exeMicrosoft Windows.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftWindows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QFHoBh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QFHoBh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft Windows.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

QFHoBh.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	QFHoBh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	QFHoBh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	QFHoBh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	QFHoBh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	QFHoBh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	QFHoBh.exe

Modifies registry class 1 IoCs

Processes:

MicrosoftWindows.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings MicrosoftWindows.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	MicrosoftWindows.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exeMicrosoftWindows.exeMicrosoft Windows.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1844	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
1844	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
4516	MicrosoftWindows.exe
4516	MicrosoftWindows.exe
1228	Microsoft Windows.exe
1228	Microsoft Windows.exe
4516	MicrosoftWindows.exe
4516	MicrosoftWindows.exe
5004	msedge.exe
5004	msedge.exe
1316	msedge.exe
1316	msedge.exe
3172	identity_helper.exe
3172	identity_helper.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1316 msedge.exe
1316 msedge.exe
1316 msedge.exe
1316 msedge.exe
1316 msedge.exe
1316 msedge.exe
1316 msedge.exe
1316 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Microsoft Windows.exe

description pid process

Token: SeDebugPrivilege 1228 Microsoft Windows.exe
Token: SeDebugPrivilege 1228 Microsoft Windows.exe

description	pid	process
Token: SeDebugPrivilege	1228	Microsoft Windows.exe
Token: SeDebugPrivilege	1228	Microsoft Windows.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exeMicrosoftWindows.exeMicrosoft Windows.exeQFHoBh.exeQFHoBh.exemsedge.exe

description	pid	process	target process
PID 3592 wrote to memory of 1844	3592	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
PID 3592 wrote to memory of 1844	3592	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
PID 3592 wrote to memory of 1844	3592	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
PID 1844 wrote to memory of 4516	1844	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe	MicrosoftWindows.exe
PID 1844 wrote to memory of 4516	1844	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe	MicrosoftWindows.exe
PID 1844 wrote to memory of 4516	1844	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe	MicrosoftWindows.exe
PID 4516 wrote to memory of 2292	4516	MicrosoftWindows.exe	QFHoBh.exe
PID 4516 wrote to memory of 2292	4516	MicrosoftWindows.exe	QFHoBh.exe
PID 4516 wrote to memory of 2292	4516	MicrosoftWindows.exe	QFHoBh.exe
PID 1228 wrote to memory of 3172	1228	Microsoft Windows.exe	QFHoBh.exe
PID 1228 wrote to memory of 3172	1228	Microsoft Windows.exe	QFHoBh.exe
PID 1228 wrote to memory of 3172	1228	Microsoft Windows.exe	QFHoBh.exe
PID 1228 wrote to memory of 3164	1228	Microsoft Windows.exe	Microsoft Windows.exe
PID 1228 wrote to memory of 3164	1228	Microsoft Windows.exe	Microsoft Windows.exe
PID 1228 wrote to memory of 3164	1228	Microsoft Windows.exe	Microsoft Windows.exe
PID 1228 wrote to memory of 2556	1228	Microsoft Windows.exe	Microsoft Windows.exe
PID 1228 wrote to memory of 2556	1228	Microsoft Windows.exe	Microsoft Windows.exe
PID 1228 wrote to memory of 2556	1228	Microsoft Windows.exe	Microsoft Windows.exe
PID 4516 wrote to memory of 4448	4516	MicrosoftWindows.exe	WScript.exe
PID 4516 wrote to memory of 4448	4516	MicrosoftWindows.exe	WScript.exe
PID 4516 wrote to memory of 4448	4516	MicrosoftWindows.exe	WScript.exe
PID 2292 wrote to memory of 2492	2292	QFHoBh.exe	cmd.exe
PID 2292 wrote to memory of 2492	2292	QFHoBh.exe	cmd.exe
PID 2292 wrote to memory of 2492	2292	QFHoBh.exe	cmd.exe
PID 3172 wrote to memory of 4720	3172	QFHoBh.exe	cmd.exe
PID 3172 wrote to memory of 4720	3172	QFHoBh.exe	cmd.exe
PID 3172 wrote to memory of 4720	3172	QFHoBh.exe	cmd.exe
PID 1844 wrote to memory of 1316	1844	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe	msedge.exe
PID 1844 wrote to memory of 1316	1844	680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe	msedge.exe
PID 1316 wrote to memory of 3600	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 3600	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe
PID 1316 wrote to memory of 4812	1316	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
"C:\Users\Admin\AppData\Local\Temp\680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
  "C:\Users\Admin\AppData\Local\Temp\680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe" Master
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\MicrosoftWindows.exe
    "C:\Windows\System32\MicrosoftWindows.exe" C:\Users\Admin\AppData\Local\Temp\680bcd0edd2947879e510ac367d5883fc6683bb8a6913c95b99a94a4441a2167.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe
      C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1ce05a14.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\2724.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.35my.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7fffe73a46f8,0x7fffe73a4708,0x7fffe73a4718
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:8
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6434026656184258532,12715065586680771407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3592 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5088

C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe
"C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\TEMP\QFHoBh.exe
  C:\Windows\TEMP\QFHoBh.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\TEMP\14383112.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4720
- C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe
  "C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe" Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 456
    3⤵
    - Program crash
    PID:3992
- C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe
  "C:\Program Files (x86)\Microsoft Zpaxhu\Microsoft Windows.exe" Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 452
    3⤵
    - Program crash
    PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 472
    3⤵
    - Program crash
    PID:4948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 556
  2⤵
  - Program crash
  PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2556 -ip 2556
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3164 -ip 3164
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1228 -ip 1228
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2556 -ip 2556
1⤵
PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\2724.vbs

Filesize
500B

MD5
db6d4ab31c682c46ff351e92753a8a09

SHA1
99e4945e61c87d7b547f65e9001265ec9a55aa7d

SHA256
ede31ad2241c0a027f9b4296a9181862782b54a93ff47357725e66cd6f9a6312

SHA512
1f72e46ef5414d08e137e7cd6a482099e1a5e3c540dfccedfa214e188474929b4e535c39f39ccfb5ca958d218ba0a02f4dd45b288f4ea905cd22be6f063aa06d

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
31KB

MD5
5f604436b12b7e475c714b28f52a252f

SHA1
8c95154a9307de8edd754b84073fcca964c5344c

SHA256
3ec9a90564ae72459cd9e17748570f169fe256d08cdf6cd17ed6135145505354

SHA512
9e5d96aff4847ccecff9b1c01419c4bb181886ed76cccfcd1dd0e4d5bad86179ecd43ea051ff794356e686e62bbfc3bd9c0e0cd95e48fd18600ba63ae8150cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
38fe0a148dc6fbedaa6c8de730d6696c

SHA1
4df6c14edc61c93eed98d24ef40893dd76308820

SHA256
220c6a0ea6d72054152649d2a7aeff2d729ecd775fc1434e9854f6c95bffa545

SHA512
424bd54458d81b03504761cdf0b6213991dddbbd1fd159055638fec111b1f4b8833e4226f4dc029cdf6fa783392a3168c2b89dd0529f20fc9a8936493b73f5eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
386B

MD5
f3757ca8815ab2725c18a6e7bef6c629

SHA1
43111a4af9e602c072c441e38cefaa4ba829016c

SHA256
f229a42480bd2ea78995e68920dc7b406cb16cf6794ec593b98007117aeaa864

SHA512
cdbb4fbf56237c1db8923c560f3683a41eb6f04437dc416fd0cba1a9c3384c21158249e705c93535ac12e842bb18b5822c681b16c4dc44ba76b10fa1220c60bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8227714e7f289b6d22ea939f574bbd71

SHA1
707b75ab4036f260fb1de37b2513a99cd53d2e8e

SHA256
b4740ec8c135c2d18568f6f9c9a446be2bb6cc8ff3aa93d720a32e459602ccc0

SHA512
53005119485a11071af2365479e799f5873121d28e43c6895fae39a6fc486ad99ad372a78573fa66f220cc56044803424bbd276080ac947ce9ae11eefe12a36f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4dc7fb1139f3c34bec92e30eb61f8309

SHA1
a29ee387df4dc2f854cdec4809ee2b4520bb2603

SHA256
18563d29b9b0b335e3d6f8a8a9dda20cbf7708dc42f70a4eba4a713138fd4b8e

SHA512
0f79e1b52e22f133fd745aa99ebfcc84bf2d4358d1486d20ecaffe5760a8d9f4776be35301d529dbb26ac7d469d1078cbbcaa44d783b8209f3a62a6e41529e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3e752b5-751b-4ca1-99aa-97dfb78eac8b.tmp

Filesize
5KB

MD5
b0e3eba1651fee1a4eaf1d5d1c2f997a

SHA1
d964044cdd1d68c4cb9d961144c9b476578b7fa7

SHA256
b2903a045ec5a1343c4517f7ee8adb1865941e2db2ea6ae5170a34dd16165aa4

SHA512
10550c5ef24ad3b4fab0b17431192119f4e1d18325ef13374fafab17678a12d9fe8a9b36f5dfc293894b242492c9ad9af3062fd229009e7d584eeb15b3c2df2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b14f3e3046185b76444f25b8569e0adf

SHA1
c75a028e1a2724fe7580dae985d7232fb65a884b

SHA256
0ca8ac8edce0077691a2c83d5938fc4491ea6ec4cd06e14506480c03a3045353

SHA512
5fc456b24e5a9365cb9d7dcb04970c3822b119e5c703351c038c0bb575eab105877c956168f1522994acc0bff1687524d0f1f8028216c2d3ebd7b056c2a4fede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKYZDMA5\k2[1].rar

Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1ce05a14.bat

Filesize
187B

MD5
e63e61e03c8cc266161528046575e5f8

SHA1
3caf9821d587795247c80bdfe99c9998ef832239

SHA256
8151b3cb83eaf45984fba3fa6fa87d96daf8242f5bd938337a8a803d968ee7f4

SHA512
71c98c472454661309c37cdae756fafce7304a6dba22f9b6583a313c13e65e9680813b1d33739a809aad80cf9131bb9b4dd7da462f9a59d992e3f780ad9867f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7790241E.exe

Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\QFHoBh.exe

Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Windows\SysWOW64\MicrosoftWindows.exe

Filesize
203KB

MD5
44ac4d8a1dd1c157c2cc064df56c1708

SHA1
ec82794ec83453d400a79df923a1b65a5507d243

SHA256
3b5acacb66902a70cdd388ae3e084e1e0c3f233a2be6c5636cd143acd0f671b1

SHA512
b4bfc3775be5847c6467bb5f4630187557fc126a30686374095c0bc6a0fc93dd4cfd9739f02ac8af260f1e84c4d6174d7dfa36df56ba6b7d13af189b799b04e9

Download Submit
C:\Windows\TEMP\14383112.bat

Filesize
133B

MD5
778c2a0b2d3a55bbb178ac2b9a34ed43

SHA1
4b5025eb157d10ce806fa46ffb7d906117c00d9f

SHA256
f5dce3e0803be2217154587dd6adf00074317749bb57bd6d2363a6977a27d62e

SHA512
07fe125cf618b67e8b8814a5da4795c858a02b40a29389657d1f0aaa0e412cc0ec0885eb7ed52e3ad84b005439ca016e841ae669344f5ed006633bf45b686a65

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
7777f28ae3ef3aa14cccc1cc0be67e61

SHA1
d2c759e3b1a8547c8bbc736902e4b0f767a23aae

SHA256
9f57bd820aaaf6361970c355b1c2288bcb07cd71e7fc66e7847919ebc58779c5

SHA512
31f6a224b3a35c2b7c9e89cd43b53e537a9a731740a590d8631d37ef9cf2d95c5cc71040806d616f4143ce1f078f27f7cd917e2dd646332b31fe18b5a8b951cd

Download Submit
\??\pipe\LOCAL\crashpad_1316_WXTWMMLVOGCRJMEA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1228-42-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1228-41-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1228-126-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1844-31-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1844-141-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/1844-28-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/1844-1-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/2292-37-0x0000000000680000-0x0000000000689000-memory.dmp

Filesize
36KB

Download
memory/2292-25-0x0000000000680000-0x0000000000689000-memory.dmp

Filesize
36KB

Download
memory/2292-117-0x0000000000680000-0x0000000000689000-memory.dmp

Filesize
36KB

Download
memory/2556-83-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/2556-85-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/2556-82-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/2556-81-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/3164-84-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/3172-139-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

Filesize
36KB

Download
memory/3172-47-0x0000000000FA0000-0x0000000000FA9000-memory.dmp

Filesize
36KB

Download
memory/3592-0-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/3592-2-0x0000000000400000-0x00000000006C4000-memory.dmp

Filesize
2.8MB

Download
memory/4516-106-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4516-29-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4516-18-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4516-19-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/4516-17-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4516-16-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download