azorult | 100d0d12257920948c65d4de3a1d6bd57acbb1a58d051ca866ae19a50553b693

Analysis

max time kernel
170s
max time network
169s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
01-12-2024 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Microsoft_keygen_by_KeyGenGuru.zip
Size

5.1MB
MD5

0f58dd34aa5683287638c896275288ec
SHA1

71f1e137aec2a8daba83d6fab655c6ed1f59b472
SHA256

100d0d12257920948c65d4de3a1d6bd57acbb1a58d051ca866ae19a50553b693
SHA512

08798f7568e6366ea1374c0a90bcc2b6ef2f71a257fa8a58842eae9a5eaa6c2ea2b9c785b086842321624f8538ccc1401c04a4e871f231f0811f939dd196b17d
SSDEEP

98304:B+EbPCDOdcEOMj7QXHHWRcgi6xzlRdmOgTEmHfmvcamCpbby6p1FyBad:BNgecEOMjAipiGbdmOWtkjX/LyO

Score

10^/10

azorult pony collection credential_access discovery infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

azorult

http://upqx.ru/1210776429.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Azorult family
azorult
Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Executes dropped EXE 8 IoCs

Processes:

Microsoft_keygen_by_KeyGenGuru.exekeygen-pj.exekeygen-step-1.exekey.exeMicrosoft_keygen_by_KeyGenGuru.exekeygen-pj.exekeygen-step-1.exekey.exe

pid	Process
4344	Microsoft_keygen_by_KeyGenGuru.exe
3048	keygen-pj.exe
840	keygen-step-1.exe
5028	key.exe
2892	Microsoft_keygen_by_KeyGenGuru.exe
4456	keygen-pj.exe
3744	keygen-step-1.exe
3908	key.exe

Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid	Process
924	rundll32.exe
4208	rundll32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

Processes:

key.exekey.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	key.exe
Key opened	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	key.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

Processes:

key.exekey.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	key.exe
Key opened	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	key.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

key.exekeygen-pj.exekey.exekeygen-pj.exekeygen-step-1.exerundll32.execmd.exekeygen-step-1.exerundll32.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	key.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen-pj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	key.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen-pj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen-step-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen-step-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 63 IoCs

Processes:

BackgroundTransferHost.exeOpenWith.execmd.execmd.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CRLs	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CTLs	BackgroundTransferHost.exe
Key created	\Registry\User\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\NotificationData	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CTLs	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CRLs	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\Certificates	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\Certificates	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CTLs	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\Certificates	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CTLs	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c0031000000000047597963110050524f4752417e310000740009000400efbec5525961815940672e0000003f0000000000010000000000000000004a00000000009d870f00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CRLs	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CRLs	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\Certificates	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	Process
2088	msedge.exe
2088	msedge.exe
2032	msedge.exe
2032	msedge.exe
2508	msedge.exe
2508	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exeOpenWith.exe

pid	Process
3420	7zFM.exe
4144	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exekey.exekey.exe

description	pid	Process
Token: SeRestorePrivilege	3420	7zFM.exe
Token: 35	3420	7zFM.exe
Token: SeSecurityPrivilege	3420	7zFM.exe
Token: SeSecurityPrivilege	3420	7zFM.exe
Token: SeImpersonatePrivilege	5028	key.exe
Token: SeTcbPrivilege	5028	key.exe
Token: SeChangeNotifyPrivilege	5028	key.exe
Token: SeCreateTokenPrivilege	5028	key.exe
Token: SeBackupPrivilege	5028	key.exe
Token: SeRestorePrivilege	5028	key.exe
Token: SeIncreaseQuotaPrivilege	5028	key.exe
Token: SeAssignPrimaryTokenPrivilege	5028	key.exe
Token: SeImpersonatePrivilege	5028	key.exe
Token: SeTcbPrivilege	5028	key.exe
Token: SeChangeNotifyPrivilege	5028	key.exe
Token: SeCreateTokenPrivilege	5028	key.exe
Token: SeBackupPrivilege	5028	key.exe
Token: SeRestorePrivilege	5028	key.exe
Token: SeIncreaseQuotaPrivilege	5028	key.exe
Token: SeAssignPrimaryTokenPrivilege	5028	key.exe
Token: SeImpersonatePrivilege	5028	key.exe
Token: SeTcbPrivilege	5028	key.exe
Token: SeChangeNotifyPrivilege	5028	key.exe
Token: SeCreateTokenPrivilege	5028	key.exe
Token: SeBackupPrivilege	5028	key.exe
Token: SeRestorePrivilege	5028	key.exe
Token: SeIncreaseQuotaPrivilege	5028	key.exe
Token: SeAssignPrimaryTokenPrivilege	5028	key.exe
Token: SeImpersonatePrivilege	5028	key.exe
Token: SeTcbPrivilege	5028	key.exe
Token: SeChangeNotifyPrivilege	5028	key.exe
Token: SeCreateTokenPrivilege	5028	key.exe
Token: SeBackupPrivilege	5028	key.exe
Token: SeRestorePrivilege	5028	key.exe
Token: SeIncreaseQuotaPrivilege	5028	key.exe
Token: SeAssignPrimaryTokenPrivilege	5028	key.exe
Token: SeImpersonatePrivilege	5028	key.exe
Token: SeTcbPrivilege	5028	key.exe
Token: SeChangeNotifyPrivilege	5028	key.exe
Token: SeCreateTokenPrivilege	5028	key.exe
Token: SeBackupPrivilege	5028	key.exe
Token: SeRestorePrivilege	5028	key.exe
Token: SeIncreaseQuotaPrivilege	5028	key.exe
Token: SeAssignPrimaryTokenPrivilege	5028	key.exe
Token: SeImpersonatePrivilege	5028	key.exe
Token: SeTcbPrivilege	5028	key.exe
Token: SeChangeNotifyPrivilege	5028	key.exe
Token: SeCreateTokenPrivilege	5028	key.exe
Token: SeBackupPrivilege	5028	key.exe
Token: SeRestorePrivilege	5028	key.exe
Token: SeIncreaseQuotaPrivilege	5028	key.exe
Token: SeAssignPrimaryTokenPrivilege	5028	key.exe
Token: SeImpersonatePrivilege	3908	key.exe
Token: SeTcbPrivilege	3908	key.exe
Token: SeChangeNotifyPrivilege	3908	key.exe
Token: SeCreateTokenPrivilege	3908	key.exe
Token: SeBackupPrivilege	3908	key.exe
Token: SeRestorePrivilege	3908	key.exe
Token: SeIncreaseQuotaPrivilege	3908	key.exe
Token: SeAssignPrimaryTokenPrivilege	3908	key.exe
Token: SeImpersonatePrivilege	3908	key.exe
Token: SeTcbPrivilege	3908	key.exe
Token: SeChangeNotifyPrivilege	3908	key.exe
Token: SeCreateTokenPrivilege	3908	key.exe

Suspicious use of FindShellTrayWindow 30 IoCs

Processes:

7zFM.exehelppane.exemsedge.exe

pid	Process
3420	7zFM.exe
3420	7zFM.exe
3420	7zFM.exe
3420	7zFM.exe
1520	helppane.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

Processes:

helppane.exeOpenWith.exe

pid	Process
1520	helppane.exe
1520	helppane.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe
4144	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Microsoft_keygen_by_KeyGenGuru.execmd.execontrol.exerundll32.exekeygen-pj.exekey.exeMicrosoft_keygen_by_KeyGenGuru.execmd.exekeygen-pj.execontrol.exerundll32.exekey.exehelppane.exemsedge.exe

description	pid	Process	procid_target
PID 4344 wrote to memory of 3540	4344	Microsoft_keygen_by_KeyGenGuru.exe	83
PID 4344 wrote to memory of 3540	4344	Microsoft_keygen_by_KeyGenGuru.exe	83
PID 3540 wrote to memory of 3048	3540	cmd.exe	85
PID 3540 wrote to memory of 3048	3540	cmd.exe	85
PID 3540 wrote to memory of 3048	3540	cmd.exe	85
PID 3540 wrote to memory of 840	3540	cmd.exe	86
PID 3540 wrote to memory of 840	3540	cmd.exe	86
PID 3540 wrote to memory of 840	3540	cmd.exe	86
PID 3540 wrote to memory of 3644	3540	cmd.exe	87
PID 3540 wrote to memory of 3644	3540	cmd.exe	87
PID 3644 wrote to memory of 2196	3644	control.exe	88
PID 3644 wrote to memory of 2196	3644	control.exe	88
PID 2196 wrote to memory of 924	2196	rundll32.exe	89
PID 2196 wrote to memory of 924	2196	rundll32.exe	89
PID 2196 wrote to memory of 924	2196	rundll32.exe	89
PID 3048 wrote to memory of 5028	3048	keygen-pj.exe	90
PID 3048 wrote to memory of 5028	3048	keygen-pj.exe	90
PID 3048 wrote to memory of 5028	3048	keygen-pj.exe	90
PID 5028 wrote to memory of 4772	5028	key.exe	91
PID 5028 wrote to memory of 4772	5028	key.exe	91
PID 5028 wrote to memory of 4772	5028	key.exe	91
PID 2892 wrote to memory of 3780	2892	Microsoft_keygen_by_KeyGenGuru.exe	94
PID 2892 wrote to memory of 3780	2892	Microsoft_keygen_by_KeyGenGuru.exe	94
PID 3780 wrote to memory of 4456	3780	cmd.exe	96
PID 3780 wrote to memory of 4456	3780	cmd.exe	96
PID 3780 wrote to memory of 4456	3780	cmd.exe	96
PID 3780 wrote to memory of 3744	3780	cmd.exe	97
PID 3780 wrote to memory of 3744	3780	cmd.exe	97
PID 3780 wrote to memory of 3744	3780	cmd.exe	97
PID 3780 wrote to memory of 3056	3780	cmd.exe	98
PID 3780 wrote to memory of 3056	3780	cmd.exe	98
PID 4456 wrote to memory of 3908	4456	keygen-pj.exe	99
PID 4456 wrote to memory of 3908	4456	keygen-pj.exe	99
PID 4456 wrote to memory of 3908	4456	keygen-pj.exe	99
PID 3056 wrote to memory of 4452	3056	control.exe	100
PID 3056 wrote to memory of 4452	3056	control.exe	100
PID 4452 wrote to memory of 4208	4452	rundll32.exe	101
PID 4452 wrote to memory of 4208	4452	rundll32.exe	101
PID 4452 wrote to memory of 4208	4452	rundll32.exe	101
PID 3908 wrote to memory of 1068	3908	key.exe	102
PID 3908 wrote to memory of 1068	3908	key.exe	102
PID 3908 wrote to memory of 1068	3908	key.exe	102
PID 1520 wrote to memory of 2032	1520	helppane.exe	107
PID 1520 wrote to memory of 2032	1520	helppane.exe	107
PID 2032 wrote to memory of 1120	2032	msedge.exe	108
PID 2032 wrote to memory of 1120	2032	msedge.exe	108
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109
PID 2032 wrote to memory of 4148	2032	msedge.exe	109

outlook_win_path 1 IoCs

Processes:

key.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	key.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Microsoft_keygen_by_KeyGenGuru.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3420

C:\Users\Admin\Desktop\Microsoft_keygen_by_KeyGenGuru.exe
"C:\Users\Admin\Desktop\Microsoft_keygen_by_KeyGenGuru.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pj.exe
    keygen-pj.exe -pAevKviq48c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook accounts
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240674937.bat" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:840
- - C:\Windows\System32\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2196
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:924

C:\Users\Admin\Desktop\Microsoft_keygen_by_KeyGenGuru.exe
"C:\Users\Admin\Desktop\Microsoft_keygen_by_KeyGenGuru.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pj.exe
    keygen-pj.exe -pAevKviq48c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook accounts
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_win_path
      PID:3908
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240688046.bat" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1068
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3744
- - C:\Windows\System32\control.exe
    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4208

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3176

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528882
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8eac33cb8,0x7ff8eac33cc8,0x7ff8eac33cd8
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2314734974445586615,51843978309065380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
269d3bd53194099f8caec1187637a60c

SHA1
64132af49a58fd0f8727ad97326c70f88bee269a

SHA256
13f1a66ba37dc1b62c50009830cb32e04588a155aa74d8d934a1ada3945db272

SHA512
6bb015b475bd75e98a4478be3bbabb1084dade95ef0ee78094a6ef41350b949fc0e9fcd6bef721fd752df7d90896d9a1b28c778921f050e10df9dee3bea33d80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94bb5b23272e67d16dfda24fbc100fee

SHA1
63ee201e8aa8868a0931c7542cdcb2657b77ef62

SHA256
2b16926d8d3a27c49c48341442229a203bb488a6f8ba871a21816f8b3bbf4417

SHA512
f9d76bfcc4b7b594c74fafa277ad1d1923cb9f38adfb1c3c2128cd468ff2b537a667fe9a37b74da282955d2694c82e276fd338e1807369b144bbb509405cb5e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e8bf4c957ada67bde0e831101808f94

SHA1
b752929744d14a240c4accb95e04c64595298671

SHA256
b9063fe46dd35999b963cc7fa071e6eb37257066536ad65fd75b78a7d52e3dbb

SHA512
deab5a8e08dc7632f0a81a92c995aaf1d499b4f145811855919f5f2c0d34e3c2af978afb0ec39a02e678ff068ca37c77736aaa4bc74e7aeb2dc4a677684412e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d72958be34c59ad951f4d976151dd440

SHA1
055e1b26132aff50a8afc1811998f3dc5ebb5522

SHA256
a9c6d87090222baa0b4defc2b0ce461b24f4f8c33199c2ed64333fa7810cb491

SHA512
756e382febb74c715ea0c48983220e12bbabdfef0ebce9b612433222070c4ee26e5042f55d733667fc73c3dd4125cb45b670909bd81aec207da8a7474c0df563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
840dbdd280c71680cd39d281d3566c85

SHA1
b8fa1fdf67debaa831a40ef70f6fd62d9561f9d7

SHA256
4170d3f4631693e136e342a0d20cfa1cb097e07215b70ac749ec2c5dcbe816e7

SHA512
ded53d765ede36a7f62c6d168dcd49db34397282ec43979438b4a3b429d3c2b9f19d87e180000ea5eae05fcc5fbd90b36c3837f92d5a76f4058716803096d162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
228e4f97f8adb199c366393ce3bdd893

SHA1
6c835764e9168f90d78f0befd1a8ed7fe02793ba

SHA256
f410826b5df25b031ba40d60a5725c8bcc37e80fabb1a50b8f2c6cfd3a14c9a9

SHA512
9d024969244fc3a4679b002839ba187ac4c62458432c69be42f7ba8b9c4a75a2d722e112b7e63731d830a749b0b76dbdcb173befddd176039313251245dc3aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
cbef57d0104bcf0e02a5418f29140ac5

SHA1
178f67204a0328a47b13e4ee401f7a3fcd42a6a3

SHA256
ec6df7442e93652f6a566aa5cb59f7bdbe566f0135f5868a5549a2d950940d55

SHA512
6be5a33583fa6e891545398e822a96bf95f4a8914c04e78bb2289bf4a0927c5156ce7e4415c2ebc73e4df3267a00f69204a9526d664834942a267b63fd32ad52

Download Submit
C:\Users\Admin\AppData\Local\Temp\240674937.bat

Filesize
94B

MD5
3880eeb1c736d853eb13b44898b718ab

SHA1
4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

SHA256
936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

SHA512
3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pj.exe

Filesize
363KB

MD5
c0f34f38475aa244c9c8696aeed709a5

SHA1
0194b56c80c4b5192873400fdc96ce7d8df682a2

SHA256
831c985a5c9cc76c7c3de456f2eafeeba65a8930ef5e2aecc69fc7bd739f1046

SHA512
15defe7601a9d49325719b746422ddc60492935d3e34db058ed7f726cfeff0b3dac6faf2bcb9113ce14bdf9e8d295bef33931fd23e58c995cc6a4f42fa310ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe

Filesize
112KB

MD5
43eb47b71c9f1003adc2d0f108d2679c

SHA1
5965eb51d289dc79ab56cb995d47f371472d4846

SHA256
913ee402508d3b9e7e55e1051f16a358ce78c19b4e07c6f234f4b73602802fa1

SHA512
7713cfcf2e1aae2ddc4dab14f4f7f1a4f5a414f87f75a2371fe261edceb9882b935a6044dd0fd1b88fc11cc9b044672fb14a91987806e3afff9df74fd6f5eee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl

Filesize
4.9MB

MD5
b8e8cf54274c487168a8d2e1278e58cb

SHA1
4b3f16c7a6b7517ea2d892290a4aabb0ba668251

SHA256
cfb85da2f3317e48ea0feb5328639003890bce1397810125158a34f8ff70d643

SHA512
3db397c848932929b713246c339cf8e02aead56de1bb56c9a65b752a3ab89dcdbf1a2803c763e8a3cc5de312ec5ed94c2575a7c486b05b1d8f1f2c4bb9047f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat

Filesize
97B

MD5
b7da5b5251bfd8f57cbac943155601a9

SHA1
133751b2b7a68a92ad1e21417dd4d2b1d44cc2da

SHA256
023d11aa3cbc04bc1591c0bb608f35da7c124f8a30c57accaf6be067b889c2ee

SHA512
7e71857c603dee06fc7a63a8a0e7cfb7f18d24b676c0a3df45f5b011f638a84faf4bb5d69ebc2c5a998482c4bbad1b726c43aa6e5669d3762f263a56d4e47368

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe

Filesize
103KB

MD5
2fbf80a7ba32f036bb97a2d0d909283c

SHA1
ed00a832320f3806ef3ecacfb54356e55b8e713f

SHA256
aaa583789b2a7d918ab2654f48b2f401588f43f8b835ea176ea4276c59bed4ee

SHA512
a74ec6ffc270d3800f673aa83a76d6dc59857a71791470a4e09653bbfc18ec192b8949566ab15adaf923a3f9b54d568f6de93ad36df70357450d3effb09160ef

Download Submit
C:\Users\Admin\Desktop\Microsoft_keygen_by_KeyGenGuru.exe

Filesize
5.2MB

MD5
465f3765f16094b07393a238b6d07ae1

SHA1
ae4b7610b3d7c20da9b51f156ecda96bcb6f6e0b

SHA256
b5435e8a26968c4e039b6ac17b3f76a31a2064e9a270b66dd302e08a0f64b15c

SHA512
5653cdd24d48cfb1ad862bd06d58266b53e966b23b8955621cc50a9c58601a05fefe8793546d75ae8fc4457e3196d13c0b8669b4eb4a605d7847bde7cef9a453

Download Submit
\??\pipe\LOCAL\crashpad_2032_STJKWXLWZBPACSAE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/840-29-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3744-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download