hxxps://drive[.]google[.]com/drive/folders/1Zry70bwVx84a_nS9aYPJ6Otgueom0_KA?usp=drive_link

Resubmissions

03/12/2024, 03:53

241203-efqlnsynbv 7

03/12/2024, 03:48

03/12/2024, 03:46

03/12/2024, 03:43

03/12/2024, 03:39

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1Zry70bwVx84a_nS9aYPJ6Otgueom0_KA?usp=drive_link

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1468	444-450 torrent.exe
4680	444-450 torrent.exe
216	7za.exe

Loads dropped DLL 1 IoCs

pid	Process
1952	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
9	drive.google.com

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e58a44a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA61E.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58a44a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6CE7FA83-63AC-4C55-A397-7FC88B3DC2F2}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA68D.tmp	msiexec.exe
File created	C:\Windows\Installer\{6CE7FA83-63AC-4C55-A397-7FC88B3DC2F2}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{6CE7FA83-63AC-4C55-A397-7FC88B3DC2F2}\ARPPRODUCTICON.exe	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	444-450 torrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	444-450 torrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "226"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 674672.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\{217DD3D6-F345-4F24-8FA6-75BF281AA8B1}\444-450 torrent.exe\:SmartScreen:$DATA	444-450 torrent.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
4988	msedge.exe
4988	msedge.exe
4040	identity_helper.exe
4040	identity_helper.exe
3272	msedge.exe
3272	msedge.exe
536	msiexec.exe
536	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2856	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2856	MSIEXEC.EXE
Token: SeSecurityPrivilege	536	msiexec.exe
Token: SeCreateTokenPrivilege	2856	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2856	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2856	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2856	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2856	MSIEXEC.EXE
Token: SeTcbPrivilege	2856	MSIEXEC.EXE
Token: SeSecurityPrivilege	2856	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2856	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2856	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2856	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2856	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2856	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2856	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2856	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2856	MSIEXEC.EXE
Token: SeBackupPrivilege	2856	MSIEXEC.EXE
Token: SeRestorePrivilege	2856	MSIEXEC.EXE
Token: SeShutdownPrivilege	2856	MSIEXEC.EXE
Token: SeDebugPrivilege	2856	MSIEXEC.EXE
Token: SeAuditPrivilege	2856	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2856	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2856	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2856	MSIEXEC.EXE
Token: SeUndockPrivilege	2856	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2856	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2856	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2856	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2856	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2856	MSIEXEC.EXE
Token: SeRestorePrivilege	536	msiexec.exe
Token: SeTakeOwnershipPrivilege	536	msiexec.exe
Token: SeRestorePrivilege	536	msiexec.exe
Token: SeTakeOwnershipPrivilege	536	msiexec.exe
Token: SeRestorePrivilege	536	msiexec.exe
Token: SeTakeOwnershipPrivilege	536	msiexec.exe
Token: SeRestorePrivilege	216	7za.exe
Token: 35	216	7za.exe
Token: SeSecurityPrivilege	216	7za.exe
Token: SeSecurityPrivilege	216	7za.exe
Token: SeRestorePrivilege	536	msiexec.exe
Token: SeTakeOwnershipPrivilege	536	msiexec.exe
Token: SeRestorePrivilege	536	msiexec.exe
Token: SeTakeOwnershipPrivilege	536	msiexec.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
2856	MSIEXEC.EXE
2856	MSIEXEC.EXE

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1432	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3024	4988	msedge.exe	82
PID 4988 wrote to memory of 3024	4988	msedge.exe	82
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 4212	4988	msedge.exe	83
PID 4988 wrote to memory of 2292	4988	msedge.exe	84
PID 4988 wrote to memory of 2292	4988	msedge.exe	84
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85
PID 4988 wrote to memory of 4068	4988	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1Zry70bwVx84a_nS9aYPJ6Otgueom0_KA?usp=drive_link
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff27a446f8,0x7fff27a44708,0x7fff27a44718
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2228,12892007754456704661,2571435767126139924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Users\Admin\Downloads\444-450 torrent.exe
  "C:\Users\Admin\Downloads\444-450 torrent.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:1468
- - C:\Users\Admin\AppData\Local\Temp\{217DD3D6-F345-4F24-8FA6-75BF281AA8B1}\444-450 torrent.exe
    "C:\Users\Admin\AppData\Local\Temp\{217DD3D6-F345-4F24-8FA6-75BF281AA8B1}\444-450 torrent.exe" /q"C:\Users\Admin\Downloads\444-450 torrent.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{217DD3D6-F345-4F24-8FA6-75BF281AA8B1}" /IS_temp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4680
  - - C:\Windows\SysWOW64\MSIEXEC.EXE
      "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{21E3CF92-BA85-48FC-B3C5-6B9C54B04DF1}\data.msi" SETUPEXEDIR="C:\Users\Admin\Downloads" SETUPEXENAME="444-450 torrent.exe"
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2856
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\system32\explorer.exe
      4⤵
      PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8DFD32A0C35400791605A341B8413C7D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1952
- C:\Users\Admin\AppData\Local\Temp\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7za.exe" x "C:\Users\Admin\AppData\Local\Temp\\data.7z" -o"C:\users\admin\desktop\railworks\" -aoa
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1456

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3951855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58a44b.rbs

Filesize
1KB

MD5
a813120e9957e6e27e127cf5c5365da7

SHA1
ac82374f3f8365220181011b674a350957fb9bcc

SHA256
7538a43fefdff335057ff62a6b53639f357366940dc3b170ac86316ca66ba624

SHA512
512afc62a5e88ca3efce100bd39ca58117163bcbd221c12b6a6d3237ad33d47ec68caee544f181910ff390c695f19b7a30ffebec6319a7731b39d6e65e6efe44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20075603-da4e-4411-8982-ab2858ffef3b.tmp

Filesize
10KB

MD5
0700b3b37b8ec94734f83f8c46c16bf7

SHA1
e16c0227e6b35bba632e7ce72eca96cab6250720

SHA256
c1055896b8f4f99fdd86a74e91921d2a23b6395e2b373a7332610aaddb3fe5bc

SHA512
c57bd726f049620994b5c500c69cf4d980a9c5badb0fc9a166ce5647d0bf7c78526ca61adabccebc9c083d1023798246c15cc37f313d092abe3fe2c38242e349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
25KB

MD5
ab77c85aab42e61d0557bfe285bcafc0

SHA1
ac4241859bef658513fee5ae997b08543b8029e8

SHA256
32a74d447d992c99982a6c6979935c3eeffc358bcbcf7b1843ccb8021523f398

SHA512
41aaeb6c514f1ec1e97e213739ee2f4cd731cfa17fc1bd2c0c2d6197eaa487ed4b57c8d359ddaabc8764db4e12d3000eb2e23f884aa5dad0962ee9e0ae1d02b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
aa418ebe35d2d275a4d00f728dc670c9

SHA1
ea1ded1286371e066519a89081cb9274d9d49767

SHA256
def56b3a352775d11ddb266ed1c34923b7c5678990ce08c798677a8c1d5e1605

SHA512
1ba92bfccf08cc702713fc97afb0dfb06ffa5a2dffcd0fd84b5d00c095b522a3bac45ec614145607f5b8d10f3ecc88474f829b5f2fdb9fb4e4af8a368dc3715c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0bc3a912dd329b94fed4739b14d494a4

SHA1
bca78853b1c67b090107fbec1492553d316e85f3

SHA256
8b874a7306900e9179db1a4485061cff65bc057b2babde9dab06b7bac0eb69cf

SHA512
993deb1501227c30f14954c7d2b80847aa5048ee9087d86390dde765ab0a97593bd6627e093844611498c5387802d8fd18af452405be65c059299f6d9f1b975f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
62c462c67f1bfda83f1e7986c7ea2613

SHA1
c1ba86b22d8b8145cae1a3193bd19e330220162f

SHA256
d74c786bab748fb6cf496e7ae3966b530f5b96600e299fdb3a16e4105c1ce6ac

SHA512
dcad8e62f21cd2707c524c90d46add3f32c0a3ffadfea74bb2b78fccb960cd89b21b80fcc9d41c5d83869f2301e032cd3b5a9ca8f6295840f5f8340bcceff3cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8aa8398352ea54eda559d3f6293710a5

SHA1
88eb8d858c9268428838f22d1ca76a2774943cca

SHA256
99773d60f249886efd3c00938e902e683c8602bd5de15f4bd586b9270031091d

SHA512
368279a6a2fe9cfc519792282262b9167cc2ec244bbb3e1f1ee75b1f613e2bac6f302e84bed6e9f21caa9721d132c915cbbe83d566e2185536edd88d3baa2c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7000d83790b8a995a883f1427c8cfe49

SHA1
a5bc31864decfb026c282e6be53c08003e2e4c8a

SHA256
866feab5b429facf4f90bfe0137ceecfd4642d328af80135244e7a5f3803f51b

SHA512
85bd08c8800190dad5897724211f6ec37e5a376af98e609b0abbdc16eccc37d25fd4b8eceb2fb6f1c770f9daadfb947481ec1d3ff4fa7ad2acc91309ff19d2ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fbdad0bc9cb92e147ec0cddd8135800

SHA1
35cd5fc6d738a95e0c4763ec5e9f6bdd5eec1571

SHA256
e8b46a978e08f684d7e89d7c3c1fdc7b7d8b683f4acb4c37eb4606e7a5e40f28

SHA512
aa873c9a1c065aba9625e07e4bec9f38c60680bc835a809bc61ee0b4b0c293aae9226f2e5a4e380afc0af0191ff3ae559a9575de683eaf949ce894923680ad67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d014a11f864b220970d2c6664a46825b

SHA1
a62d32a4153fcf84e62c27795bcdf586277761b4

SHA256
9833c9e2b07b3d4ebe6db5aed1f754303d3dc03e777c58e32e88dfff46e679b7

SHA512
71423931e601cc97e19638bf2b81b986a568ae8195a59f7950cdf329efcd18aab388282e29cab6100298b5667da920c4e893a6dc3ae8e53afc439720589199d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7za.exe

Filesize
721KB

MD5
2395868a72bfe1fd5e888b679faab621

SHA1
7ab01a1e3b0ae8a0e59ff586a6777b78dbe67750

SHA256
8e679f87ba503f3dfad96266ca79de7bfe3092dc6a58c0fe0438f7d4b19f0bbd

SHA512
369b487da9dae83cdaf98ee45c056fc847a5f50585979638d9d8e8ba8511a31267307d885fd40399bf4c22461f82c60f6298bd7e31402e12bfebd0621b131222

Download Submit
C:\Users\Admin\AppData\Local\Temp\{217DD3D6-F345-4F24-8FA6-75BF281AA8B1}\0x0409.ini

Filesize
21KB

MD5
a108f0030a2cda00405281014f897241

SHA1
d112325fa45664272b08ef5e8ff8c85382ebb991

SHA256
8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

SHA512
d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

Download Submit
C:\Users\Admin\AppData\Local\Temp\{217DD3D6-F345-4F24-8FA6-75BF281AA8B1}\Setup.INI

Filesize
5KB

MD5
c8b613c3f7ea99e2181e60924b6ad0cf

SHA1
018ff5c46aafe0d2a5fa1b780d3d4c75fa378c43

SHA256
f9476e7c6f8640e2e25cd4ce21b264ec5d8e9b2a823dbb23b62220579a53b35d

SHA512
5847487fd089495f29123e102f168f9e05fdbdff4882253e36da6717b734cb34bfc9165959e21f4d45b7534b41716b5dff42bda106985a6beb565c3ce6fef56d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{217DD3D6-F345-4F24-8FA6-75BF281AA8B1}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{217DD3D6-F345-4F24-8FA6-75BF281AA8B1}\_ISMSIDEL.INI

Filesize
632B

MD5
e903b33eda83bb8fee60b36e17e86b00

SHA1
ca8e77a07580a6edef80358d7ece2b75ea17b15b

SHA256
72e7282ef73d9214ca14df75c5c4545e3d935ea5241d35ab4ce2915221bfe5c2

SHA512
ff286f5769eaf9f623efbe8624d5e11f5aad7183aa685aec2f6ed7f9d96db8daed086a951026f6e661f0c267e6949801b61e772658c29a96da4b06435f8a48e6

Download Submit
C:\Users\Admin\Desktop\railworks\Assets\AP\C450EP\CabView\DestScreen_TPE\450_destscreen.bin

Filesize
1KB

MD5
0a1e0c0966026df188d6d91062203b86

SHA1
bda3668fd0e99900b73f70ad05819875fa364d96

SHA256
d886960e83e89dcf0f88dd0d50e2ccec15be7163b779301c4f648b26922308b4

SHA512
ed1a8aad83ee48955ea2cd66d204e2f87feb2ca980410335f878f98138d3840bb97ce49ab4b9b6e7835f6bc5cd842fc82b28e3d44f644a0b6e23fd02d685e3cc

Download Submit
C:\Users\Admin\Desktop\railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\SWT_444_AP\LocoInformation\pl\Description.html

Filesize
397B

MD5
b0be4fe10fce93d2bfc9e2ee09a18a83

SHA1
ad1cc24fe84287d253cc3de40bbc9c279110c197

SHA256
e1e56455147b18193a725cabdeb1f684a9f4c959436d7ba1a7762e7f34d5aa60

SHA512
5c0b2d209532d6c91ceb781d83a5dddace7f6e69d89e5b6b3e867c0031c7ea162a2fbdb52c5ccf75426b323bd39ad024e2821cc6324501efbf9565584808f3f7

Download Submit
C:\Windows\Installer\MSIA61E.tmp

Filesize
105KB

MD5
547edaedf124ec8848d8625fe3045bd9

SHA1
d6b69020ceaf0ad6eacab9b4f228f67c3023b423

SHA256
182eae16a648e6de8c45ea5b433b0035e257ac7e51e43f9b1afe7968e01f8a27

SHA512
74b34b9a7602513dfc6352917fd41678057a5bc0b8b3047cfd680582a76168d4dd9f160c6fa8ab7b37133bf8a81a8328cfddd50bbabf59b84defdbc8efbb6a4a

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads