hxxps://drive[.]google[.]com/drive/folders/1Zry70bwVx84a_nS9aYPJ6Otgueom0_KA?usp=drive_link

Resubmissions

03-12-2024 03:53

241203-efqlnsynbv 7

03-12-2024 03:48

03-12-2024 03:46

03-12-2024 03:43

03-12-2024 03:39

Analysis

max time kernel
130s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1Zry70bwVx84a_nS9aYPJ6Otgueom0_KA?usp=drive_link

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1908	444-450 branding torrent.exe
1256	444-450 branding torrent.exe
244	7za.exe

Loads dropped DLL 1 IoCs

pid	Process
4744	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
13	drive.google.com

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e592215.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI236D.tmp	msiexec.exe
File created	C:\Windows\Installer\{6CE7FA83-63AC-4C55-A397-7FC88B3DC2F2}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{6CE7FA83-63AC-4C55-A397-7FC88B3DC2F2}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e592215.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6CE7FA83-63AC-4C55-A397-7FC88B3DC2F2}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	444-450 branding torrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	444-450 branding torrent.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1060	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 498845.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\{20FCCE8C-3C31-449E-9F6E-74D516783950}\444-450 branding torrent.exe\:SmartScreen:$DATA	444-450 branding torrent.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1060	WINWORD.EXE
1060	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
2320	msedge.exe
2320	msedge.exe
4332	identity_helper.exe
4332	identity_helper.exe
3212	msedge.exe
3212	msedge.exe
3032	msiexec.exe
3032	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	244	7za.exe
Token: 35	244	7za.exe
Token: SeSecurityPrivilege	244	7za.exe
Token: SeSecurityPrivilege	244	7za.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe
Token: SeRestorePrivilege	3032	msiexec.exe
Token: SeTakeOwnershipPrivilege	3032	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE
1060	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4476	2320	msedge.exe	82
PID 2320 wrote to memory of 4476	2320	msedge.exe	82
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 112	2320	msedge.exe	83
PID 2320 wrote to memory of 4856	2320	msedge.exe	84
PID 2320 wrote to memory of 4856	2320	msedge.exe	84
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85
PID 2320 wrote to memory of 4268	2320	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1Zry70bwVx84a_nS9aYPJ6Otgueom0_KA?usp=drive_link
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff874cb46f8,0x7ff874cb4708,0x7ff874cb4718
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,7394400518796404034,7975891107047093864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- C:\Users\Admin\Downloads\444-450 branding torrent.exe
  "C:\Users\Admin\Downloads\444-450 branding torrent.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:1908
- - C:\Users\Admin\AppData\Local\Temp\{20FCCE8C-3C31-449E-9F6E-74D516783950}\444-450 branding torrent.exe
    "C:\Users\Admin\AppData\Local\Temp\{20FCCE8C-3C31-449E-9F6E-74D516783950}\444-450 branding torrent.exe" /q"C:\Users\Admin\Downloads\444-450 branding torrent.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{20FCCE8C-3C31-449E-9F6E-74D516783950}" /IS_temp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1256
  - - C:\Windows\SysWOW64\MSIEXEC.EXE
      "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{FF077DB4-139E-4C9F-B859-AD66D1CF1A56}\data.msi" SETUPEXEDIR="C:\Users\Admin\Downloads" SETUPEXENAME="444-450 branding torrent.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:324
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\system32\explorer.exe
      4⤵
      PID:2780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EA6F00F328A6D5F90A73BF762FF0A568
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4744
- C:\Users\Admin\AppData\Local\Temp\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7za.exe" x "C:\Users\Admin\AppData\Local\Temp\\data.7z" -o"C:\users\admin\desktop\railworks\" -aoa
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:244

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SearchPing.rtf" /o ""
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e592216.rbs

Filesize
1KB

MD5
1eb96091456e5948d47f238482996ed6

SHA1
d82e570149e0f1f6776650f5965b622da8e94232

SHA256
f6739114f675790f7457dbdc88e84f1e2e8f91983cdabf14b4c7735de5c1eee7

SHA512
c4b1efb59d4857c95573934e6b6d6cfe2695a2ab4f258844ca81e1dea570346b7915b2b52f67d9fe37e374733202278f08125c9aca95eebb5446db758e2a42ba

Download Submit
C:\Users\Admin\AppData\Local\Downloaded Installations\{FF077DB4-139E-4C9F-B859-AD66D1CF1A56}\data.msi

Filesize
1.4MB

MD5
2773876e2243f184a3df9c2f5f8059de

SHA1
0f6fc80aea647e90851444fc0626a7a1c114d304

SHA256
c68d8021d6dffbcfb39e1022d4c20a2b6df1a3737289b48ad3a43e2f8df4d808

SHA512
98332a06147d3a3d8a6de199790aa381055b23face042055370f189b99caf5a89e943a526fefdae5a738c788944d171f8e3300ff628fa36cdfcf14152688ce6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
25KB

MD5
ab77c85aab42e61d0557bfe285bcafc0

SHA1
ac4241859bef658513fee5ae997b08543b8029e8

SHA256
32a74d447d992c99982a6c6979935c3eeffc358bcbcf7b1843ccb8021523f398

SHA512
41aaeb6c514f1ec1e97e213739ee2f4cd731cfa17fc1bd2c0c2d6197eaa487ed4b57c8d359ddaabc8764db4e12d3000eb2e23f884aa5dad0962ee9e0ae1d02b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6c0cb391f2420f3f8ec5a3930537bc86

SHA1
5be65160b0056835bbc717b4c1e5fdb3f5d4db0c

SHA256
308ff3677a60af992a11d0f2158c146b39a6c4fcc9670358970abf72b438560a

SHA512
f26b31d37dc87e4691e8ced1801b59ea80f66546f8f11c30f01cce33658338453b11be90ea8572bf402499b85e79bb51c85acb7aa2d1c700b6fa2a20c4245ed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3afc3763bdd7dfcb53daea5d8acd1440

SHA1
fa5e266b8227c6a6c5fbd76e9effdc5184c3c04b

SHA256
92a1c0a6ca4d3903d8fea8d857327b06eb975683be7b8bc2e1a282d725b90dd9

SHA512
ade1081074453e7e40d0634fa7969e0a0e906e75918f28af71b1d5ae86cc22039b73ffec3eb57195536dcc29a3bc36953c3ae7044e0dffc8c7ab218651a22892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8f1bbfbc3118b76612d02140f988c2bc

SHA1
4624a3156a6df5ccc9886ed65660a8c0fa501dde

SHA256
bfca09845658d08862d4821d1287638bfacfd133469c8ceece84827a335f9ea1

SHA512
dda122f108906726d066579d6e2af2d228bc9af8b468c747d39d6c52ea0382d34fc1d8f38bb0918a0fef4457ef304793885ef592e18579d4b562a63e45b5b755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
247465e0e1d6a6a3c33c124c039f7a04

SHA1
de46eef82e6a27f36c87dc03272dfe0e86e4edc9

SHA256
bdcf5c259c3a21425a8ca58e291a75a9dec20230ba2d28036c7babec59533dac

SHA512
b4ca8a32d3e998c475d655da74388d06bf68a8851d97648950199503d126ff47af69dacf700e825e93e388b2a855a8d34601b36aa3c4db55ee3bd14b74cd19a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
222bd364908f64ce661393d335a7c76d

SHA1
ff11cf262ce8ce2ae02583555106acdfb723c36f

SHA256
a20bce1163119f46a557cc974d83578fdb3c9a5929e4c49d582066f5f6b63241

SHA512
c02933890189e59f73245fc6b81b26ea6c939994e84a18051bdf1d83b783a378d4f90ccb69b07dfa9fa68d7bab2db08a8207586a0014ed306ca4b065b68d522d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7be829c79298c8121700c20328427615

SHA1
3624ee02d2e8890f23bce97c6a3abd5f368e0a00

SHA256
c49a60bc36939134eb46582a3f53d8d7733aff60e8b2078d68d96b910ee9fd66

SHA512
664ecd0873ee48e84e3fb9a003c312b9fcd04c29fd0155f059c59e1c7e2259887788ed4b45658ff8b6c8ebf64acf0c763aab84f2c95c80a0a64a4956a8655976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5ff5e257c430bd7e8d3c401be6d4bd25

SHA1
6184d01bc7c844b9332658cad36ef04105a22f82

SHA256
228d5e532db1d204ed5cb54047173f7933c4d241ebc652c202ff65e1c74b88cb

SHA512
3ae4db015c9a27365bbf6ce0ef70875c68bb0b63072585c1a2bfaae12c7abcb5e511f9ba1e9bf4512d53b98fc7736b7c9c9de8855693c742c5f49dafba5df272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bee6.TMP

Filesize
1KB

MD5
7da89d6eb0c2f27356bd1eb0b7231fdc

SHA1
24d4a781f6d3012b2ed0fcff6214b7ee0308214c

SHA256
84b4f57acfc31680a2d673f9aa479ea57f8f904d3f4b4d0e8f12c96094889ba7

SHA512
2dae356024ed799231d2e8bf7a41fb01b15fd765e5154b4d997d50aea067f892fa770b854ccf9271e10631e0c5f85d4db2c9f26b89802836896a620bafefd009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b612a218aeb80de16b8bb18cdbfc7bbd

SHA1
5c7b31a84bcc170437b17ceecc5c5d88e727857c

SHA256
1f0651c97ea4347109834b54fb294b1a05c92fb4a603958df2ac4b446530c3af

SHA512
e2afaa9a4e4d7c31eb8d4fe9170dc740ba7113d4f618ee9b608511588aa50f20f8f25ee7470bc80967c2b22477a5680a0078186640a19ff98face6f4a0bcdb6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0b81e88607615454b6c19354f0e10750

SHA1
88e7c489360bd39dc2de2a0567eb7cbc088ad585

SHA256
33ae393fd1b160045684b328df06a3d8fce0e51e23e274a59b1b0e6f36c77b23

SHA512
5d637a47ba0518ae19d3b3c731aface33cce0ae305a53bcebdd2b29857dce202c266895efeb7bb78d4fce967df7de41961d4511d0b9e49034bb57fc8a6ebf7d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
10171186ceff0e69b200d00e97b9cce4

SHA1
247c4ba95b4f08e62effbf813822229a54282223

SHA256
fb3984b56ecc1c7f139f7296a0f7925dbf6837b3f55fbca8b766857f654c3050

SHA512
1861283b5b8b4d40ecc9e013cd2c5e55e1b16f84db5710e5efb13317159f7d939979c7ea465b34c230330765a5816d753f5da92031926a3ef070bf79801151d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7za.exe

Filesize
721KB

MD5
2395868a72bfe1fd5e888b679faab621

SHA1
7ab01a1e3b0ae8a0e59ff586a6777b78dbe67750

SHA256
8e679f87ba503f3dfad96266ca79de7bfe3092dc6a58c0fe0438f7d4b19f0bbd

SHA512
369b487da9dae83cdaf98ee45c056fc847a5f50585979638d9d8e8ba8511a31267307d885fd40399bf4c22461f82c60f6298bd7e31402e12bfebd0621b131222

Download Submit
C:\Users\Admin\AppData\Local\Temp\data.7z

Filesize
120KB

MD5
ffef238b6c93a4e9569f94d98b86363d

SHA1
c0d6a3f1fba49ae62b7473845c1ff1903cde4e74

SHA256
f85366d56e44d84df4ce006b7bc7618ae88213894b52eb49e3dba9425bb4e941

SHA512
64a3f17cae5d17b57abc0349d9051be066741b24fc38462b440bdbb4876461f04d03b33e3bded91a813f3c300b781e44256c5fb822b06d770f2655599ef41949

Download Submit
C:\Users\Admin\AppData\Local\Temp\{20FCCE8C-3C31-449E-9F6E-74D516783950}\0x0409.ini

Filesize
21KB

MD5
a108f0030a2cda00405281014f897241

SHA1
d112325fa45664272b08ef5e8ff8c85382ebb991

SHA256
8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

SHA512
d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

Download Submit
C:\Users\Admin\AppData\Local\Temp\{20FCCE8C-3C31-449E-9F6E-74D516783950}\Setup.INI

Filesize
5KB

MD5
9602c3d22de06ccb543e71085735bd50

SHA1
aea2b3c4eec4a14e7e37884486941283b503923b

SHA256
a2687c696a0c29249185063e9605673d72ddac552278af3bc3a523f023cb09f1

SHA512
0cd4f88238d3b316cfe14d04da54a5afa6fb6575a3bc7a1dd46ff1532ff0ee1ff4ae3645775b363aa48c75a8b45043619b232696c3f9b4fda3fd949265b269e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\{20FCCE8C-3C31-449E-9F6E-74D516783950}\_ISMSIDEL.INI

Filesize
668B

MD5
9b118c53191f68848c9b4d7a86c96316

SHA1
6ea3ba7963831365f43516f4275c7ecef6138ae6

SHA256
39fd6fe1de4743e614405f65778d6cfb9908d4cbc8d8c8657b3d9439cc4c2d3e

SHA512
1dc2c2bae9c5439f4d47e589f8e240f65f49fb1a39122ff05959f4df18f129a5fd22042eab6b6b0398e7874df8d4912a61bfbd045db9ea6b548cf65547de4fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{20FCCE8C-3C31-449E-9F6E-74D516783950}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 498845.crdownload

Filesize
1.9MB

MD5
aaf844d761c1b867fe945a4d5e077452

SHA1
28799af33ba731e3989238205bbbe69383533ea1

SHA256
aa4a601eb668d691d1bb4eb5773fa2a1987d0d0260071731d8f386616883429d

SHA512
6953ac39fcb712f2e739e1d91169db742d32a4e9c6ab54f83926858c901ffdb90d93e6bc1f20fb394cd252f74981a011ca07734b4f693df7e4989481b8a0df4c

Download Submit
C:\Windows\Installer\MSI22E0.tmp

Filesize
105KB

MD5
547edaedf124ec8848d8625fe3045bd9

SHA1
d6b69020ceaf0ad6eacab9b4f228f67c3023b423

SHA256
182eae16a648e6de8c45ea5b433b0035e257ac7e51e43f9b1afe7968e01f8a27

SHA512
74b34b9a7602513dfc6352917fd41678057a5bc0b8b3047cfd680582a76168d4dd9f160c6fa8ab7b37133bf8a81a8328cfddd50bbabf59b84defdbc8efbb6a4a

Download Submit
memory/324-411-0x00000000026B0000-0x000000000278B000-memory.dmp

Filesize
876KB

Download
memory/1060-473-0x00007FF843590000-0x00007FF8435A0000-memory.dmp

Filesize
64KB

Download
memory/1060-472-0x00007FF843590000-0x00007FF8435A0000-memory.dmp

Filesize
64KB

Download
memory/1060-474-0x00007FF843590000-0x00007FF8435A0000-memory.dmp

Filesize
64KB

Download
memory/1060-475-0x00007FF843590000-0x00007FF8435A0000-memory.dmp

Filesize
64KB

Download
memory/1060-476-0x00007FF841130000-0x00007FF841140000-memory.dmp

Filesize
64KB

Download
memory/1060-477-0x00007FF841130000-0x00007FF841140000-memory.dmp

Filesize
64KB

Download
memory/1060-471-0x00007FF843590000-0x00007FF8435A0000-memory.dmp

Filesize
64KB

Download
memory/1060-515-0x00007FF843590000-0x00007FF8435A0000-memory.dmp

Filesize
64KB

Download
memory/1060-514-0x00007FF843590000-0x00007FF8435A0000-memory.dmp

Filesize
64KB

Download
memory/1060-516-0x00007FF843590000-0x00007FF8435A0000-memory.dmp

Filesize
64KB

Download
memory/1060-517-0x00007FF843590000-0x00007FF8435A0000-memory.dmp

Filesize
64KB

Download