hxxps://github[.]com/AyuGram/AyuGramDesktop

Analysis

max time kernel
128s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03-12-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/AyuGram/AyuGramDesktop

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

Processes:

AyuGram.exe

pid	Process
2796	AyuGram.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

AyuGram.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	AyuGram.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
13	raw.githubusercontent.com
23	raw.githubusercontent.com
24	raw.githubusercontent.com
25	raw.githubusercontent.com
26	raw.githubusercontent.com
27	raw.githubusercontent.com
28	raw.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\AyuGram.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

AyuGram.exemsedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	AyuGram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AyuGram.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AyuGram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	AyuGram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	AyuGram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	AyuGram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 33 IoCs

Processes:

AyuGram.exemsedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tg	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tg\URL Protocol	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tdesktop.tonsite	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tdesktop.tonsite\shell	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tonsite	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tg\shell\open\command	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\AyuGram.tg\shell	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\AyuGram.tg\shell\open\command	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tdesktop.tonsite\shell\open\command	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tonsite\shell\open	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tonsite\shell\open\command	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\AyuGram.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\Downloads\\AyuGram.exe,1\""	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\AyuGram.tg\shell\open	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tg\DefaultIcon\ = "\"C:\\Users\\Admin\\Downloads\\AyuGram.exe,1\""	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tonsite\URL Protocol	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\AyuGram.exe\" -- \"%1\""	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\AyuGram.tg	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tg\DefaultIcon	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tdesktop.tonsite\DefaultIcon	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tonsite\shell	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\Downloads\\AyuGram.exe,1\""	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\AyuGram.tg\DefaultIcon	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tg\shell	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tdesktop.tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\Downloads\\AyuGram.exe,1\""	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tdesktop.tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\AyuGram.exe\" -- \"%1\""	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tonsite\ = "URL:TonSite Link"	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tonsite\DefaultIcon	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\AyuGram.tg\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\AyuGram.exe\" -- \"%1\""	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tg\ = "URL:Telegram Link"	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tg\shell\open	AyuGram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tg\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\AyuGram.exe\" -- \"%1\""	AyuGram.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\tdesktop.tonsite\shell\open	AyuGram.exe

NTFS ADS 4 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 70422.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AyuGram.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AyuGramDesktop-dev (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AyuGramDesktop-dev.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

AyuGram.exe

pid	Process
2796	AyuGram.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	Process
1392	msedge.exe
1392	msedge.exe
2380	msedge.exe
2380	msedge.exe
2448	msedge.exe
2448	msedge.exe
4076	identity_helper.exe
4076	identity_helper.exe
240	msedge.exe
240	msedge.exe
3352	msedge.exe
3352	msedge.exe
2476	msedge.exe
2476	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

msedge.exeAyuGram.exe

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2796	AyuGram.exe
2796	AyuGram.exe
2796	AyuGram.exe
2796	AyuGram.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AyuGram.exe

pid	Process
2796	AyuGram.exe
2796	AyuGram.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 2380 wrote to memory of 3896	2380	msedge.exe	77
PID 2380 wrote to memory of 3896	2380	msedge.exe	77
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 5036	2380	msedge.exe	78
PID 2380 wrote to memory of 1392	2380	msedge.exe	79
PID 2380 wrote to memory of 1392	2380	msedge.exe	79
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80
PID 2380 wrote to memory of 2820	2380	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/AyuGram/AyuGramDesktop
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed5e23cb8,0x7ffed5e23cc8,0x7ffed5e23cd8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,5121041966176632551,6107091854743388494,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Users\Admin\Downloads\AyuGram.exe
  "C:\Users\Admin\Downloads\AyuGram.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
25.4MB

MD5
da3cf19f88301b65ba0fb96dfeb8389d

SHA1
ad2d79a3728f3465f950272be440c2b2136d1cba

SHA256
2f6b8f01f34b79af40f2aedacd125ffb0a0a0f4b6f5cae266335d79d65e47bf0

SHA512
4a4d7bed170aec7d9662ede8e808b47fde78786706e8f4f400f79b042dd0e384c78445923e6ef15f7c0286deed8b674eb40fe6e7cae6df64311cc5931c661429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ba5cd96b0acb4517d6b9f29e7e3a9d35

SHA1
7a4708ed0c5ad6a9ed61d30d69b2f0b9b38965bf

SHA256
2c43a6c78468ea88610ef7e89c0e282a59a3563f6f09669887ae37908cd3a93f

SHA512
dd04603ba2dea358fe956bc24418c1034f5ad05f4a1e1ed8e0c42e037a9ff44ad0d3bfa926ee71d6cf1a84896d51b7960022bf12196118c083d66610424c58c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b161b56615dbe7512e16f3200526a466

SHA1
52afb85bfdb6ae2cc826b46f7fbf0a5467573f37

SHA256
07a5ada7dca1be78dbee97cec2134a9e4394f2ae912082aa9de964f02c1c7bf3

SHA512
c0b3e88318101c7ed9cbf78797c9ae1d322cc0ff19e2f17016984ea2d582891ea591cfe23902ab32ee1e2110cc084076eed5ef5508f3550ac1965562e9bf0083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
656B

MD5
6dedf5bbc9076d1d785dff0ee22c64c4

SHA1
3bc18ec646e15279ff19c25f7fdd8e61cddef052

SHA256
bf8aa662d6aa8fb59cdfdfa1904e88b87e7e218a3714af2a805ce63741314961

SHA512
e149499519830a7dbe34375547ad43acb9d0df152ad877ddebedcfe59131e5f8edf27deed13bc254a6f06162311afed8119bfc63c8135780762ffc9b17a160f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bb785c6a7d616658ca04f5b9a11d63bd

SHA1
cce57bb2308fad9a354280ae1564fbd2f17675be

SHA256
403a5938e235c9ce94c88f6d7d81f682821256adce1fcbaf9b62674e7f5897ec

SHA512
ed7bf3d677a5192746801cb26db83275cdd1046b6da777da5612cebfcfe696016cb209f34ef103c0e6bee3247aaf0824a17c06ec39bce27e9da0d575ac1408ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da67cd46cbe9a4426e6feeeb4c0f9441

SHA1
4115e63c6968d505968d17d630819a29f0ba61d3

SHA256
a93c0ed87682f8a51f5fdc4a4bbcb4f9211780a92f675904ba2986b0d2a4f803

SHA512
2793179fa317c0f4f9eafc89e7ff41876eb3f89a157e599bed4fbe244d38d9919317c0fae6793d799398f4ddb0cdb0f8c327e1edc9e13fd54520204459360bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ee330dbb2961ada19ada3c77d3d636f5

SHA1
d851cc99f44f1eea1e113a25b6649fe324af5328

SHA256
32a7f7e6adbfc729fb6dea98185de73e69bf606dc3ff10e6625e5cb670eb5c6b

SHA512
4f0c0b3cdb1ffc92e5021e3485f94886ecb2a676efe9ad0ba02435272a31b052946705ef1d0e9988d578c413f5a77534c63589a1873c8b3eed049e6769df106a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e72.TMP

Filesize
1KB

MD5
700ee88de9e7d2db5606845c1b827fe9

SHA1
132a521225d11ccd7bf9c6bee071f01036b97551

SHA256
63badfcd5d22ac64b18224a3eed4b2fc3581ad41204955835846f57798dd78db

SHA512
69f22f7ade8646fd634bf149ad956bcd28a769338ce1506ea4e54591dce9aab11f63bcd85b7cb2fcfc5264f9263507e047df959ee894e254e090fd514662ce34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8bb2d8d706a7be763c3bf47d7b80f22b

SHA1
2631ae7538e3cf279b028604882d5438cb972d43

SHA256
ed8023d357066a72edb9ff3218f3ad499f78e3975b73f9f82bdb78c9cf49d3f9

SHA512
87ae0249bdd241b83d7428d11919f51bc778be5eb546e0404a2cf82883bd78ce78ed49b3f2cba848cdc03bea7c6df679ebace0f8eb5881eba04d6503bdac73ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
879bbd4535642db69a0f78ec9953a9e2

SHA1
569069045f6b47376d2b5ebe30be0d9d02107f9f

SHA256
3f40f97e2ad19a53596aa00462c55b5ed6f0326917b9f51aa0c30a531d80304d

SHA512
acbfaa546c21f103d33a4e2992802970a2a3016e0ee0f20bae0889aedf3af1e0b5cc2daa02b62dd0c1b24a0f21db64049d6cbdb62a26f03f5d4026b246545834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b4694c7f947990f4cc03a0c3b1ee8331

SHA1
839ae5cd28ed3fd1589e028390f7bc3b1ee6100c

SHA256
8ab48cbc036a092a267477ce16fc2f8496d383d21c727cdc157af190dddd76f1

SHA512
51cda875491e814538e6c6405e0762032b44f562d2ad916173286d7651f11d5075f7d6168baaf5f9762b4113d86ee56cb7f5d44ee1b4ac04b788f619038b65fd

Download Submit
C:\Users\Admin\Downloads\AyuGramDesktop-dev.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\log_start0.txt

Filesize
925B

MD5
8afd81cb13dc356b31889564434b8007

SHA1
be81705e1c35d2a8d360c7ccd03a200cd53a9d6a

SHA256
39449219b3838d4aea41e23d6d83530d127c634fabdeffc94965fd1e8791b24b

SHA512
39d7a9a5115cb9fb148645713a20f106d1bf50f2e86ad74a463431870da8edf5550a6f878bb956b0a6ec6c5fc973821d2d54f679c13336112e6c6482df386057

Download Submit
C:\Users\Admin\Downloads\tdata\ayu_settings.json

Filesize
1KB

MD5
1fcbb597d29a1adc2746c584f3be8976

SHA1
9f9703a7d7ddf3bc31f6aa0a55086fdb718ccd5a

SHA256
0fe5342e2112bfc794cf248502c5e513e1a8b198fa60b7ec9d562d8ee47098cf

SHA512
75b69eca44a5e879171ac1f0f565dbfec807180173f7643c535a01f5983246fdfb48c948715e421412e74f263711fbd7e4d816c17731ff75bdaa55dd78f13563

Download Submit
\??\pipe\LOCAL\crashpad_2380_PKEXTRWAZLKBCQDU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit