Malware Analysis Report

2025-01-18 05:06

Sample ID 241214-afpbdstmgr
Target ed5a7491d26a7d1621150eee7d77a97b_JaffaCakes118
SHA256 71916efd98ebad32e60025ebb48cbc3bb8556d60a82260143580fa2b3f90c72c
Tags
discovery strela persistence stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

71916efd98ebad32e60025ebb48cbc3bb8556d60a82260143580fa2b3f90c72c

Threat Level: Known bad

The file ed5a7491d26a7d1621150eee7d77a97b_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery strela persistence stealer

Strela stealer

Strela family

Detects Strela Stealer payload

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Browser Information Discovery

Program crash

NSIS installer

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-14 00:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win7-20240729-en

Max time kernel

119s

Max time network

127s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\register-zh-TW.htm

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF48E4A1-B9AF-11EF-9188-62D153EDECD4} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440296835" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 101bd883bc4ddb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000000a4fae3dbcd0846bac46a8deefc9bbd0000000002000000000010660000000100002000000070863c10fb0cac4710efaaf3ccbb9e7638e2cb74c4f218149d6372ccb174a59f000000000e800000000200002000000040943aa499fe338980582c6468d3f2cbb3e76f6ca9738fc07e193c313d3e1b5a200000001a6ec875c25a7552332f2504d64e34368b68d543d7599a0dd74fa75162e9849940000000e335dc3a87136891bb15a64053bb2c410f5fe0568106b9f80d442e1a6e3bd164b497249fe077f95eccb1ff679997bbfb45c47001b1aa18f1ada08eb60350b4e8 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000000a4fae3dbcd0846bac46a8deefc9bbd00000000020000000000106600000001000020000000a4d35f1cd6d810cf465de4fc53e9c7af3c297b797d421f537192cbbf6b9e2e7f000000000e80000000020000200000003548d7ad9f2cf7257ad76abecb5a31b20757239f2c37a781107ef8dfeff37d389000000077f12df1d0d12889e62adba6e4cb3c94cb6070c554aebaa01d120a0980f15cb1ec74aaf6def6e91cb880ae35f9d2b45cad83b5e29b62fc3ba58c7a38ef2a9b07920fa574732e58e89222a45c475a64dc163b3dd1e070eccf7860596f493fa6ed1fad17e771ca25af25d47b7dd2ad22f6bd82b8d96012b775255dedef3abb8f89243b4eb78f5277af3828fffefe6cf28140000000fa65bea39a688b2e7bc421a2ca2c582c3142898ed7d4a67d1ce47e1f0388c573cff972294d61f47ec247f3d373dbcd8ed708579dcdb6c4c04c540c60cf4bac59 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\register-zh-TW.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab3C77.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar3CF7.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28e994ef639a40d60058d4d8f5b44e8f
SHA1 fbe340fb1def5e000ea32f07f36cf6a41e5110a7
SHA256 036205225677a6fa4503295f1a96cc397b617b1c51cbbbf97ebda2367435c985
SHA512 d225bfeb3ad93218c7fd37bdd6658633a9691726d176b5829140c147215886538cbfb9710a78438b9544da655d393f2d772e8ee6f8f1bab97c7c2c4a8327093a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c1de32eaa4234fc2ee1d9f099b8cc3a
SHA1 77bf0b13164571224c4619ab829f3548b3ae9087
SHA256 f4d89e4f77f6a10a464ac2cabf022c8744ad36ca92d072df359ee32260ccd78c
SHA512 5fa32503b23469ca94172c98e28914250210ee6bbd0534ccf6b789591456c2d1dd2bbae9e2c594baaf12475568b8afaeefb93a6a1eebd6f7636bab719767c306

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 909f76b3d5d327d4f6bc4fd46f06b3fb
SHA1 38418a59a4e4ac5dcbe4399525916d15b4b8e5c1
SHA256 29d2dabc692b175bb703f452da7b4ecd6f61a05961d550bcbaadd70671cf358f
SHA512 0d636f0ee6eed42a485946d0b99c21c026b49880cddd55ada3ae9f23a1acd53102d62bfadeeee6d866ae5cfdf487b40f474448ed57483063580787f08399f84b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 216818458568c9492988d7c35fcf7dfd
SHA1 3297e40f156dcd43120a13442a40f9e18b437361
SHA256 e041e010a86b7b629052a48dea7649d000aee06499a21b4c8dbb9bbcc5990bb0
SHA512 00cfbee55fa6bc4d5ebcd1bb27e74469773c9c984005d1b1b9c46a46df71619c7986925a9ec9dbe859fa80c29edfd28f09e263ada019c61b10f706dcef7378df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b68479e42475a88ed62c3dfbd5c596c4
SHA1 86748ee7bdba326ec1caed8f80b49826d78b587d
SHA256 142e6ab7cb83fe8e55891a50740b5ddb09c027d14acef322f22216829ee88571
SHA512 01d5360179311006866e9a499a7ee8e059b7f3e7de21e57719b93e5d8f597d19e0e8eaba418bfd6ac544dac50ca1d8066eba29043f09ec317d890fb08610e7b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a0d256441c15b13c598d10b715b9c465
SHA1 5279693d8ea0b7887c5bc2e6f458c8acf788fd5f
SHA256 733d5784883e6f42cb2388e72ff4450e88019de197bb40a2fd181c56680d6c95
SHA512 bf44f505f7fa25bab8e81d3420df58f1ccfdfcc8e603b90d062865f437cdd36f252c7b35ae39165841dfe8dc7c779e3f3084fe74cadef5a65aa3373624f5317d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f1097d91295d1fe9b53b27865feca56a
SHA1 52a98660cc63336717b08f876a4a1134d52bda49
SHA256 614d2f57c3a855a9fce7d7e845508fdbc0021f558119670d835f7d8d30bafef8
SHA512 948a565984667669aaf5fd7729634fb6776b36b452fc97518085af6a64c729ae872d6a18c7dfa01d205a784829c0669c098383bbfdc06e89b8f843aa65fca5b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6865ba0135a86a06fbad56a21bc08329
SHA1 5248823fb93f6d3381014c8fc80bf0e89f59354c
SHA256 faba4b22f49b77630a31e318ab55b75fb3ac95af1bd2d612e87747d994af5ed0
SHA512 bd75040ec93ba8e3dfb457f8e9446b1e8c111051a97b4a1f10a80bfd73201cd3dd3c714c8ad03890c454ab1412346daea81affc0d2a823c4f2d3764f02933ec9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 55de6d8a519e619c74a033bcec85e826
SHA1 ff61647dfa3a384242159cf3782b0668bef5e01c
SHA256 0231ad06cd767ed556618d2a395e7347575f5d89042a23483eceada421a1c138
SHA512 35809eb08ffda120a16b98ac980f63c8ebe9232b113a515b262008dc274666bd6d8b06a2c82631e5d8d070f309ad10e175c4ec4acfa1e00cca26e921b1fcf732

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51fbf0d263e324ac1f2a248fe27955bc
SHA1 5905e0ad40cd2316d9a8a9717ee2cdfecb83d21c
SHA256 a1cab72d99c38e38c94568fae80920df35f1ec34dba48f29a25ce66ba5f2c7f9
SHA512 8fdbb879a01aefdce795c815765c6f2823a99866435609217058c931b3fb357066794546a0ee67efeb1821ded9165ec4bb21b629be4953b396728d727184893b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e23ac2be73d158ab85cc333a9eef293
SHA1 3635806c2d4def0dd0169a799b4fb96d3d07ebc0
SHA256 02b04c316b8a9991da51b055a4071220a50e90c03ae1dc9e920e9e300a43a30d
SHA512 9cd4f5e26e71a20d8af2aa0e47faaba2144d64b126c28107f3faccb7cb130c1b9bf8da3d2c23b39ac2bc00fba1b6e2fb3691c6bf8532a06c221eb290da4b3400

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cadb6e268cca56285f08cce962ea54af
SHA1 2a94469eaa895d796396ec9808364a617a41c2b2
SHA256 8b2b13aa5b0d517dfc4bc0b7fea0851cc1c4fa811f3ebc08b83ada5728a57b29
SHA512 74d1efbbc20c11a447aec655d977879078ed5e559c9129bdc462ba073308b977c7bae7e9ab3c37ac67eb6b0679dbb72bb58232247e2060f68278810d5ba4ecb1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6339e27dd2bb62ef27a815d177649a91
SHA1 a567e65b7443c854f5f4763c80e6e2cf9ddacf9f
SHA256 36de503ce911db6c3b6344b138cbd7434237ca6653ab13e59cb44ce7e111485f
SHA512 5c9f7bc0f91ed750a210f7f8be06cd6dea1d816026912f711a89369c3a4b627b201c20c6091cfbcd1a91a3b0ca549d94ee3aa15772b3622255ea5551cda567a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f8a1c75c19eb40df7d449d3043dbdede
SHA1 8c8c90305db53b22e6e458581c32b8bfcfdda5a8
SHA256 04e09082b903f7649c2a31738537b3a8f29a681d0b7fe33387a508cf97a7aa3b
SHA512 8c5162653e9afbb8bc748688ea0b2bc19dd5e9069f6c1da6c7498fb456a3191d56b2170383b3539da93dd7ed673812a44184c1824d049f7b53925fa85d36728c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b9dd913951a5082ccbd66de9ebe16ab9
SHA1 8e75fcd8fa88c7db2f8ca8aa96238e4f0bce95b5
SHA256 af0e3e4b19ba5471a5729f699d8f63860b05a88bd2ec4b09e38edc40e9b6bd13
SHA512 10f88c78b439b6799673acbb7976623410e17e54e798e7b7c610ebd9987b6e82fa9ff29fe04ee93c6422cd2c5c0b506dd3a78f2a1f418cbdc350104907e1a669

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 269c8130655aab97f3dec3b5091950e6
SHA1 a7e7c5b37569aab2575afaa91f23e4bfb4bb36a7
SHA256 e5e5191a7e214439f0d6b40cc483fcadd53bb5083b1a1212267ef15e1413cf4f
SHA512 c67311755529cde678be54f914c09fd375bb492accb862f71ae8619dff4b760a980f27d57074175b045c4cb5e3a8020a0a59ffa1700f09c137fadaee6d24a0d4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81b10bc86a8581acd81bd6978dbf12be
SHA1 a0f7d226a44ee7ceb53ef643a11cb0e218926b09
SHA256 e708a39996c2989fe37c0786f679fc6836a6d0829f3c381429db66ee37c169a5
SHA512 5ca4630996470a1a99712b0547073622a4305054ce7d3a41a3558328c09f0f9563f1762178389be7e690f9857a58b1a896e8568f8adfd4d7624413e403e53743

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 486769db376412fdb3e56d061709bc08
SHA1 775a739e1f516bf7d37fa2bc57fcd9d39a2ba4ae
SHA256 3e44123b458725684920f4609d7f5e583da980800f9e8d4457352c42698d2a61
SHA512 2d0bdea6047796f9f7fdc5cb4093bf758a2e2809ed4a81d1b3727088c55f87b1eca92268261b11f73d50c1fa563069a00fadd9bc421d65d4a433744e8959f6d2

Analysis: behavioral14

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

149s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\SnBus.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\SnBus.sys

C:\Users\Admin\AppData\Local\Temp\SnBus.sys

C:\Users\Admin\AppData\Local\Temp\SnBus.sys

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
N/A 13.89.179.10:443 tcp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

106s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\install.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\Temp\{2d1ffe61-97ae-4448-aaa4-84a5f773d104}\SETACAB.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{2d1ffe61-97ae-4448-aaa4-84a5f773d104}\snbus.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{2d1ffe61-97ae-4448-aaa4-84a5f773d104} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{aea904e2-6036-f649-90f5-fe5445cf61ab}\SETAD18.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{aea904e2-6036-f649-90f5-fe5445cf61ab}\SETAD18.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{aea904e2-6036-f649-90f5-fe5445cf61ab}\snserial.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{aea904e2-6036-f649-90f5-fe5445cf61ab} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{2d1ffe61-97ae-4448-aaa4-84a5f773d104}\SETACAB.tmp C:\Windows\system32\DrvInst.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Users\Admin\AppData\Local\Temp\install.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 388 wrote to memory of 4732 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 388 wrote to memory of 4732 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 388 wrote to memory of 3964 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 388 wrote to memory of 3964 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe

Processes

C:\Users\Admin\AppData\Local\Temp\install.exe

"C:\Users\Admin\AppData\Local\Temp\install.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fd9cf680-f4be-9f45-96dc-4ad74640b1cc}\snbus.inf" "9" "435f382f7" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "C:\Users\Admin\AppData\Local\Temp"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{61de96a8-4bc3-b949-bd4e-a871775d6c3b}\snserial.inf" "9" "479e6210b" "0000000000000160" "WinSta0\Default" "000000000000015C" "208" "C:\Users\Admin\AppData\Local\Temp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\{fd9cf680-f4be-9f45-96dc-4ad74640b1cc}\snbus.inf

MD5 96d0078ea02ed681f67d8c8e6409473c
SHA1 a45fad9dc80b4e74b0ec31af2187b0e4b6cfee3b
SHA256 3804a768e956d3f30666258972b3215b738fdd58383b8ea808d31042f4fda439
SHA512 e53e058248544cdbcf219130ba4ec3dce6e6885745064e8da52174490b348952b72addb7bc45625d73521fea7c290f1698adc1efeada744a8eda08f7008247b3

C:\Users\Admin\AppData\Local\Temp\{61de96a8-4bc3-b949-bd4e-a871775d6c3b}\snserial.inf

MD5 c2aeabdadd719d5ff4097c4fe2995af7
SHA1 39cca12c94d4ba8aa41a6560a00b031de6899606
SHA256 392e836b5a9cdbba0f9b4eb8346a6c0281c134c070a40d99a2c71ad0d2362520
SHA512 7854dce413a860dde871d143480fc21ddbd2441516d9a913f568883aec726f0d45d5385dc2ac9fdf449babef2c72715378d683b097f869fd4f6ec6fe54281d38

Analysis: behavioral19

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:11

Platform

win7-20240903-en

Max time kernel

117s

Max time network

117s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\ȿ˶.url

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\ȿ˶.url

Network

N/A

Files

memory/2380-0-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2380-1-0x0000000000220000-0x0000000000221000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Data\register-en-US.htm

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1996 wrote to memory of 4800 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 4800 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1996 wrote to memory of 3612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Data\register-en-US.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffebdd546f8,0x7ffebdd54708,0x7ffebdd54718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1439163891784962659,15511014757100782972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2940 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e443ee4336fcf13c698b8ab5f3c173d0
SHA1 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA256 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512 cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

\??\pipe\LOCAL\crashpad_1996_PFOKRQLFVSHPVAPW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56a4f78e21616a6e19da57228569489b
SHA1 21bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256 d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512 c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 89df6926ab0405a03ea139b14b6bd310
SHA1 d929dfd35aac96f7160dcca75d8c57fc5aacf6ef
SHA256 110fd46a962e97981f0f98d8675a11358ee81566eb647c61d45123771b023aeb
SHA512 11cec3e41b3eddafe3d237dde452731a159f7b280f987a5dc63abc06a464711ae920a9ce6fe25e2f54a7a408fe5be5f1ea338d7a10026f9e59c00b977037aef6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8fc7333dd62a6508202309befb47b4ce
SHA1 42c16e8979c63618ae0d5e149918ea33afd0fa79
SHA256 a87608f8e4b14404ad0da7d12bd026d284e240708959ea865b32bc9b95518c85
SHA512 26ca66b0f780b3992659ea90d8a66bf057f12cbc2f18be5df73302ef11f2c57e0eabba18970c28c90d3f58f5b40b78ec490339771b174e2fff422c4a94064c4f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9e42dc8bb8cede1a666675d8956652c1
SHA1 4326a72b4f94630b3d3d49131746976d3f2b0f60
SHA256 7650a3cd9a80c95d69ee03a76fef826490366d31946251cfd291d5cb012ce0e3
SHA512 86862edf7f13d02a3733265d26d76bfb8a7cea59e0034034b5a4be401de5a356f91d61285a57df24f2706ac274f834211b4b2652ccf555961d8d597d1918aecb

Analysis: behavioral17

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win7-20241010-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\install.exe"

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\DriverStore\Temp\{0672bf78-9524-0005-527f-9d5077202d58} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{34e7e05f-f31d-0093-6cd4-ca2de154e674}\SET90CB.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{34e7e05f-f31d-0093-6cd4-ca2de154e674}\SET90CB.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{34e7e05f-f31d-0093-6cd4-ca2de154e674}\snbus.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{34e7e05f-f31d-0093-6cd4-ca2de154e674} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{0672bf78-9524-0005-527f-9d5077202d58}\SETAC65.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{0672bf78-9524-0005-527f-9d5077202d58}\SETAC65.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{0672bf78-9524-0005-527f-9d5077202d58}\snserial.inf C:\Windows\system32\DrvInst.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Users\Admin\AppData\Local\Temp\install.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Users\Admin\AppData\Local\Temp\install.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\install.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\install.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1288 wrote to memory of 2168 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 1288 wrote to memory of 2168 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 1288 wrote to memory of 2168 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 2796 wrote to memory of 2892 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 2796 wrote to memory of 2892 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 2796 wrote to memory of 2892 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\install.exe

"C:\Users\Admin\AppData\Local\Temp\install.exe"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6fb39c27-b37d-3b8b-3c8b-d27932b4cc4a}\snbus.inf" "9" "635f382f7" "000000000000056C" "WinSta0\Default" "0000000000000568" "208" "C:\Users\Admin\AppData\Local\Temp"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{0e76f59e-897e-2b48-af11-854018e08e4e} Global\{7ba2baa5-11af-4085-9bd2-a9692b1d5663} C:\Windows\System32\DriverStore\Temp\{34e7e05f-f31d-0093-6cd4-ca2de154e674}\snbus.inf

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{502d60f1-4b98-022f-bf3d-de040114142b}\snserial.inf" "9" "679e6210b" "0000000000000568" "WinSta0\Default" "000000000000055C" "208" "C:\Users\Admin\AppData\Local\Temp"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{431c85bf-426c-2b13-1e15-942c78160a5e} Global\{04601519-3395-4092-9cff-ad10771b1d19} C:\Windows\System32\DriverStore\Temp\{0672bf78-9524-0005-527f-9d5077202d58}\snserial.inf

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\{6fb39c27-b37d-3b8b-3c8b-d27932b4cc4a}\snbus.inf

MD5 96d0078ea02ed681f67d8c8e6409473c
SHA1 a45fad9dc80b4e74b0ec31af2187b0e4b6cfee3b
SHA256 3804a768e956d3f30666258972b3215b738fdd58383b8ea808d31042f4fda439
SHA512 e53e058248544cdbcf219130ba4ec3dce6e6885745064e8da52174490b348952b72addb7bc45625d73521fea7c290f1698adc1efeada744a8eda08f7008247b3

C:\Users\Admin\AppData\Local\Temp\{502d60f1-4b98-022f-bf3d-de040114142b}\snserial.inf

MD5 c2aeabdadd719d5ff4097c4fe2995af7
SHA1 39cca12c94d4ba8aa41a6560a00b031de6899606
SHA256 392e836b5a9cdbba0f9b4eb8346a6c0281c134c070a40d99a2c71ad0d2362520
SHA512 7854dce413a860dde871d143480fc21ddbd2441516d9a913f568883aec726f0d45d5385dc2ac9fdf449babef2c72715378d683b097f869fd4f6ec6fe54281d38

Analysis: behavioral4

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3132 wrote to memory of 4404 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3132 wrote to memory of 4404 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3132 wrote to memory of 4404 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4404 -ip 4404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win7-20240903-en

Max time kernel

117s

Max time network

127s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\register-en-US.htm

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000058a40ad70e14cc458149e75d2f4dc4070000000002000000000010660000000100002000000086eacd5ac591e009d3144772b80fa203d19f32b8685ddf7507877e33b924f908000000000e8000000002000020000000311737f801a930bc99a1a61c83fa7af4fbf6429a3b4c7ca350f22cfab6b3392320000000b9e10f11822dd12ab6fc01156aa72d87c01663d805468172c7b640a6bea8d34a4000000075ca43878dfd7783c2beeed86a543d1a062ed3b7b9842d3514c4528438dae607ca133e57d45e51de3d3b3a477098daa847d08282a2a7c7025cdde5e78f664251 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b5c683bc4ddb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440296835" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000058a40ad70e14cc458149e75d2f4dc40700000000020000000000106600000001000020000000aa9af5feec3e0cb0b9cd647541a334ab716a9cc79ec3f6c17a10909e68810816000000000e80000000020000200000000aa120bbb3f8ea282fe0db9d86f0d08d527e25e7917e79bfd50bd17d9c89a63c90000000c373676e1b6e679fdb63ce7be3bed09393bdf28a91f61289b46b8f1de30e7d58c4c053178e8d01cd92d3544b0030828f22217f70e981714717b38acc1893ccfe7d8885f726f50c771c5137035c74aa2f7c568d0368bbc4bdf6cd4f72d46fcfa16f6d03af451cb0a89d0f417e2739aa4e201001458c8693ccbff33210e2e16a5b1a80be443d518f2d5391ac11dfdcad144000000095fe402cc4fd3111040f6ad2cf2c4e346764ca4c270b35c9bf26b88379bff928ee0d84f1a5d016e75a56216c9230314a0a5fc84dd31fdbfbbfa8f72fb2cb5411 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF518791-B9AF-11EF-98BD-527E38F5B48B} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\register-en-US.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab2992.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar29F4.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f83999f4e3b24b9c3b938f906e704cd9
SHA1 8cc80ff94e5284d757edd4e4b9a823e8e956c649
SHA256 f1090bc09aa8a3df0e5f40a8ba70c7208dad740d1f5dc39022f9511f76b7ca70
SHA512 7e0bb67963456bf5ce05566ed8289108d03918836f2ac51f740e1883ba49260edd769857d0c939ccd9afdae076c4489a8fc92d34126e8b3c7a34aab242a189b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fe847f0babf6c0850e5cc2fbcd7aeae0
SHA1 25fedf25c5ff4b1469d02168964a6e907d6bd379
SHA256 cc92a2ac6ee4c1d4ef9415e8fe38c3efbead42af10b14743e4a4e3d0d13c7fd8
SHA512 5d539cba419d9f11184443668259181fb033a546fb86c06479179a0dcaa98bc0d1e3efb3f648605b3f1ce8cab4d1e9082780caa94bd26049488025533f885757

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6b11f1ea834f8c9120b0389e9b451957
SHA1 6321ffa0d16b927e5ff5b8dcbb2543ab7ae59bc9
SHA256 52153b2ef2b77a1111a04bfb1e9ad624af8a602bf4e510a352b23247c819d3b8
SHA512 bdb8dc6c71dd9f58b226ac516330966bcd5a55f3908d41026fd2c6590c121fbc7650c6de05471e41c9a2f92fa7cc2613130092738440383a595e3a0060cff419

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0999f43d430643df3cad0d50427c6279
SHA1 45bc3480292f6845951458c8826d824ea41b1bec
SHA256 5b587ec5b446d823ad77f9a1b453672e3c3cb796103cd0203cea4f1c37e1785b
SHA512 f2e9173c4d08eca1b9bc454ea264265a7154341776a669c86b4e2670668d642d2033daa8e515f6b1bf4e27ffa773bd8fb922ca78a71d1e828f5e392b45ef1822

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15c68ce63282588dc672345ce5a0f8a3
SHA1 1b934afa326ed979802a4e303d7f992b5684585e
SHA256 0651048f668d5824dda49bf93ce60cd680ce1495b3bdc7434561a05c7173b744
SHA512 035c427d58c3addad4b62542c050af183aa1b1701c4b77bbd16de445983069f9f4522bce3704df4716d8c4a28278a33ac09d268462553c94981fb9089665d2c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 812205516dae3a82696733a1ab01084b
SHA1 d5ede6db7ebc097df2e7d134b51dd4b804290d48
SHA256 80f9d03a83977806a9fa96bfc45e0182b12377acb1e66c5dc79e4744a0418b29
SHA512 ffbca21f34ed179d8f5770f621732ada44ca5494bc4c27ea3cbfb74cfe2166dd7fd06d5be9836ae89b1cbaeb7e9eada2f7f41cf4ddf3fc148c0f59fbb4edb463

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bdd5195b2653bc3a528ae5636b6b05b3
SHA1 6e8523875731f7cdb8191f479232d4e06dc1d26b
SHA256 c21129529b078e207dc7681726341a68e4995fe31ecd8eba6803d6034a54921b
SHA512 66b40469b5085e3100d655f43bd711143d96e952354c5aca15864c5f21c8c007241b3cc4a42ead13f14e0343c14053e38c3396708c59c91371ad93122c37e4d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b137fd8828878d79cb2a8c1f2ba39424
SHA1 eb86b770222f73008d3cf89e62af36677a5030d3
SHA256 7aded3a06c0154c46e417e1d18ea7e3b675274ab765f24975bccfd6dc278613a
SHA512 5020086371cff903d890d79e4de8a525220a5f10793792a42148e2f4f93b7c483c3a45b0ad1643d5a9c7b53c13fca936caf2b8394e6ffa241ba8200d2fb3964c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e3e9f3494836c9c452f46d46d8301586
SHA1 06c3e7b1d3aba1955396a113bca23bf7a9a89837
SHA256 51bdf3dd272abdcfed9cced648355fd1cb084de17f9af770ed07db8f0ec71890
SHA512 8673c0a7e69c8fb9b035f2df40523e18782a27f7afe00e045fd11256f4a4154334e20371c3e36699d70c8a4b9d6640668bb85aff6298bc3e9048c87dd461968a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fe91f6b6d2469bb579692901aa0ac83c
SHA1 fce6ea24c2178147c315f1344ebce5726a22f51b
SHA256 ac7ae67bcce57355b1f38c3a4ee69980a699fa8764d71a4eed3d47832764849c
SHA512 b950ddd5a5b81b5f0b4621b752428a39373635cf567a1eb2e8a64cefc372360033b8d118900ed35de8e4146d7a7eeb74d05f150e64abc00331e9265ab1e4694f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91c06ab83db6bf94aca590c1257d34aa
SHA1 958f78a60de5371cefbb897e7ba037d04eed0b9c
SHA256 856fb838cf3acdbe8eabdae8167075d8ca908d7823e770b6733de398c8d28131
SHA512 6f9d16c13a97fdaa125d3ad4adf8d7a70f0e133f7db8a2f615b0b4d7d9298351df92a6ec56ade1209ee8c66393ebca14f070afe0a5cf3150a080f742971a4da6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c4856b72a8422089ab1230fd91d4cf53
SHA1 d6238b7194ea54b6be0b8a6ccc1138f6ebeccd00
SHA256 48434ef190004685807db50992928c494b80888819b7cd9a08715a494ae369c5
SHA512 ecd176a6c9591fcdf38ac49fffa016fef655b0c760fce2201a5a1633ed7be49d37fa8b46ed9d49ed53e4617c76d135fbfe91f08d4acfa18769cb948fc1117c0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77273e2b10f40e47025bdf998d7e5667
SHA1 312232b3dbc8c37443071a09ff76804e11e137d6
SHA256 c258d0a4892c6f49e1514b4120e622fdd44f014db5c5f2b229e452aae51e4ba7
SHA512 2f9769a3fde7400af48df651b86c4711e99f4adfcf6e2ef14992de6ac2d02b48f235f56b1d6e5969d860931a26289a0c1e1a170c3ae9bfae4fcbdcd3ac8a9c3c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 94fb813e8efc9ff2f78ef603d10cf8aa
SHA1 68fc5318c155b3b854e2b45c1e3a6a235e01a02b
SHA256 19a239ab84768a32e3ab442671b52cfde58297a8f1557a42f50324cd0e96a3ae
SHA512 6d74574c57f4e568fd9fedc8b809f51f2ff8b82dddbf243eb47e98329936db0a69867b934c084db48137672cfac49a5810756ec1f8fcaa92bd66eda92ab5eb5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b3af493738fc653fdf28762ec6da74c5
SHA1 3feb413fb784d7d1fb4c15127dc7c6875b15a25e
SHA256 b38067376cdb2e7d39a01f70c641adf877ee841dc9ab85becddfc091ade2508b
SHA512 2726802ba5e34370bfd9bb6da817214f0b9fe9e73eacba12e47db99b4d35aff0738863628b6f5dff07cc15225034301b06c6f690575088a902c30a5b713e0ef4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 747feb8fc3945b4c647bcfe3707572a6
SHA1 6019d6120573a5d88858afb28e3528e431f33981
SHA256 1e460506be8ce65bc2ff24ada1da92c7cef5fb15a8abf685fb55a7b3e2662e2b
SHA512 69adb52cebd0fdc31d4df2f89d2f59654cf7db6f4582e4a4aea3a7cfcf84b6236307d9d0d995a41052f2061925f39811a0d31718f7e5e248fbf3461e407c2d12

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 93dfab906eab25a612d7d37108b52234
SHA1 cc4585e30673d787e862ef8bf4c19369c601bb70
SHA256 1a9145afd962e78a201f9f73f96372eb9976dfb6fecc4b50a4e4a815a78398a0
SHA512 bb23544f7e698122d212b23d7b82db7eff928c869bb19350551328ed5f3dc062678f8baba1fee98d9d401b50466acafd6952024cac0e6767f2288a0816d25808

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6bb63b6042805653f48c38822201bf00
SHA1 a8c4a5668c09862513c504940909d53176035b92
SHA256 a039030fe4898ef5bc2033529aed05fa1454602697729912c6e6d3a4d1f0a5d8
SHA512 4c32cb93bbd35666dcc72309a5c06c17157def381a1e12d21e7fc73f74988f56efa02ac9fddef31c80453279579004f1c51214457faef94b69696a7aa077ac1c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c1bdb3954b67139f5044275e7360c4b2
SHA1 f2c14b90e05b2d6940828dd3db0c9154817aea14
SHA256 98a74fff67f63ee28dc1a39e0f2b7154ced1ff5761083a31a760d7310d5f605f
SHA512 cb3642fb6a799e34bb04ae756e332ed770d66592e5821943a036951eaa09145c8a1cb0b61f9c034f329752985348e97150b988ef14c8188faf3191272b503055

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b8404726273d857c114bcc5cd6ecdd1d
SHA1 615b95002f3f3f2053224eda08f85bce2d4d0731
SHA256 b66469627208fa32fdd7e2a273a29076da5a5844c80ef4e1ee206aa2a43a84f5
SHA512 67d3f3bec1d329a464ec3fd8f5f1e90a410e50bc93dfa5c735d2d785ff70001da69e0a020d687a04e4570160c4f1bfbdad7f3179331172dc36739fdac7f97875

Analysis: behavioral11

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SerialNull.exe"

Signatures

Detects Strela Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A

Strela family

strela

Strela stealer

stealer strela

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SUDT SerialNull = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SerialNull.exe /quiet" C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SerialNull.exe

"C:\Users\Admin\AppData\Local\Temp\SerialNull.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.sudt.com udp
US 204.44.196.81:80 www.sudt.com tcp

Files

memory/2532-0-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2532-4-0x0000000000400000-0x0000000000471000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:11

Platform

win7-20240903-en

Max time kernel

120s

Max time network

120s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\SnBus.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\SnBus.sys

C:\Users\Admin\AppData\Local\Temp\SnBus.sys

C:\Users\Admin\AppData\Local\Temp\SnBus.sys

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win7-20240708-en

Max time kernel

120s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\SnSerial.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\SnSerial.sys

C:\Users\Admin\AppData\Local\Temp\SnSerial.sys

C:\Users\Admin\AppData\Local\Temp\SnSerial.sys

Network

N/A

Files

memory/1708-0-0x0000000000010000-0x0000000000018500-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

90s

Max time network

141s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\SnSerial.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\SnSerial.sys

C:\Users\Admin\AppData\Local\Temp\SnSerial.sys

C:\Users\Admin\AppData\Local\Temp\SnSerial.sys

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

memory/3980-0-0x0000000000010000-0x0000000000018500-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\ȿ˶.url

Signatures

N/A

Processes

C:\Windows\System32\rundll32.exe

"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\ȿ˶.url

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Data\register-zh-CN.htm

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 632 wrote to memory of 2332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2332 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 3044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 632 wrote to memory of 2396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Data\register-zh-CN.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff874cb46f8,0x7ff874cb4708,0x7ff874cb4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15770840008365187700,3564024329619581205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ba6ef346187b40694d493da98d5da979
SHA1 643c15bec043f8673943885199bb06cd1652ee37
SHA256 d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
SHA512 2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

\??\pipe\LOCAL\crashpad_632_KKHSLHHSDVQXOYNY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b8880802fc2bb880a7a869faa01315b0
SHA1 51d1a3fa2c272f094515675d82150bfce08ee8d3
SHA256 467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
SHA512 e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6758e112b79891ce83e37741f394cc68
SHA1 75ccb6bd65ca9c947c63f1a2d7624884ca9acd7e
SHA256 8baef4fe57a63e81753e3837b38768da6749af17d0f8310db7085106018dd504
SHA512 69ae37aff23fd9a5d3bfae51af682cf3a797de06ac1715917d29dd5f6f1235042c721b64d30ef25b81d73b073be4f427182975014b84892592cfd1482a858f26

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 90a0576db95c2e161299785e3ab6feaf
SHA1 86cc33cb7a15ee73cacc044a8236c3453a06d1bf
SHA256 c0d28e7c9d6ceb865b21d75b5cd2d3fed19f0a514d3d4ee6b3bb1e4b149f4cfa
SHA512 1fa8320da8be26d6a6b3f970b949290bed12c9184a59e53d3bf4b9fbd2d96b20f1424779e25489c4a9c2626db8781de8070a12e163ca052f949336a3a94cabac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fd78fb5f1e025309ed289cba7c165207
SHA1 240e7b15de57c3f6c63ecc89c72f05bba548e762
SHA256 dbcb168946a28deace10f7c4237b8a75325903f632c1a5d7925cf38ae5b58234
SHA512 cf12d84db55b99c0d73b8dacf131227d6aa8f94584ff2ed2d79bbc2ed970abacec125d55f9c6259af00843108d3f78f126c2d76701d5621490c900b53b908dea

Analysis: behavioral10

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

144s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Data\register-zh-TW.htm

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2412 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 2456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 1856 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 4200 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 4200 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2412 wrote to memory of 3404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Data\register-zh-TW.htm

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc45246f8,0x7ffdc4524708,0x7ffdc4524718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5521649260938505300,2633040143306203574,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2748 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

\??\pipe\LOCAL\crashpad_2412_JSPAXQXRNWOLSSQX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8f91f6902c64fdd49cc928278d304621
SHA1 595dc413b52bc91722fb3e42733a3eec0422b837
SHA256 191d50de73555b79aa8536d587988ee2bcbf424498ad207b50d1f592b72ebe25
SHA512 87b5b56bc06bd5d1b7e16a71ce5349c660cf0de38f9e014c222236df7e4ccf141620d9c4dd5974f2459dcdc87bbe049a9399820e7ad5b381c6d7b4296e4dd5c8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e8dfb4bc947712b18e7b7314bff64460
SHA1 c745628eb1fa39483efec74dae4fbcdc674e930f
SHA256 98e944d5f6acb9e255e38d101b70179d5a3041af5cbbbc505fef878aadca8eeb
SHA512 4e3132469f630c3740b60f36e67078fd1f18e8784fee5b9c5f1cf47899a097fffd3c361ae1d7180ed11c8faca35636070dfed4525218c7ba02408bb0cfbce9ab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c413a71f70c2a336f48e3a1c449d2d72
SHA1 266a61abd4597759427cee7587818b8700fe8676
SHA256 1c8d3c00ac7ec67d70c592ed750b126f50bb572c92a6ad18d94d562f486eeeb8
SHA512 efb5be1de486ff20ec98edce3ccfc83604596886f4dae0b9753b4ce534ecf6d059b40322c67c2cdd6c0e1fb843b44cc23891dddceba4d5ea470a4cbcb7484365

Analysis: behavioral3

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win7-20241010-en

Max time kernel

119s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 224

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win7-20241010-en

Max time kernel

135s

Max time network

133s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\register-zh-CN.htm

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440296840" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b081fc85bc4ddb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b13190000000002000000000010660000000100002000000069762928fca0965d10304c9e1298b4217c0f2cf9795f93e2a006783db8784973000000000e800000000200002000000038d11e2375e69ce339651320d40924a62c6c7a5187ae671ff1f67b04cf666c4d900000001f973fdb15dbdaa050153aacbd515528d79159fca448b8130259d4489d05846809d40eb1741f5426f683db6318fa7910413866b7cbe2bbeb3f8f6d1f0aa4479776b845aa93a47c09d50a074af6e4a6c379a8c273fcb4370c56b977abe5335e6ba6700bf44c39131ee45179b244b154b50eb198218bdfa145f70828642c800a852bca727040333dbdef76f60e9ddeaf2c4000000001a3c5c5997089e31117938804a1f98fabb398a8d2935d0d208ab2cc6a35df3cf55a5086460188ddaabd93f0da72d3459cecf8f7ba19bdd11dd1edd46c7b8bb7 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000ea38f4e534764287e5084936ec1c29db684425a3ea71538bfe7a298783494d83000000000e8000000002000020000000198777a43010c0f716dd6872e7233760afeb961fefc1d0ea05b378551a5d95ea200000006af725c8fdd6d1738059f2735ee26192cb7c1ce8393f74596ee3a06af0b6db1240000000419ec405508fd3ad824f3e65bdb13cb0f90a9ffedb86226a454012167e4ba4637b70f022a09214077485a9bd5173a6f823c8fa096b2a7c2bd77b0e614740e411 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0D5D5D1-B9AF-11EF-AAD8-6AD5CEAA988B} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\register-zh-CN.htm

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabFA87.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarFB95.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 14074a549f3c358a6caa579a0a2b5588
SHA1 50e511abaa45eebdda6a9868a912525f2ad35d92
SHA256 6efc6c8188b3428b41396209eace422c03b4abcccd85399b11ea79ac40e48ce6
SHA512 ab35a87ec19888afc83e4032a198c5ab91febd221d89a802c8d0f8653aed7828d7e540c700ccc687fb59cda44aecedfa7f144977b8d23ab45cda8e54dbc64986

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be7baff5c33ea80e6221e53b36e70495
SHA1 a45eaf630e776a1f62e3f7f73f2a71f5bf80f316
SHA256 d92d5b85abcb612045c3b4d241f720fa40032d86b3049559d0e752f0c953e1c8
SHA512 337c4625699a19a1af83b5a7ede5ff494d54e766b33c7a66b07207455f074e91ce82af3a083790efc0e72de7ae3395e71920d0f501083d34d0e76911a2cd0d0d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0c738649fafb7a65d17590bd3067dd39
SHA1 3f4792304faec71dfc5a5f53724d68e968c83190
SHA256 2f97e01ae904a8b73667b9db8d96aeae0fa59031e9ceb700a4207b63b57bd6ca
SHA512 cdc3561ddc7047080e282cb312b0cecf73a09e51901b0766a049d60e53b097f5a74d32a11150191bc7934a31f8a657f65aaa79ebbbf626ea8e696902009027f3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 752f2841d125d551bfdcf5f134f58283
SHA1 4a92887533428ed09517646dab1d666202314f89
SHA256 999e020c6fa6088596e61f8a55e13eb0582eac33d311d99df67e8e5358797a5e
SHA512 201fb471f78ddc8b12519137ab65e1727a042451e47f9e6f3e6d47dbe6be159a8a6d1c431b7c26f1fa65b6988ede8a7eb0c780591beb88a0bc86a1612e005380

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1152951a0deded053aa238ec45aa9c33
SHA1 01f7c026b21d568b17474585a0adc48c8d551b80
SHA256 d838d93a2744ce1d2f4aab6a75d6aaf8ba5ba8b896f5590899adfa8a0ac8cf39
SHA512 6f0f6734e6ebff317eca0fa8f47f075eb3bf83d1bde4347ba50cd8a56f47d6ebfd34f4a1b355107385bc9a30eca57a6647ec71dd44143eeeab694be592fcfdc7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6def070674eec0964924e6d5e4b283c5
SHA1 7770f03b13441109f563c83e4cdca48208a3e143
SHA256 42fca73c846656b0541d310493776015faaf69b3567a72137a93ebce82caefd4
SHA512 e0b58c9e078db659f85f51624124d470d8fd8822a130a12464cc468cee60bb67193a10c50eabbc9060f5aff6d3f102f9b82e7d13a2d5f2cccf5775f6a7e7bf12

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e2e520017b44b2f47cefc6d8797ded2
SHA1 99d89a9e76c78c08c112ec2a194da1b0bdb01ec1
SHA256 ab807cf659e8da6fefc4221c6c2ac008ca68d6f2c5235ab81b0a9d3b2c42a002
SHA512 fcda8346244c5012611b38efd5d5c58327d31f2a563688d055db7e8a8f1b134bd921bc74731e529804f1d26dde8f1fb26df39dd2779c2fb16fe4b4a7eb1eeaf3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4538b21ee2dae58cc1c16623f8634b9d
SHA1 ee9cb669a88b64d3dfdbec73cda2e815176f4a07
SHA256 6d4685bfc296358d0bf95513096b0fac16e4596f42b2dd078df9699d1a55a5be
SHA512 d0ead975f86f2b79a924e009465b7c0600c1a936de34c9dc48e4091c1720683ab41d88fbaa3a18cfbbaabd02efc58dc1b09d3a367c2c121594a15500fc879cf9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7178ff1b2430ad845fb7ace04e0a05a1
SHA1 83144c233340043ccefff0944d53c3e45af0f460
SHA256 5c119c98e0ea7e1b441c19b1cac47f6699079a6abbb25fc8f89c022187fb05c1
SHA512 ad1e5bcd9a2816b68383b63107a4c8c12fbd424762f717b199d7db0776b6c41b52860b29760a27065198f856ad6e9750c1fb8fc55a75df55d04f6fa7613c47c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bce87f584bfc07810e7a7959177c4e26
SHA1 10147185f080f69d1a456b17df3846ce7a7403ca
SHA256 eb4929c13c332efbe4c65a37ebb4835e70556d5cc02fdcdc4617acc3943043d1
SHA512 219ab8d9a40f323156d5cf40a13ef0c666caedf8ce803e9e8d1aa309bfb16bb0d06c7169aa96c0a5597700bfc0c15b625c0b97730eed71b6e786e2353bd2be41

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78b4534d760a3750409d4361eec09b73
SHA1 79a4b5e52d166e6ebd66e75ec7239634b329b4c5
SHA256 007b42810f5326c9bebb1acd5d5fd460b331f90b9585a39ca62e774878f4f067
SHA512 4758e5ea959694961a4fae60efb29bbe365daeabc28c17706881dcc5d890fecfb9c0dccc90637179f2ad940fc8161e9babaa9e1f2424ced2d69793b0be2d8329

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f455e8b2e1857befef4487acd16f1f5e
SHA1 8bc28b31c04c1f4356e93f8245c205e82254aeda
SHA256 df07de65e8afbf13009d0efde0a4b2507c91130fc9a72ee64faf8d081c2c7e59
SHA512 974af63b14374919516535c9493f22a19469680fb06ad4040115a407c55a516a67ecda87adc3868a7165e9dfb5c995bbde01d6077ff95d0f91c098f3e0d36e3f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9debcf9271d9d33279f38dd3385105fa
SHA1 ad96b16e852882689901c3b3915a2a7edb684d0c
SHA256 0aa2df2b57f6fc40932a0ee3c6418502fa44f79e5a86b909d7666be1a3335fe2
SHA512 1287d94a1fef51d49c12b1c3373996dcd1b65d7ceeddc89eacef56acd379c3d43c866cae553263a2fbbba933f902c6f31aed175466fb6168880403134b532ed7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f1bd22e6b3f5209efc3b47978d10069
SHA1 fccca57e94a271683889e368474f0017a622e587
SHA256 998e58fa17dea5e46250e76a447ddad2a26372895216c299657d42bfce2206ff
SHA512 3be0ba413d63058141e9d6869aa39c14d57413cf298bf1df0d95435717760534dd6c0b7300bd818c34564f020011b7cf490c5209ba5fbd7c2e1f3575e193eca4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1d7c7582c1a45e31428a4c8de8c22550
SHA1 f2a295014ce4ee9fa44b4dcae652a13a46772110
SHA256 20e3f3b993d5ca957617ce989c9e920813dcf6a66f282cb7b43aa61ac82ae83f
SHA512 98f98e0407f6721fef33377a831dfc874ae423b944f57178aa59a666e25abff61fdd0062169f146f5ee1f04230259d9f7204a0c38aa6e2f47d08907b34fd24da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f386e84c808300c822fef1ee7df89e9
SHA1 bcf21f6604ee96339d27981318e7a847fa93b2cb
SHA256 d9c97d2778cff8f753078a363a3a4656fd066c5128e235e8fed0e29de62e42ab
SHA512 ff1255cb0d597a63228ba8c5dc4ba84c27bdf1ff6a4722bd91d33a90e06eeab672ae462b6eac43fa7474837ddcc3d751c9b2c0adc10bf320cc06458354ad9724

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b13fbfa5387c62a82fdddfcf54514f10
SHA1 cb2227bd915a88b3f53159f5eb420a0e1db73f76
SHA256 c2130a260ceba403f6ab398bfd431ff69dc58385bcb6e0e25dc231c59d81817d
SHA512 c9500a02d30519bc68f19baf626739c38c7170762248e82c17adbe3921253c9bec5775d18ab09aac2bd4ad17c002ef25e860e4b6bfe944528ca14edd93e20521

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2da04ac1e2ef1c99fd124c77d02da21b
SHA1 ac05eb7c4736e19416389643539dc864489f0d42
SHA256 90ddae22b07a004b62d95ed6efe89e1c7110da41eef34df91e39131dd225af90
SHA512 064b44f09124c3b2750e1073757827662d8159dc2a9d1642d1c24a359d1a50f79598aaff926cb8e971a74c971e1e2f1cb628a6f72312403ff0c5ee899a0bf936

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b56b36a6bf65bf9c36579ae473f58d2
SHA1 c63727682ffb6f823fae71ac6ce69a9deb3d24e4
SHA256 ca23aaeabf6c3b789ebd29c596b6b0e2c4525087423cf5569ee0c5db95e29539
SHA512 fa7933d023d5c2106c7452d1648207284298f61d9a4ecec06ea1e3e39d99297a59c3bf2292dd797fd6354f8bde4532f6aefed655ce5929cb39ac353444c3d0f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 98bf2f7ee259db8d109639924165746c
SHA1 d051330a7a44fbe02acb85b39db4ec078ab12a20
SHA256 198f5a4ba3cd23c4d229137536bc4ac98c2404d0f310c6a35db6360b4ac523e0
SHA512 781a4b09ed9b86716ba22e4746f74e3d022b881b934f5e7cb2ac9b1b54ab37689c080feaee57d8cf285e1fa290b4fabbdd05ab96d38f3e46ecdb46a735e3dba1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b561d3191ea49eec63e00e9e5cf2d3eb
SHA1 7e69114368aada329858b6c9e23e65f3d6cad997
SHA256 aa00c82c3e0ebb69d3ce628bf98674d1f2718ac7fdc5c618b9db7f5fc0bfe28d
SHA512 a17d27a83e6b76bce6853521a355b575d82183faa02e101bf5c156e37271302e4c9b2cbf783ce129a71a2bcbdf803f9ab14099610d9b6c775527452035cbb696

Analysis: behavioral12

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SerialNull.exe"

Signatures

Detects Strela Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A

Strela family

strela

Strela stealer

stealer strela

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SUDT SerialNull = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SerialNull.exe /quiet" C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SerialNull.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SerialNull.exe

"C:\Users\Admin\AppData\Local\Temp\SerialNull.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.sudt.com udp
US 204.44.196.81:80 www.sudt.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 81.196.44.204.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp

Files

memory/4808-0-0x0000000000400000-0x0000000000471000-memory.dmp

memory/4808-4-0x0000000000400000-0x0000000000471000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
N/A N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\DriverStore\Temp\{15afac35-5ac8-1661-3a53-253b54e93653}\SET5D3D.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{5e6da0ba-3426-5611-4ece-fb6bed48f646}\SET755F.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{5e6da0ba-3426-5611-4ece-fb6bed48f646} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{58dfabe5-62b0-211e-4310-3e3d2acacb46} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{58dfabe5-62b0-211e-4310-3e3d2acacb46}\SET44BE.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{58dfabe5-62b0-211e-4310-3e3d2acacb46}\snserial.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{15afac35-5ac8-1661-3a53-253b54e93653}\snbus.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{6d1d6cee-18a9-23f5-c7f8-3c358080a000}\SET2D19.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{6d1d6cee-18a9-23f5-c7f8-3c358080a000} C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{58dfabe5-62b0-211e-4310-3e3d2acacb46}\SET44BE.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{15afac35-5ac8-1661-3a53-253b54e93653}\SET5D3D.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{5e6da0ba-3426-5611-4ece-fb6bed48f646}\SET755F.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{6d1d6cee-18a9-23f5-c7f8-3c358080a000}\snbus.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{15afac35-5ac8-1661-3a53-253b54e93653} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{5e6da0ba-3426-5611-4ece-fb6bed48f646}\snserial.inf C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{6d1d6cee-18a9-23f5-c7f8-3c358080a000}\SET2D19.tmp C:\Windows\system32\DrvInst.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SnBus.inf C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SnBus.sys C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\install.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\sncht.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\sneng.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-zh-CN.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-zh-TW.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\install.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\snchs.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Help.chm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Readme.txt C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\sneng.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-zh-TW.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SerialNull.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SerialNull.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SnSerial.sys C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\License.txt C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Help.chm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\snchs.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-en-US.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-en-US.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SnSerial.inf C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SnSerial.inf C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\License.txt C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Settings.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\sncht.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SnBus.sys C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SnSerial.sys C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SnBus.inf C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Readme.txt C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-zh-CN.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1636 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 2592 wrote to memory of 3068 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 2592 wrote to memory of 3068 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 2592 wrote to memory of 3068 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 1812 wrote to memory of 2764 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 1812 wrote to memory of 2764 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 1812 wrote to memory of 2764 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 1636 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1636 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 844 wrote to memory of 2908 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 844 wrote to memory of 2908 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 844 wrote to memory of 2908 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 2640 wrote to memory of 2212 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 2640 wrote to memory of 2212 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe
PID 2640 wrote to memory of 2212 N/A C:\Windows\system32\DrvInst.exe C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe

"C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe"

C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe

"C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe" -u

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7cd529da-555f-31a1-cc77-832d70373975}\snbus.inf" "9" "6c49640e7" "0000000000000570" "WinSta0\Default" "00000000000005AC" "208" "C:\Program Files (x86)\SUDT\SUDT SerialNull"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{55b21c07-c5dd-1f77-d0ab-b36d2979e83c} Global\{0fb3b0e3-ce41-233c-c3f6-b67414eb5d49} C:\Windows\System32\DriverStore\Temp\{6d1d6cee-18a9-23f5-c7f8-3c358080a000}\snbus.inf

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{35e40b2e-d2fe-5c9e-84fe-e04c9906e56d}\snserial.inf" "9" "649a1470b" "00000000000005AC" "WinSta0\Default" "0000000000000320" "208" "C:\Program Files (x86)\SUDT\SUDT SerialNull"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{7b1592b0-1bc6-3c1f-f2c2-8c6b61b77448} Global\{48976aa9-6653-1e3a-4826-3434cd244e11} C:\Windows\System32\DriverStore\Temp\{58dfabe5-62b0-211e-4310-3e3d2acacb46}\snserial.inf

C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe

"C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{471745f5-9260-4688-2cc5-4069f742cb3a}\snbus.inf" "9" "6c49640e7" "0000000000000320" "WinSta0\Default" "000000000000055C" "208" "C:\Program Files (x86)\SUDT\SUDT SerialNull"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{2e777d02-3af9-4f3a-950d-6c536af4db40} Global\{16615ac8-d2dd-326c-cb4f-8a66dc5c071a} C:\Windows\System32\DriverStore\Temp\{15afac35-5ac8-1661-3a53-253b54e93653}\snbus.inf

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{18ab5816-6acb-078a-1570-943f8ff0f64b}\snserial.inf" "9" "649a1470b" "000000000000055C" "WinSta0\Default" "0000000000000570" "208" "C:\Program Files (x86)\SUDT\SUDT SerialNull"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{39082f18-7636-2896-6378-825d5370bf02} Global\{2bf52721-4f68-004a-ecf2-cb39f31cbe1e} C:\Windows\System32\DriverStore\Temp\{5e6da0ba-3426-5611-4ece-fb6bed48f646}\snserial.inf

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nsyE061.tmp\System.dll

MD5 d4d09da0218ba046a66a294f0cca9dfe
SHA1 417b1acdeb0a4de6ac752a93080ca5b9164eb44b
SHA256 9090e47d239aa1da9598a483861165e0153c01ad9ff9d65cb6c0f4497a1da5b3
SHA512 3bc9a65842301dab56c139cc5a3457158d37ef294583728c93da1e11ae457df9551b0f8fbd03d5ea3058f3bc794d0ede57ea3efd5d663b45d25647a39cd955bf

\Users\Admin\AppData\Local\Temp\nsyE061.tmp\LangDLL.dll

MD5 83c5a8e90cd10cb31a9215eb4421341f
SHA1 52ddbbfa955936f87516c52b2bb679a6b4363e22
SHA256 da006773e11871b8834036c30acab8fabcce2c9e9f52bb2b425f947bdf33f7c6
SHA512 46c20fd762a643028f3c4287ed3dbd762bc1cd17ee5ad1d90cbad23f15901fbab14b726d7f3e45eeb370fb6a2ee5268a2e9ebaae7ab6067c855361d24fc806a4

C:\Users\Admin\AppData\Local\Temp\nsyE061.tmp\Header.bmp

MD5 f12f2234e5496f8518390223324d8b1c
SHA1 6e470e2b41ad38422a5beb4e7f4d28b721dcf2a5
SHA256 46fbe97a281202d59414e0ca9a68009b8423ff5fdbc0027f4a309b588c9af7ec
SHA512 d83aed727d741e1e7d036a2c4021195b46ec474e021486d5f699b2a651d27287af5aabab9772232ee57c6856670d128b21db356f061396ebf779ceaca0af36d7

\Program Files (x86)\SUDT\SUDT SerialNull\SerialNull.exe

MD5 cfe544e042b57980bdc5c044e64d06a3
SHA1 38057e44e41d5eeb706e2e27b35b8e8d87d0fb24
SHA256 502f20ca9cf7259a73217d3144fdd2aefb697b997717b5a16e9c92a2d276afc9
SHA512 f741ac253760e579d9d0a10667863987ae35fbd806bbea9bef36f1062a7fea24358336d778970f44390576702568355c768453a9188ef9a9c13b84f88efd3e50

memory/1636-39-0x0000000002B20000-0x0000000002B30000-memory.dmp

\Program Files (x86)\SUDT\SUDT SerialNull\install.exe

MD5 242b49803d0dc2c25486ab866d8516cb
SHA1 8d4302a242f4e3be1678e21e9bf79cc27f123e7d
SHA256 0d03931dae04b1d6cae8d3745c3aff6315e0df8c6b0bb2589fe77b50580e88f6
SHA512 02ba717114ac8fe22898356403065203d719e97b6bc4ececaf849fb21e02529bf54f367bd3468103045cc63a60c77935d8efa04fec67f6d80b60e43067966577

C:\Program Files (x86)\SUDT\SUDT SerialNull\snbus.inf

MD5 96d0078ea02ed681f67d8c8e6409473c
SHA1 a45fad9dc80b4e74b0ec31af2187b0e4b6cfee3b
SHA256 3804a768e956d3f30666258972b3215b738fdd58383b8ea808d31042f4fda439
SHA512 e53e058248544cdbcf219130ba4ec3dce6e6885745064e8da52174490b348952b72addb7bc45625d73521fea7c290f1698adc1efeada744a8eda08f7008247b3

C:\Program Files (x86)\SUDT\SUDT SerialNull\snserial.inf

MD5 c2aeabdadd719d5ff4097c4fe2995af7
SHA1 39cca12c94d4ba8aa41a6560a00b031de6899606
SHA256 392e836b5a9cdbba0f9b4eb8346a6c0281c134c070a40d99a2c71ad0d2362520
SHA512 7854dce413a860dde871d143480fc21ddbd2441516d9a913f568883aec726f0d45d5385dc2ac9fdf449babef2c72715378d683b097f869fd4f6ec6fe54281d38

memory/1636-90-0x0000000002B20000-0x0000000002B30000-memory.dmp

memory/1636-91-0x0000000002B70000-0x0000000002B80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DMI753F.tmp.log.xml

MD5 8785433e67e2bf36a62a4baf3ba85524
SHA1 ec9e1db622c02db3fa049032226bb089f5915912
SHA256 a671779765423d603cfe0dad9a88ae7c294ac657c7e7ad6b9723c58163fb541c
SHA512 487d383fa443ad325946082e6fc5c70726b20793047f6fd7bc2c34d5ff81697663cea2394ba129d9c151c026b03e91091658f275899bdd939265fd13c8d77f61

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-14 00:09

Reported

2024-12-14 00:12

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
N/A N/A C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\Temp\{8e9bdcb6-660e-0645-b389-5e1d5d052b44}\SETEDEA.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{8e9bdcb6-660e-0645-b389-5e1d5d052b44} C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{05a333c6-a3c2-fd48-a9df-e764e72384b8}\SETEEA6.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{e5485ddf-a195-f54c-8054-2a061f3beb7a}\SETEED4.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{993ddb2b-3874-5d48-87c1-76600f40c186}\SETED8C.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{e5485ddf-a195-f54c-8054-2a061f3beb7a}\SETEED4.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{e5485ddf-a195-f54c-8054-2a061f3beb7a}\snserial.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{e5485ddf-a195-f54c-8054-2a061f3beb7a} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{993ddb2b-3874-5d48-87c1-76600f40c186}\SETED8C.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{993ddb2b-3874-5d48-87c1-76600f40c186} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{8e9bdcb6-660e-0645-b389-5e1d5d052b44}\SETEDEA.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{05a333c6-a3c2-fd48-a9df-e764e72384b8}\SETEEA6.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{05a333c6-a3c2-fd48-a9df-e764e72384b8}\snbus.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{05a333c6-a3c2-fd48-a9df-e764e72384b8} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{993ddb2b-3874-5d48-87c1-76600f40c186}\snbus.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{8e9bdcb6-660e-0645-b389-5e1d5d052b44}\snserial.inf C:\Windows\system32\DrvInst.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-en-US.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-zh-TW.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\install.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\License.txt C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\sncht.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-en-US.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Settings.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-zh-CN.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SerialNull.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SnBus.sys C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Readme.txt C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-zh-TW.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SnSerial.sys C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SnBus.inf C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\SnSerial.inf C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\snchs.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\snchs.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\sncht.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SnSerial.sys C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SnSerial.inf C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\install.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Help.chm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File opened for modification C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\sneng.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Data\register-zh-CN.htm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SerialNull.exe C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\License.txt C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Language\sneng.ini C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SnBus.sys C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\SnBus.inf C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Readme.txt C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
File created C:\Program Files (x86)\SUDT\SUDT SerialNull\Help.chm C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\svchost.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1972 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1972 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1972 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 804 wrote to memory of 2092 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 804 wrote to memory of 2092 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 804 wrote to memory of 3148 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 804 wrote to memory of 3148 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 1972 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1972 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 1972 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe
PID 804 wrote to memory of 1676 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 804 wrote to memory of 1676 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 804 wrote to memory of 4480 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe
PID 804 wrote to memory of 4480 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\DrvInst.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe

"C:\Users\Admin\AppData\Local\Temp\SnSetup1.7.exe"

C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe

"C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe" -u

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8ffaeb9e-8f18-bb41-8be4-9c4c56772c1e}\snbus.inf" "9" "4c49640e7" "0000000000000100" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\SUDT\SUDT SerialNull"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{05a4a71f-6e97-f64c-85df-42a2411c4447}\snserial.inf" "9" "449a1470b" "0000000000000158" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\SUDT\SUDT SerialNull"

C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe

"C:\Program Files (x86)\SUDT\SUDT SerialNull\Install.exe"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4a66c3a3-cd07-054d-bb91-b6ffe7c5e4e4}\snbus.inf" "9" "4c49640e7" "000000000000015C" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files (x86)\SUDT\SUDT SerialNull"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8b9396b0-5480-744f-ba59-2bf8c5470c1c}\snserial.inf" "9" "449a1470b" "000000000000017C" "WinSta0\Default" "0000000000000100" "208" "C:\Program Files (x86)\SUDT\SUDT SerialNull"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsaA077.tmp\System.dll

MD5 d4d09da0218ba046a66a294f0cca9dfe
SHA1 417b1acdeb0a4de6ac752a93080ca5b9164eb44b
SHA256 9090e47d239aa1da9598a483861165e0153c01ad9ff9d65cb6c0f4497a1da5b3
SHA512 3bc9a65842301dab56c139cc5a3457158d37ef294583728c93da1e11ae457df9551b0f8fbd03d5ea3058f3bc794d0ede57ea3efd5d663b45d25647a39cd955bf

C:\Users\Admin\AppData\Local\Temp\nsaA077.tmp\LangDLL.dll

MD5 83c5a8e90cd10cb31a9215eb4421341f
SHA1 52ddbbfa955936f87516c52b2bb679a6b4363e22
SHA256 da006773e11871b8834036c30acab8fabcce2c9e9f52bb2b425f947bdf33f7c6
SHA512 46c20fd762a643028f3c4287ed3dbd762bc1cd17ee5ad1d90cbad23f15901fbab14b726d7f3e45eeb370fb6a2ee5268a2e9ebaae7ab6067c855361d24fc806a4

C:\Users\Admin\AppData\Local\Temp\nsaA077.tmp\Header.bmp

MD5 f12f2234e5496f8518390223324d8b1c
SHA1 6e470e2b41ad38422a5beb4e7f4d28b721dcf2a5
SHA256 46fbe97a281202d59414e0ca9a68009b8423ff5fdbc0027f4a309b588c9af7ec
SHA512 d83aed727d741e1e7d036a2c4021195b46ec474e021486d5f699b2a651d27287af5aabab9772232ee57c6856670d128b21db356f061396ebf779ceaca0af36d7

C:\Program Files (x86)\SUDT\SUDT SerialNull\SerialNull.exe

MD5 cfe544e042b57980bdc5c044e64d06a3
SHA1 38057e44e41d5eeb706e2e27b35b8e8d87d0fb24
SHA256 502f20ca9cf7259a73217d3144fdd2aefb697b997717b5a16e9c92a2d276afc9
SHA512 f741ac253760e579d9d0a10667863987ae35fbd806bbea9bef36f1062a7fea24358336d778970f44390576702568355c768453a9188ef9a9c13b84f88efd3e50

C:\Program Files (x86)\SUDT\SUDT SerialNull\install.exe

MD5 242b49803d0dc2c25486ab866d8516cb
SHA1 8d4302a242f4e3be1678e21e9bf79cc27f123e7d
SHA256 0d03931dae04b1d6cae8d3745c3aff6315e0df8c6b0bb2589fe77b50580e88f6
SHA512 02ba717114ac8fe22898356403065203d719e97b6bc4ececaf849fb21e02529bf54f367bd3468103045cc63a60c77935d8efa04fec67f6d80b60e43067966577

C:\Program Files (x86)\SUDT\SUDT SerialNull\snbus.inf

MD5 96d0078ea02ed681f67d8c8e6409473c
SHA1 a45fad9dc80b4e74b0ec31af2187b0e4b6cfee3b
SHA256 3804a768e956d3f30666258972b3215b738fdd58383b8ea808d31042f4fda439
SHA512 e53e058248544cdbcf219130ba4ec3dce6e6885745064e8da52174490b348952b72addb7bc45625d73521fea7c290f1698adc1efeada744a8eda08f7008247b3

C:\Program Files (x86)\SUDT\SUDT SerialNull\snserial.inf

MD5 c2aeabdadd719d5ff4097c4fe2995af7
SHA1 39cca12c94d4ba8aa41a6560a00b031de6899606
SHA256 392e836b5a9cdbba0f9b4eb8346a6c0281c134c070a40d99a2c71ad0d2362520
SHA512 7854dce413a860dde871d143480fc21ddbd2441516d9a913f568883aec726f0d45d5385dc2ac9fdf449babef2c72715378d683b097f869fd4f6ec6fe54281d38