njrat | cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d

Analysis

max time kernel
79s
max time network
80s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
22-01-2025 17:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Gaming Chair.exe
Size

7.0MB
MD5

b97c8aab67e949a5e43905ceed9b0319
SHA1

5b9f0aa33a1e4e325370711d950fdf06b737993f
SHA256

cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d
SHA512

e2c3a1773859c6e76a1dc155593ff96983cd1d499c4e9e3ff732027167d81b484c0d774652a7486e778b66b7abcb4d645b1d31c6b8199b95c4000ea6e7d40580
SSDEEP

98304:iSLCUGG+t+aCnfFXL/LNIRDB3YP1SnPWMO5RadDNkZCXA/G3Ra3Eql:8UGGw+zRIRFIP1Y+MooOHwRa3v

Score

10^/10

njrat lammer defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

station-gps.gl.at.ply.gg:26933

Mutex

ded5a8703334377d83da00a864706211

Attributes

reg_key
ded5a8703334377d83da00a864706211
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5364	netsh.exe
2112	netsh.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation	Gaming Chair.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation	Lammer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation	System.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ded5a8703334377d83da00a864706211.exe	System.exe

Executes dropped EXE 4 IoCs

pid	Process
2824	SilentPatcher.exe
5024	Lua Injector.exe
884	Lammer.exe
2460	System.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ded5a8703334377d83da00a864706211 = "\"C:\\ProgramData\\System.exe\" .."	System.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\dd7d9b1e-ec02-4374-9800-2f24c7ae7bed.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250122172254.pma	setup.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4360	sc.exe
1868	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lammer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaming Chair.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lua Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
6028	taskkill.exe
1592	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "23"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Gaming Chair.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe
5024	Lua Injector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	System.exe
Token: 33	2460	System.exe
Token: SeIncBasePriorityPrivilege	2460	System.exe
Token: 33	2460	System.exe
Token: SeIncBasePriorityPrivilege	2460	System.exe
Token: SeDebugPrivilege	6028	taskkill.exe
Token: 33	2460	System.exe
Token: SeIncBasePriorityPrivilege	2460	System.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: 33	2460	System.exe
Token: SeIncBasePriorityPrivilege	2460	System.exe
Token: 33	2460	System.exe
Token: SeIncBasePriorityPrivilege	2460	System.exe
Token: 33	2460	System.exe
Token: SeIncBasePriorityPrivilege	2460	System.exe
Token: 33	2460	System.exe
Token: SeIncBasePriorityPrivilege	2460	System.exe
Token: SeShutdownPrivilege	4712	shutdown.exe
Token: SeRemoteShutdownPrivilege	4712	shutdown.exe
Token: 33	2460	System.exe
Token: SeIncBasePriorityPrivilege	2460	System.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4004	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5256	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 2824	5152	Gaming Chair.exe	83
PID 5152 wrote to memory of 2824	5152	Gaming Chair.exe	83
PID 5152 wrote to memory of 5024	5152	Gaming Chair.exe	85
PID 5152 wrote to memory of 5024	5152	Gaming Chair.exe	85
PID 5152 wrote to memory of 5024	5152	Gaming Chair.exe	85
PID 2824 wrote to memory of 4184	2824	SilentPatcher.exe	87
PID 2824 wrote to memory of 4184	2824	SilentPatcher.exe	87
PID 5152 wrote to memory of 884	5152	Gaming Chair.exe	88
PID 5152 wrote to memory of 884	5152	Gaming Chair.exe	88
PID 5152 wrote to memory of 884	5152	Gaming Chair.exe	88
PID 5024 wrote to memory of 4464	5024	Lua Injector.exe	89
PID 5024 wrote to memory of 4464	5024	Lua Injector.exe	89
PID 5024 wrote to memory of 4464	5024	Lua Injector.exe	89
PID 4464 wrote to memory of 4360	4464	cmd.exe	90
PID 4464 wrote to memory of 4360	4464	cmd.exe	90
PID 4464 wrote to memory of 4360	4464	cmd.exe	90
PID 5024 wrote to memory of 2772	5024	Lua Injector.exe	91
PID 5024 wrote to memory of 2772	5024	Lua Injector.exe	91
PID 5024 wrote to memory of 2772	5024	Lua Injector.exe	91
PID 2772 wrote to memory of 1868	2772	cmd.exe	92
PID 2772 wrote to memory of 1868	2772	cmd.exe	92
PID 2772 wrote to memory of 1868	2772	cmd.exe	92
PID 884 wrote to memory of 2460	884	Lammer.exe	98
PID 884 wrote to memory of 2460	884	Lammer.exe	98
PID 884 wrote to memory of 2460	884	Lammer.exe	98
PID 2460 wrote to memory of 5364	2460	System.exe	101
PID 2460 wrote to memory of 5364	2460	System.exe	101
PID 2460 wrote to memory of 5364	2460	System.exe	101
PID 2460 wrote to memory of 2976	2460	System.exe	104
PID 2460 wrote to memory of 2976	2460	System.exe	104
PID 2460 wrote to memory of 2976	2460	System.exe	104
PID 2976 wrote to memory of 6028	2976	cmd.exe	106
PID 2976 wrote to memory of 6028	2976	cmd.exe	106
PID 2976 wrote to memory of 6028	2976	cmd.exe	106
PID 2460 wrote to memory of 5432	2460	System.exe	107
PID 2460 wrote to memory of 5432	2460	System.exe	107
PID 2460 wrote to memory of 5432	2460	System.exe	107
PID 5432 wrote to memory of 4548	5432	cmd.exe	109
PID 5432 wrote to memory of 4548	5432	cmd.exe	109
PID 5432 wrote to memory of 4548	5432	cmd.exe	109
PID 4548 wrote to memory of 4684	4548	net.exe	110
PID 4548 wrote to memory of 4684	4548	net.exe	110
PID 4548 wrote to memory of 4684	4548	net.exe	110
PID 5432 wrote to memory of 1592	5432	cmd.exe	111
PID 5432 wrote to memory of 1592	5432	cmd.exe	111
PID 5432 wrote to memory of 1592	5432	cmd.exe	111
PID 5432 wrote to memory of 2112	5432	cmd.exe	112
PID 5432 wrote to memory of 2112	5432	cmd.exe	112
PID 5432 wrote to memory of 2112	5432	cmd.exe	112
PID 2460 wrote to memory of 4532	2460	System.exe	113
PID 2460 wrote to memory of 4532	2460	System.exe	113
PID 2460 wrote to memory of 4532	2460	System.exe	113
PID 4532 wrote to memory of 4004	4532	cmd.exe	115
PID 4532 wrote to memory of 4004	4532	cmd.exe	115
PID 4004 wrote to memory of 1492	4004	msedge.exe	117
PID 4004 wrote to memory of 1492	4004	msedge.exe	117
PID 4004 wrote to memory of 2288	4004	msedge.exe	118
PID 4004 wrote to memory of 2288	4004	msedge.exe	118
PID 4004 wrote to memory of 2288	4004	msedge.exe	118
PID 4004 wrote to memory of 2288	4004	msedge.exe	118
PID 4004 wrote to memory of 2288	4004	msedge.exe	118
PID 4004 wrote to memory of 2288	4004	msedge.exe	118
PID 4004 wrote to memory of 2288	4004	msedge.exe	118
PID 4004 wrote to memory of 2288	4004	msedge.exe	118

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4184	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Gaming Chair.exe
"C:\Users\Admin\AppData\Local\Temp\Gaming Chair.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\attrib.exe
    attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
    3⤵
    - Views/modifies file attributes
    PID:4184
- C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start FairplayKD > NUL 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\SysWOW64\sc.exe
      sc start FairplayKD
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop %c > NUL 2>&1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\sc.exe
      sc stop %c
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1868
- C:\Users\Admin\AppData\Local\Temp\Lammer.exe
  "C:\Users\Admin\AppData\Local\Temp\Lammer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\ProgramData\System.exe
    "C:\ProgramData\System.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\ProgramData\System.exe" "System.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE0DA.tmp.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Windows\SysWOW64\taskkill.exe
        
        TASKKILL /F /IM EXPLORER.EXE
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF53E.tmp.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5432
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MpsSvc
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4684
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /t /im FirewallControlPanel.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall set opmode mode=disable
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFD1F.tmp.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.redtube.com/
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffe4d3046f8,0x7ffe4d304708,0x7ffe4d304718
        6⤵
        
        PID:1492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
        6⤵
        
        PID:2288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
        6⤵
        
        PID:1728
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
        6⤵
        
        PID:2812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
        6⤵
        
        PID:4676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
        6⤵
        
        PID:4028
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
        6⤵
        
        PID:1064
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
        6⤵
        
        PID:4588
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        Drops file in Program Files directory
        
        PID:3816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff655bb5460,0x7ff655bb5470,0x7ff655bb5480
        7⤵
        
        PID:5448
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
        6⤵
        
        PID:4312
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
        6⤵
        
        PID:3944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
        6⤵
        
        PID:3936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
        6⤵
        
        PID:4568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
        6⤵
        
        PID:1504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
        6⤵
        
        PID:4264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7644644553780592383,7599179889861554506,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
        6⤵
        
        PID:1080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C40.tmp.bat" "
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4868
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11676.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3008.tmp.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp85E9.tmp.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:5556
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown -s -t 1
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4512

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c5855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5408de1548eb3231accfb9f086f2b9db

SHA1
f2d8c7e9f3e26cd49ee0a7a4fecd70b2bf2b7e8a

SHA256
3052d0885e0ef0d71562958b851db519cfed36fd8e667b57a65374ee1a13a670

SHA512
783254d067de3ac40df618665be7f76a6a8acb7e63b875bffc3c0c73b68d138c8a98c437e6267a1eb33f04be976a14b081a528598b1e517cdd9ad2293501acc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
254fc2a9d1a15f391d493bff79f66f08

SHA1
6165d5a9de512bb33a82d99d141a2562aa1aabfb

SHA256
2bf9282b87bdef746d298cff0734b9a82cd9c24656cb167b24a84c30fb6a1fd0

SHA512
484a1c99ee3c3d1ebf0af5ec9e73c9a2ca3cf8918f0ba2a4b543b75fa587ec6b432866b74bcd6b5cdd9372532c882da438d44653bd5bccdbc94ebc27852ff9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
07e2bb74b6a5f4c60fda2b5f5d92971b

SHA1
880213643ffef547067979d10ae0c7e4ad91e502

SHA256
c46901ae61299d55411bdfec9b2c9dc16af7d76e314da6478af2714aaa3018f9

SHA512
5fab2ee86f7933928c6ea99fb65057ab3d68acb7ee081abc525da60806036cd99613accefcb1934a1ab40859840d08a3fc1cad78dec82173f51dfec0c25ff8a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
d7ebe40d82d71c715c5c21c12a2e2cbd

SHA1
0cab4cf47de1d461708952defbb8a132e0adb276

SHA256
fdc466f3a51ab3aa019027efe5b06e79ffe4740f40b053c58ba3ee00c0122bf5

SHA512
7511c63d6bf7f7491c522f5448b8772b905de47bcc1e89d4fa49c1a756d01be1ec896d2589633b015805ab24c4471b08944f4eb33a374a11a09aca607c05663e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
adc631f46fe3b8abbd6a4dd0c60037b2

SHA1
af533655d0664207b7aee8ffd79759c93f577213

SHA256
a0807c6900544b015ad1de2f967fed7e34628fbd292a7b98a4fa5f97001e97e4

SHA512
4a1cab279cfde038957d7aa0edf0ac661422668376b4524efc69e3ea72ec5a0d7ad0ef369d9f15fcc5f551bd2968af14dc6882f34f6a3f6138974ffe07c96708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3bc5c2a558f2446f46d10ad52aca27d7

SHA1
76c52ea9ada7f3f56b75646467e6e7fef84dc069

SHA256
d894e15f4f2e4aa9007c01e6d35069ed8d5e569a60f24b34ffb5770c406f45fd

SHA512
1e1f5c2f98b27b08aea56ceb7bf9c7042c038b1acfa86050c22b7d9efacb396b674f3e64a370837e2d9c4504537297f673f37e58d0031c9f33e8865dd51fa60d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bded4e33bab8bed8f417bf89cdb938ea

SHA1
572be7f8121f5bb79cc78091ce7164c905f34766

SHA256
4eaaba5661341a91b260d25f0fe4d417c94887ef296bbbf7bfcb66bc1ee4bec0

SHA512
928a5a9110dee041cbd077064af4e0a28f1df80b6870ab2becc21a978003c26bcb729ac0948264fd9ffebe0a1bd3dae6d630c4962f1c3baf4ec3a420cf019a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
48febe0b0625901956573dfb2378e7ed

SHA1
c324173a8f8fd7a6a7398f6bb24dd2ee11d3cf24

SHA256
f0fae7ad33efdd05845d0d631ce8341ea4b6dfd4c45be844f0c117738df9c0d0

SHA512
fc38a0c64e67e3b5d43f787fe86f700e6f753d8e90bcebc446d4a8c631b9e4362a74fa862a5b2ffc74f3f5236d3ecf006b341042b5469d1cc24f2c325a607a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc3a0ca62cfef580ff9ebbb7afc92b9b

SHA1
fde9832ce521fcd53850d0701a543ef75b772e3b

SHA256
b0203fb7c3812937e92ac04ad6065a2129bc165a36a60a4d2fdb0accc4499464

SHA512
fc1f3a5bd2106d9b6ed5a678c2f4978550a0d7414172b0ce6954a835b0da01ac28c177955a48c2ef56ea3d517a6672474a9cab873aeccae3f22a45ccf2d070de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
168B

MD5
662dce4fb6f5ce6449e423497e05ee6c

SHA1
a67f06295a0bac281d367890e7ca69fb4bc9c31a

SHA256
6e249e7fdf696506e5e28109ecad88a3b2b04b5e3f3b18209202c8a79045c665

SHA512
6b4c7dd4dd78fd39298f8036d4fcd4ada748bf991ef098a349f963ba9a74a8bb18aa19974241e3d8b7459c4f8560dd428bae4812d4897fa27b0a05ae2a740919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585b69.TMP

Filesize
48B

MD5
e417d073d4c5c21f90872b5646c513d9

SHA1
97f464b5378fc13f5898d9f817187118caec219e

SHA256
618a0f57d64c3ea6989ba2ad40421fcbbf370bead5515f52f8d43baf649439c5

SHA512
df7918814dfd96589174f5a98dee3072364591819575fc430dfb41ffb748301fc4fbcb20a11f90f5af1e53a342b2896f5fcb9c2ea3fec16ca271c7c5058b7fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b359d018b392b3009aeabf9d73ec031f

SHA1
2af15cf108080116a065dc80d4c499dfa76064ac

SHA256
914b58f75c31ffd664622274b15606390d663536c47d07146301ae5ed6d8d14b

SHA512
5fbd7b1be24dd4678fa97be522f6ff29a06da2555a68c2a32ff05300b71a2b0b383d0b5e916a2eb0f2409fef7629b848853df3512ce2474e4e644a0010a040b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9a92cf50f0ff43bfcdfb3baf2e14abe5

SHA1
aeed31f86f30a747e85645ea473c8135cd7ee92b

SHA256
f9d76090d4ee5e0b7eebc064f9531189799e6c81b4faa9fca3235ad8eecca646

SHA512
cd59bbeab755cbf2d9bd1c7bc44f864d6ac608a24d5363d2f1995713f61f27dbf312f1ad50f4f6b92d275c4328dca6d0dbf4c3c21cd2363f777ad897f45b947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\20933.vbs

Filesize
15B

MD5
1571094ba67aca326126f75e3dc4891c

SHA1
5d910d777fafb73f6f32b49ccbb2d31a610e6a79

SHA256
e2998b6e6ec64c422e94a7af91f7b74916d8165ac4021f76f63f054ff65f10fa

SHA512
06191fd946c052df09bbddf1c30352469579d52bc0aa6038b18f233009961ded6c94d17fc4c874b11a3813390576a620889810b259230e143172cf38c53a3cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lammer.exe

Filesize
23KB

MD5
8ef1c362e7a42893a331a657d021d665

SHA1
fdfe06f05c2a51ef8968ddc1d9a7595d694c93f8

SHA256
db27bc172a5de048b3514746a8d78bfda52828ac10bf929fc89839b2cdc9deab

SHA512
978e8ea7504b32f1d4f18a34f7822c60593ea5bda821cd63d77b7e2e9b13f4fabfc5f89ec681cbcf88669138b2936394761e4da58e223d80c3948e28148ce299

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lua Injector.exe

Filesize
2.1MB

MD5
6b1ae040f09a43a4f0eee6fd964e2a47

SHA1
5d5ae0e6d89612fa55286f12f3a09443408ac1df

SHA256
d1163ec121ee6bdd11496c227b5f09a69cd2172aca93d111fac1be0cf73be0f2

SHA512
e6a7ad8d8245b7fa009b77c77e5d85059bcc6802247b72a5bf927a97390650d446f83984c43a3fd6cd5f5a35f747bda6b5d1e408aa59f212a856cc9eaca861a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SilentPatcher.exe

Filesize
2.6MB

MD5
7145358dc4b4908c33481df669f6a0f4

SHA1
87f13e788bd0bc105f1a9e992166ac819488d9c5

SHA256
d1035e2bc6fe5b8450d60f6c45c4d9479a014cec0f15cfd00a23a65a5e10634a

SHA512
164c6506b0df97877e15f1b2a668f06521b510817575d9c6df716bdf51e6deac20e2c78eb4ca1f42f4337aec7b747f7ebbcc5d7821a3ce92ac68aca8bd0c184a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1C40.tmp.bat

Filesize
114B

MD5
43e331b0b04228d37be65b4bc35d3eaa

SHA1
9b4c0308492f8e88b61b5ec3bfc5ab343781dbca

SHA256
e96b950444a3775b1f70929527ef85bdb6cb57dbdb13ea5b73ce1f91053238e5

SHA512
7b0239ee379b8f6848d362637b4ffaa18f8b9772f045bb882626f1a0f2dc693e0f5dca75a2bde9786666b3e41e5068e945f6ad6a47e86017d42bbe3510870569

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3008.tmp.bat

Filesize
185B

MD5
f0dfe96c58a7a81be2c6938f53e1f982

SHA1
fa31f1755bccdcdf14174f0eb30ba0cf8da41a81

SHA256
2b51af812899dad4305fccec8de8a17df5bc05ccc93c1ebac46acabde148889e

SHA512
91b40013604a84152ef8cf5fe10e5709828860857239a560d7e3a8222dec066716abe71323ddc47994ef41c862ff403a2d7041710af9a30e59f3e4e0201eadeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp85E9.tmp.bat

Filesize
34B

MD5
af45a1096d1543e3b8a84eb76743e1e5

SHA1
74b3825abdc9f63ee98ce5cf02520d4fefb1e52b

SHA256
ea973f052ee5036b535a0b1593bb982861e793367980a4f4d33b6a92d0936bd4

SHA512
db55de580e493150326567ca8879b6acfb63d55ce70d5ec74cb96e21cd6d9cf6198e0afe1cea2b4d4ca49889c50e7f616034e1abb079b544a01c67abcda3b4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE0DA.tmp.bat

Filesize
55B

MD5
07b4bc97851f8703052e491426e0c7fa

SHA1
49faa15bebefef1bb4657b718dd22112ae6d69ae

SHA256
919e32e4e486eb117c0aa5f5359583e9e0e49062c959e120e126760647f7409c

SHA512
e04c6ec5e44b7d5245fd450ad57f30d16a95895c0dfca42a932fe6663197a6992e636381b3748c52eba665cf44aba1064ef58f8b45172bf9315f6ce07818a642

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF53E.tmp.bat

Filesize
175B

MD5
4c233ae34e0e53590b756e9bc8468077

SHA1
e3d4cffdeecc863fc189b7abb14d09201241e309

SHA256
3823ed36754159b8544b630d7ad3a68415d77a6b04c2a1ed327ca3cbaeaaee79

SHA512
7a960eca6495e0a69944abacaf3e0ade18b35b1b0157414ff1f4a14932c661de26c0deea8a2066eab965a7e13513e40c2d05a279775a691223e24d3e8a8a859f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpFD1F.tmp.bat

Filesize
37B

MD5
f5726d253fe5d4ecc9568bd9999883ca

SHA1
8fec12574c36283782076dd020fe67bbd6c49b8b

SHA256
1ede0c20a3dc0fd37285a36f19be95d0770f162e199e3514713301ecc8d05687

SHA512
2bc5d23a1eac45030c181f585c1a44b74386779d1e6e9448e190210d4eae4f98273923b7e055985d06c17e629429098fa78fa11a365d40fc93406cf6a13c9ee6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6224f2712548cad3a1fef0425e48b7be

SHA1
c1f05f89f01e6388ca0414eedf1d22348c47bf93

SHA256
9dcc333cb0049959ae5152dd4168462b77729fea5c880a576adea3fe2a7dc31b

SHA512
272785900813370ba6ac579b1785366848ab088499faf1647ae2e0424e592ecedda8553edc875cb233a9676aad1aa2b1e71076ed572d93dffc86b2de4437a27f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
ef5903a2ca65df59d7100108912805f2

SHA1
2fd89d8c9da1e143d863d205c6a7b933594300db

SHA256
ba6cbd602af2e01bfb765c5e48dbf4fd349083d3bcb3ec7f09022042abfec6e3

SHA512
4a425fa8c44cd5187aacd298771e6ed08bbc197d90fca1a357cd1a88e8cfe6e8c11751c94e3eef50776eca271d3b0d1000d3d564a0511ecab4a64338f187ba05

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
memory/884-108-0x0000000000E30000-0x0000000000E40000-memory.dmp

Filesize
64KB

Download
memory/5152-0-0x0000000000400000-0x0000000000B04000-memory.dmp

Filesize
7.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads