Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    897s
  • max time network
    900s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250207-de
  • resource tags

    arch:x64arch:x86image:win11-20250207-delocale:de-deos:windows11-21h2-x64systemwindows
  • submitted
    08/02/2025, 11:33

General

  • Target

    nkth.exe

  • Size

    55KB

  • MD5

    33644523cb6a6c01bbf2dd5c3a97aafc

  • SHA1

    7fd0d35a09a32693d30ffdb49ecd69c1229d2a20

  • SHA256

    e451ebc803766d533d92baf458485284fb64cc3e8d4491cf410ea7fb2d5ded45

  • SHA512

    43bddd6e1cd6acf040fec6d2b51afd86daa0f5f8ef7990b7dab2e9a42bdcdec5fede30d0510e6fdfd1cb08a4028e5057061f7c4e91a8b5a300ae1af9505cef2b

  • SSDEEP

    1536:5EOADn6cpNPmSpVcDGiwsNMDdXExI3pmsm:bADn6cPzLcDGiwsNMDdXExI3pm

Malware Config

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • System policy modification 1 TTPs 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\nkth.exe
    "C:\Users\Admin\AppData\Local\Temp\nkth.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\3ee715ddbed2404d81a1ae4e1bbbe6c1.EXE
      "C:\Users\Admin\AppData\Local\Temp\3ee715ddbed2404d81a1ae4e1bbbe6c1.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Users\Admin\AppData\Local\Temp\MTHR7H.exe
        "C:\Users\Admin\AppData\Local\Temp\MTHR7H.exe"
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:876
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "Mason" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\Mason.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1536
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4969.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:1576
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTI3OUJFMzMtNzY4NC00NTBGLThCN0ItODI2Nzk4MTI0OThFfSIgdXNlcmlkPSJ7MkZGQTQzQTUtRDk4Mi00MTJDLTg3RUMtREU3QTg2RTRBOEZGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTkwRjA2NkItRjhDNC00RDlBLTk3OTktODdFQzI4NDI5MkFCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTczODk1MTk2MCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI0NTQ1NjU5MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMzY0Mjg0NzMiLz48L2FwcD48L3JlcXVlc3Q-
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:2448
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\MicrosoftEdge_X64_132.0.2957.140.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4988
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6367aa818,0x7ff6367aa824,0x7ff6367aa830
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:4772
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:1820
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6367aa818,0x7ff6367aa824,0x7ff6367aa830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:892
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3804
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff71534a818,0x7ff71534a824,0x7ff71534a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:4412
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4780
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff71534a818,0x7ff71534a824,0x7ff71534a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2444
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2864
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff71534a818,0x7ff71534a824,0x7ff71534a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1504
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTI3OUJFMzMtNzY4NC00NTBGLThCN0ItODI2Nzk4MTI0OThFfSIgdXNlcmlkPSJ7MkZGQTQzQTUtRDk4Mi00MTJDLTg3RUMtREU3QTg2RTRBOEZGfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntGOTk4OEFEMS1BMUQ5LTQxMkQtQTc1NS03MjJDMkRCMUYzODJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjQzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40MSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins0QkMzNDE5RC04NjJGLTRFQkMtOTQ3Ni1FQzJBRTI4Q0Y1QUZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkwLjAuODE4LjY2IiBuZXh0dmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzgzNDMxNTg5NDM3NjgyMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIxNzgzNTMwMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjE3ODM1MzAzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODE5MjQxMTc5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk2MTk2NzImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9Y1ZiUTRZVnE2WGZzakxwUDYlMmJueWlnM3RDUlZ3aGYlMmZmNGlrb1NGWTBBR3JaWFNIaERqRW1IU2VIUkJXaXBTUUh2ejd1SkplOTlHVnNpNW5WbjBGVHRRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTgxOTI0MTE3OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk2MTk2NzImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9Y1ZiUTRZVnE2WGZzakxwUDYlMmJueWlnM3RDUlZ3aGYlMmZmNGlrb1NGWTBBR3JaWFNIaERqRW1IU2VIUkJXaXBTUUh2ejd1SkplOTlHVnNpNW5WbjBGVHRRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc3MTgwMjE2IiB0b3RhbD0iMTc3MTgwMjE2IiBkb3dubG9hZF90aW1lX21zPSI0NTMyNTAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTgxOTM5NzQ0MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODMzNjE2NDgxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDM2NTQ5MTYzNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjY0MzgiIGRvd25sb2FkX3RpbWVfbXM9IjQ2MDE1NiIgZG93bmxvYWRlZD0iMTc3MTgwMjE2IiB0b3RhbD0iMTc3MTgwMjE2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI1MzE3MiIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMSIgcj0iMSIgYWQ9IjY2MTIiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0iezlFRjE4RUY2LUZDQTQtNDM5MS1CRTZGLTc3NkQ1QjJGRkRFRX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBjb2hvcnQ9InJyZkAwLjQxIiB1cGRhdGVfY291bnQ9IjEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7NTlCRkQ5OTAtNzY5OS00NEVELTlEMjctQTMzQUQ2RUMxRjg0fSIvPjwvYXBwPjwvcmVxdWVzdD4
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:2392
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{45413FB2-6459-45E8-BEC6-5B0ECDEC83DC}\EDGEMITMP_3C09C.tmp\setup.exe

    Filesize

    6.6MB

    MD5

    b4c8ad75087b8634d4f04dc6f92da9aa

    SHA1

    7efaa2472521c79d58c4ef18a258cc573704fb5d

    SHA256

    522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

    SHA512

    5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

    Filesize

    3.7MB

    MD5

    3646786aea064c0845f5bb1b8e976985

    SHA1

    a31ba2d2192898d4c0a01511395bdf87b0e53873

    SHA256

    a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

    SHA512

    145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

  • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

    Filesize

    789KB

    MD5

    45b6cb7ebfeec84d2122e2abe3063367

    SHA1

    e09de9f85a590e6003e992c23a3eb47a4a8a4422

    SHA256

    a4a6450e0a24cc8e915ebb2b24b836b04172b74579be6e7b222832261a3cab64

    SHA512

    b6bffe08d8d8bae18929a905a02a314cfe7cae36205fe0624f54ffa57c70379b74fceb1ad7d463f272b311cb34582cce101e01e3eebc30460631e14d6dc59b94

  • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

    Filesize

    795KB

    MD5

    04f166359595a54dcf0c963c2a652877

    SHA1

    1c9231bb0b3117b1cb8aeba076f5417cda373b3c

    SHA256

    8ca974b31ffd0539b7c6f7e91e01d95729b93f70550d4e9d65435314974525c6

    SHA512

    69a3d328b476ecaf2ccd5ca7e781f0f513a7fd4481eecb91d34afbc650448ded57dc2c0b6094bdad030bfd6af6b89461ece71f46b3ee0d97c40809a586233d9a

  • C:\Users\Admin\AppData\Local\Temp\3ee715ddbed2404d81a1ae4e1bbbe6c1.EXE

    Filesize

    241KB

    MD5

    8964489afcdf25c4eef3aea0e0c9a872

    SHA1

    656485b929fd67c26f733ba6e85525d76c8f9791

    SHA256

    6b4840400cf2f697ce98a66af37497447278ffef8dcac35182726154146ea066

    SHA512

    3ff73c9c910e1f30c9235501864e79d6ac4bc8fafbb62191edca0b4f5ad5c6a46efce9065c2cf169775b83954085d79d2cb45d6f4be8fdbb85a6163f98fecfab

  • C:\Users\Admin\AppData\Local\Temp\MTHR7H.exe

    Filesize

    150KB

    MD5

    e8a16450f1f658e2a216317eeab1ea49

    SHA1

    19b26d056d24b1e00933a104a8e320ba52c9c1eb

    SHA256

    6c0ffa7412a2aecdd253d12481460a4dd3ee02d912c3ee4d2124274e12add8a5

    SHA512

    93f952c4891eeb62a90b969973dcd5e5ce85b6d020b96f2520a5fcd47b21a4c6ccf9512d2c935c4dc3557b184a32d8b0623b342a1344b48fba24b6944749db98

  • C:\Users\Admin\AppData\Local\Temp\tmp4969.tmp.bat

    Filesize

    184B

    MD5

    72d92ed5baa8113b6f613916e6c98997

    SHA1

    e039fa4f935c035bfc41e417a67436d3151af879

    SHA256

    cc0e18e44544b7ad0218947ffb7e821666d85afe396017fdfe2b2b9ca742f9b9

    SHA512

    cf5d501c264c50ac1e8fca0d35488b865b37eef2797dc51fae4d4549c542910a0b1a2414056433e1d96737e04e5974440655e42fcfba086d30893b7061893875

  • C:\Windows\SystemTemp\msedge_installer.log

    Filesize

    72KB

    MD5

    4fdc5793f726c0181989ede60fbf8031

    SHA1

    9bdcb903c2b55f8a10f38303cc83dd30c19d3236

    SHA256

    fb43759f94d7e96617868708167b18d173da9cc46b1f8fc772b318728ccaeb34

    SHA512

    5114b9f84fe13d72f1ee417a34445f5900480f637b46da94cce98341d9ae186b7ad9d41942dac3eb4d4e0d9a654fb584dfb6a1351786b11b5e68e0f37ac32ca5

  • C:\Windows\SystemTemp\msedge_installer.log

    Filesize

    102KB

    MD5

    a6c65e08b0d08126e72a6c01ae77a073

    SHA1

    c1116a091033bba822c279348d5d399d98a29d25

    SHA256

    78292d9f306e29bdbf23d3a73ca9974ec1c175ed76215b2bacabb753e4fdcade

    SHA512

    6d9e91ee799013000dffbb4fba2fe0034f073dc04baa1b7543477d8004ddaf7472b7dd51d4090cb248557ec4e01aa2ab63af37b13ade307f95580cce025e590e

  • C:\Windows\SystemTemp\msedge_installer.log

    Filesize

    104KB

    MD5

    2b5daf284a3a89216c2effc355e2c35a

    SHA1

    5734b73b046523533d8d67bbc1b07ae0dd7c2b43

    SHA256

    40944ef4ae0434e62624dd9d56d016de4c24f64828f65c14a9f11f5ccddb38fa

    SHA512

    f777373cdb0f0a3c18b699a3284a04b82d2796f3492dc9e007905fa4c90967a19221c9f682e28bc640fcc41bdcc799c0ebfd2acffb365a282cdb39e760da26fb

  • memory/876-45-0x0000000006E60000-0x0000000006E6A000-memory.dmp

    Filesize

    40KB

  • memory/876-44-0x0000000006680000-0x0000000006712000-memory.dmp

    Filesize

    584KB

  • memory/876-40-0x0000000000E80000-0x0000000000EAA000-memory.dmp

    Filesize

    168KB

  • memory/876-41-0x0000000005E70000-0x0000000006416000-memory.dmp

    Filesize

    5.6MB

  • memory/3016-7-0x0000000074510000-0x0000000074AC1000-memory.dmp

    Filesize

    5.7MB

  • memory/3016-0-0x0000000074511000-0x0000000074512000-memory.dmp

    Filesize

    4KB

  • memory/3016-6-0x0000000074510000-0x0000000074AC1000-memory.dmp

    Filesize

    5.7MB

  • memory/3016-4-0x0000000074510000-0x0000000074AC1000-memory.dmp

    Filesize

    5.7MB

  • memory/3016-3-0x0000000074510000-0x0000000074AC1000-memory.dmp

    Filesize

    5.7MB

  • memory/3016-2-0x0000000074510000-0x0000000074AC1000-memory.dmp

    Filesize

    5.7MB

  • memory/3016-1-0x0000000074510000-0x0000000074AC1000-memory.dmp

    Filesize

    5.7MB

  • memory/4144-21-0x0000000002FF0000-0x0000000003006000-memory.dmp

    Filesize

    88KB

  • memory/4144-42-0x00007FFAD9E20000-0x00007FFADA8E2000-memory.dmp

    Filesize

    10.8MB

  • memory/4144-20-0x0000000000ED0000-0x0000000000F12000-memory.dmp

    Filesize

    264KB

  • memory/4144-19-0x00007FFAD9E23000-0x00007FFAD9E25000-memory.dmp

    Filesize

    8KB

  • memory/4144-22-0x00007FFAD9E20000-0x00007FFADA8E2000-memory.dmp

    Filesize

    10.8MB