Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

nkth.exe

windows7-x64

10

nkth.exe

windows7-x64

10

nkth.exe

windows10-2004-x64

10

nkth.exe

windows10-ltsc 2021-x64

10

nkth.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    897s
  • max time network
    901s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250207-es
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250207-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows
  • submitted
    08/02/2025, 11:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    nkth.exe

  • Size

    55KB

  • MD5

    33644523cb6a6c01bbf2dd5c3a97aafc

  • SHA1

    7fd0d35a09a32693d30ffdb49ecd69c1229d2a20

  • SHA256

    e451ebc803766d533d92baf458485284fb64cc3e8d4491cf410ea7fb2d5ded45

  • SHA512

    43bddd6e1cd6acf040fec6d2b51afd86daa0f5f8ef7990b7dab2e9a42bdcdec5fede30d0510e6fdfd1cb08a4028e5057061f7c4e91a8b5a300ae1af9505cef2b

  • SSDEEP

    1536:5EOADn6cpNPmSpVcDGiwsNMDdXExI3pmsm:bADn6cPzLcDGiwsNMDdXExI3pm

Score
10/10
njratadwarebootkitdiscoverypersistenceprivilege_escalationstealertrojan

Malware Config

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\nkth.exe
    "C:\Users\Admin\AppData\Local\Temp\nkth.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Users\Admin\AppData\Local\Temp\d80f015b1fea4ee09435ff8a51b300e9.EXE
      "C:\Users\Admin\AppData\Local\Temp\d80f015b1fea4ee09435ff8a51b300e9.EXE"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Users\Admin\AppData\Local\Temp\MTHR7H.exe
        "C:\Users\Admin\AppData\Local\Temp\MTHR7H.exe"
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        PID:2908
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "Mason" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\Mason.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4708
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp85B7.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1880
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:112
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjUyQTQxQjItMDEwQi00QjZGLUI4REEtNEYyNzQ4RTk4MEM0fSIgdXNlcmlkPSJ7OTY2M0M5M0ItNTE0NS00Mjg0LTlFN0MtOUYzMEE3M0UyQ0UzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDg5N0EwNTUtQzM0NC00NUI3LUI3MjEtMTdCOEQ0MkY3MEQ5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NjE1IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDc5NTE4NzcwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ4ODgzMTE0NyIvPjwvYXBwPjwvcmVxdWVzdD4
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:1276
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\MicrosoftEdge_X64_132.0.2957.140.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2276
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff77563a818,0x7ff77563a824,0x7ff77563a830
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:4080
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:3492
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff77563a818,0x7ff77563a824,0x7ff77563a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:936
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6c602a818,0x7ff6c602a824,0x7ff6c602a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3124
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6c602a818,0x7ff6c602a824,0x7ff6c602a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:2384
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6c602a818,0x7ff6c602a824,0x7ff6c602a830
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:3292
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:3344
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjUyQTQxQjItMDEwQi00QjZGLUI4REEtNEYyNzQ4RTk4MEM0fSIgdXNlcmlkPSJ7OTY2M0M5M0ItNTE0NS00Mjg0LTlFN0MtOUYzMEE3M0UyQ0UzfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntFQkQ0MTEyNS01RUEyLTQ3MjYtQjc1Mi1EOTMyODcyRjUwOTd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQ0LjQ1MjkiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSIxMjUiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuNDMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBjb2hvcnQ9InJyZkAwLjUwIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjEiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0ie0NFNTI5RTJFLTgxRjktNDc1NS05OURDLTE4Mzc0MTA0MDNDOX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIwIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzODM0MTY4MDg0NDY5OTkwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTExNDg4MDY2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MTE2NDM2MjQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0NTExNzUwMzUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzQwMDM2YS00ZTE4LTQ1NmQtOTZmYS1kMWQ5YzRjYTQ2NzY_UDE9MTczOTYxOTY0NiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1FYjdPaGlPSnJkcG1LMWZUdVV3Umw1UHNPeXM0Z0VsQm1xVkUzV3YwSE1xV3g2eGpUJTJmUTJYdW9KMmttJTJid0xyU2R6VDF4UFo3czg0RXFDZmQ3Z2R2alElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDUxMTc1MDM1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzQwMDM2YS00ZTE4LTQ1NmQtOTZmYS1kMWQ5YzRjYTQ2NzY_UDE9MTczOTYxOTY0NiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1FYjdPaGlPSnJkcG1LMWZUdVV3Umw1UHNPeXM0Z0VsQm1xVkUzV3YwSE1xV3g2eGpUJTJmUTJYdW9KMmttJTJid0xyU2R6VDF4UFo3czg0RXFDZmQ3Z2R2alElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9Ijg3ODkxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0NTEzMzE1MTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ2NDE0NDEwNyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzAwMTAxOTQwOSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjE0NTQiIGRvd25sb2FkX3RpbWVfbXM9IjkzOTY5IiBkb3dubG9hZGVkPSIxNzcxODAyMTYiIHRvdGFsPSIxNzcxODAyMTYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjUzNjg4Ii8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNjYxMiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7RUNCODU1NUEtOThBOC00QzZFLUI4N0EtQzlGNTEyRDFBNDdBfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzIuMC4yOTU3LjE0MCIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NjA4IiBjb2hvcnQ9InJyZkAwLjI4Ij48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjEiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0iezk1RDJBNENELUY4RjYtNDE3NC1BNkQ5LTg2MDk1MjhFMThGNX0iLz48L2FwcD48L3JlcXVlc3Q-
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:1120
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2352

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Browser Extensions

    1
    T1176

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Pre-OS Boot

    1
    T1542

    Bootkit

    1
    T1542.003

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Modify Registry

    4
    T1112

    Pre-OS Boot

    1
    T1542

    Bootkit

    1
    T1542.003

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{4421F197-EC07-46EA-9205-A0F4897CF312}\EDGEMITMP_37F5F.tmp\setup.exe
      Filesize

      6.6MB

      MD5

      b4c8ad75087b8634d4f04dc6f92da9aa

      SHA1

      7efaa2472521c79d58c4ef18a258cc573704fb5d

      SHA256

      522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

      SHA512

      5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

      Download Submit

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
      Filesize

      512KB

      MD5

      691d3f52c792afaf86c0737a5bc77e9b

      SHA1

      73f065f18030bf2abda8e4d37e9c39b3242064c5

      SHA256

      1f4673ffbf81832eac966ed164e42aeac2b087f7c7fe6011aa6de25e6c32561a

      SHA512

      8128738068290e6dbd7c8d9e9bfa38ab66d57f2ced0ab2db45aa99a8c41fb115dbc1a29a176e5f2894fdc3b2b1761a7437850a59715505f0319643f17ed3d214

      Download Submit

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
      Filesize

      526KB

      MD5

      d15badc401aec0fd5198294b9beddf2d

      SHA1

      db739aeeca2557958832164e0bda2bafbfb9f3de

      SHA256

      1db8af1eda4ffb4be2106e88e5e6a619b4d2740c31729060e8691bda341238da

      SHA512

      1289137333de87728b6be7775d3aeeecc2e760826701e5c1b409455111c35a57244f7700d42fa8d0ae0129cae125516ae89bb88446ced899ef45280fe8bae646

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MTHR7H.exe
      Filesize

      150KB

      MD5

      e8a16450f1f658e2a216317eeab1ea49

      SHA1

      19b26d056d24b1e00933a104a8e320ba52c9c1eb

      SHA256

      6c0ffa7412a2aecdd253d12481460a4dd3ee02d912c3ee4d2124274e12add8a5

      SHA512

      93f952c4891eeb62a90b969973dcd5e5ce85b6d020b96f2520a5fcd47b21a4c6ccf9512d2c935c4dc3557b184a32d8b0623b342a1344b48fba24b6944749db98

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\d80f015b1fea4ee09435ff8a51b300e9.EXE
      Filesize

      241KB

      MD5

      8964489afcdf25c4eef3aea0e0c9a872

      SHA1

      656485b929fd67c26f733ba6e85525d76c8f9791

      SHA256

      6b4840400cf2f697ce98a66af37497447278ffef8dcac35182726154146ea066

      SHA512

      3ff73c9c910e1f30c9235501864e79d6ac4bc8fafbb62191edca0b4f5ad5c6a46efce9065c2cf169775b83954085d79d2cb45d6f4be8fdbb85a6163f98fecfab

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp85B7.tmp.bat
      Filesize

      184B

      MD5

      8904cdb4b431a3072fdc336fb7c53858

      SHA1

      fee5e4b459115d1451160a226a18ab19303cd8b6

      SHA256

      df960058e2e4b4700ceb08b766ef10a463b449035abec71c4066f0d7d9dcf130

      SHA512

      a08fc21ad908633235972a2f9779a06e1fadbb0fa27d3c678077caa46773de9822263033f65a245c29424049b378f804057c5c8b5cdfc8dad14ad779059520a1

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      71KB

      MD5

      c23bf19b73f8270bf9463fc26a8218a3

      SHA1

      9eefab1083cf0a04650a77e2a0e2887674798b7e

      SHA256

      2425fb274a505eb7a0b618f1387f65edb65feffd1d624730385031264407d88e

      SHA512

      078792bfed4712049dadce2e7410a40a1825c3bb5c8810ab3dde4877d9471f8ce0112e834d678d4cc0180fa091bc87c3dc6fb638ca110ffe0bb2b0a9d02d3d24

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      95KB

      MD5

      0e717ef2019d92654a1b59fe0b776c61

      SHA1

      7c2cd0e6b8542721778544fc35322d74309be1f1

      SHA256

      485b4ea33d755ad23ff4471fd52f196d6ad8bf62ba0bbe78d67ef35d8d517496

      SHA512

      97043f43d6b1af88a8aa6b5fe1bba8a3e5eb9e9729516c3899aebd80e89e46ab18d232a2a3e96fb7d83cab1666a3255a6da4ce0da50398b47f6f689c63a54845

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      96KB

      MD5

      db175db0a4e8fe9c027d35f3b569b110

      SHA1

      49b63404776d734529cbb8d74ad9f45272be9a31

      SHA256

      06b433b44141d1ba6903af01f9cc9926400bf48205a4bf9775bda313da86486a

      SHA512

      8cee1cb2c94ec36b5198a5aa861c0eafc046c5ba65f29bdcceec2db972480df81fd33227b08149fea2d586116de646b199d5be63a62d3153c67a900a56d53640

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      101KB

      MD5

      23dab2ec4f74e3d18825aae6f6d9a8c6

      SHA1

      da1d02154046540bf5c1e52a3123e1bc1a469a7d

      SHA256

      c224f479dee2725b420539eba20ea404e98d2419952bb69be501dbdc5360cd28

      SHA512

      a1d1250e4fb8b5fdbfc9b931c461aa07cce19c0e5899160d2c8976259d6a1aeeb9befc0c6a2280e98c59b8adc7d85e45d483fb97b68082d2588313bc9e8787e4

      Download Submit

    • memory/1756-2-0x00000000740F0000-0x00000000746A1000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1756-3-0x00000000740F2000-0x00000000740F3000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1756-6-0x00000000740F0000-0x00000000746A1000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1756-5-0x00000000740F0000-0x00000000746A1000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1756-4-0x00000000740F0000-0x00000000746A1000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1756-1-0x00000000740F0000-0x00000000746A1000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1756-7-0x00000000740F0000-0x00000000746A1000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1756-0-0x00000000740F2000-0x00000000740F3000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2908-393-0x0000000000980000-0x00000000009AA000-memory.dmp

      Filesize

      168KB

      Download

    • memory/2908-396-0x0000000005870000-0x0000000005E16000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2908-399-0x0000000006080000-0x0000000006112000-memory.dmp

      Filesize

      584KB

      Download

    • memory/2908-400-0x0000000006500000-0x000000000650A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/5004-375-0x0000000000A00000-0x0000000000A16000-memory.dmp

      Filesize

      88KB

      Download

    • memory/5004-374-0x0000000000210000-0x0000000000252000-memory.dmp

      Filesize

      264KB

      Download