Analysis

  • max time kernel
    900s
  • max time network
    906s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-02-2025 13:41

General

  • Target

    lmlmdos.exe

  • Size

    23KB

  • MD5

    5eb67cac2f9ef8a548ba327896909cda

  • SHA1

    b8f3612f2d00c581387b02a615ad178874b51329

  • SHA256

    f5c542679e18756fcaaf434a1df9ecee261c8fa6788b75dc64c458e4eef15f2d

  • SHA512

    40665518a5451f7bd86ca1e3ad58cec178566c0f45fde647e76c2bb8d81611ca61fe1974cb97988065239005ca63fc9de0c449d45357ee90a8a99ccd30a5415f

  • SSDEEP

    384:XweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZQy:oLq411eRpcnuI

Malware Config

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Downloads MZ/PE file 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 11 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\lmlmdos.exe
    "C:\Users\Admin\AppData\Local\Temp\lmlmdos.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:3204
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEEzQTI2N0QtRDc5Qy00NDlFLTk4RTUtOEQ0NTA2OTdDM0NDfSIgdXNlcmlkPSJ7RDhDQURDQ0QtMTlFNy00NDBCLUE5QTAtOEQ0NUVGMzBDNDA0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OTY4OTZFMTUtRERGQi00ODUzLUEzMTEtQkM0MjBCMUQ4Nzc5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU1NzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODAxNjUyMzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDc4NTMwMDAzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:4700
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\MicrosoftEdge_X64_132.0.2957.140.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1104
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff75b5ea818,0x7ff75b5ea824,0x7ff75b5ea830
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:4840
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:5024
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff75b5ea818,0x7ff75b5ea824,0x7ff75b5ea830
          4⤵
          • Executes dropped EXE
          PID:2556
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1276
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x228,0x22c,0x230,0x224,0x200,0x7ff67b7fa818,0x7ff67b7fa824,0x7ff67b7fa830
          4⤵
          • Executes dropped EXE
          PID:1776
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:4568
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff67b7fa818,0x7ff67b7fa824,0x7ff67b7fa830
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:2268
      • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2236
        • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff67b7fa818,0x7ff67b7fa824,0x7ff67b7fa830
          4⤵
          • Executes dropped EXE
          PID:4292
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:4344
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEEzQTI2N0QtRDc5Qy00NDlFLTk4RTUtOEQ0NTA2OTdDM0NDfSIgdXNlcmlkPSJ7RDhDQURDQ0QtMTlFNy00NDBCLUE5QTAtOEQ0NUVGMzBDNDA0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntDRjE4RDg5Ny00QUY5LTQ4OUEtODVCNi1CRjVDNzFCNUIxODZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIiIGNvaG9ydD0icnJmQDAuMTkiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMyIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7QUZFRjc4NjQtNzQ1QS00QjcwLTkxNjItQjFBMEU1NzIwMjJFfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjIiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM4MzQyMDkwOTIzMDMxMTAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMjE2NTUzMTEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEyMTgxMTAyOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA1MjExODU3MjkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzQwMDM2YS00ZTE4LTQ1NmQtOTZmYS1kMWQ5YzRjYTQ2NzY_UDE9MTczOTc5OTc1MCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1GemZ0b0QxNzM4T1olMmIwUVpQbW1GYWIlMmJ2RWEyZklhZmJ0VXZFRHRhSCUyZkpmdnQzcjFjMDhwZ05kM0JhWVVhS2NNOFRZQzFhWVVTaW1UQ3AwYkVJaDNOdyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNTIxMTg1NzI5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzQwMDM2YS00ZTE4LTQ1NmQtOTZmYS1kMWQ5YzRjYTQ2NzY_UDE9MTczOTc5OTc1MCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1GemZ0b0QxNzM4T1olMmIwUVpQbW1GYWIlMmJ2RWEyZklhZmJ0VXZFRHRhSCUyZkpmdnQzcjFjMDhwZ05kM0JhWVVhS2NNOFRZQzFhWVVTaW1UQ3AwYkVJaDNOdyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3NzE4MDIxNiIgdG90YWw9IjE3NzE4MDIxNiIgZG93bmxvYWRfdGltZV9tcz0iNTMzNjU2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNTIxMTg1NzI5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNTM0NjIzNjY0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTA4Mzk5ODcwNCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjE1MTUiIGRvd25sb2FkX3RpbWVfbXM9IjUzOTkzOCIgZG93bmxvYWRlZD0iMTc3MTgwMjE2IiB0b3RhbD0iMTc3MTgwMjE2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI1NDkzOCIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMyIgcj0iMyIgYWQ9IjY2MTIiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0iezk4NjI5RTI1LTQ3MkQtNDY1QS04QjVFLUZBNjI0QUFEMkFDNX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZT0iNjYwOCIgY29ob3J0PSJycmZAMC44NiI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIzIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins1QkMwQ0ZGNy1EQkRFLTQwMTMtQThDRi1GQTg2QzgzOTA3RER9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4068
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A92100C8-1269-41DC-94EA-5C65F8B86F7A}\EDGEMITMP_C6795.tmp\setup.exe

      Filesize

      6.6MB

      MD5

      b4c8ad75087b8634d4f04dc6f92da9aa

      SHA1

      7efaa2472521c79d58c4ef18a258cc573704fb5d

      SHA256

      522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

      SHA512

      5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

      Filesize

      3.7MB

      MD5

      3646786aea064c0845f5bb1b8e976985

      SHA1

      a31ba2d2192898d4c0a01511395bdf87b0e53873

      SHA256

      a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

      SHA512

      145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

    • C:\Program Files\msedge_installer.log

      Filesize

      70KB

      MD5

      b864e268492e91167bd1c69e61b6f0e2

      SHA1

      f6fef6fd9cf68bd9fc0233a588a8118c32ec5b89

      SHA256

      297200c0f98111ad48a2c50bfe0d71c079cac3fe82f78f614130fffdbe6c1fc7

      SHA512

      c52d6faff57fc452e43b42ed9a77d9d4f3b3e863cd0c143830f48774855e9dccb5fc31b5e58c4171a6038e35a6b7b4586a6756bfb5c76c571a53e5572f8aa209

    • C:\Program Files\msedge_installer.log

      Filesize

      99KB

      MD5

      94e3b3403b1db7321458f77f1d60bddb

      SHA1

      179996b026ecc4e778a9cb08836e591654eb4786

      SHA256

      eb013ab98309f02207079ff05a0a59408e95f8c580a75b2a3f3bd943dce22700

      SHA512

      557fa44ce20a64f00e4fdfa00833549fee80897ec387db2d89de54f7ef15ee49311973bdd077d7c999e295aba1e2460d2d7785aaf6e2949aca9e747697734abd

    • C:\Program Files\msedge_installer.log

      Filesize

      100KB

      MD5

      19b54464e124598d6b69a6194a0c0791

      SHA1

      6da11c18fa87becc33961bbfc276963a607f54be

      SHA256

      2eebb0a5d8a2cda90454615f9c62b3003de6112f55efff7b0645f976be1963db

      SHA512

      5ac94c84ce82e877ad6286569e65da82b3b72ee47972b247633b877fe681c7b7663ad96c006c430a12739272ea2994ff059bd164631f464e77948a6ba41f0314

    • C:\Program Files\msedge_installer.log

      Filesize

      101KB

      MD5

      6021b9c5e400abd7f90290f2679ed293

      SHA1

      8c56a374a2b4bc4ea072d3336e7820986813a73a

      SHA256

      2065d3583d0e2d60528f47d837856afe92bc5968cc919ad8061a6044076541bd

      SHA512

      43c4612372d18c8b38c505f0210ebf8e7c2d19d356095eedc6092d80ada7d5d04798f4911a1d32e91b1c8ae9a7a92a01bb24cbe073bea6a9b9bb2b7b59ff8eab

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

      Filesize

      1.1MB

      MD5

      a8ff649b629c824f05c73ec0517784c7

      SHA1

      4161659149fb0205f7be958fdd44a53933ea680a

      SHA256

      4e2ed4381f469719d0c50a4c01543549d17689aa844c4fb883449a56d5fb8f79

      SHA512

      018222d4f58d1f763e82fc9e4ada090a47d10832a3d229a0eae3645592604e3bc636b1f3dc5b2f2043e0305dd264764fab2ec399733746da2dd60a6b086bde88

    • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

      Filesize

      1.1MB

      MD5

      44e2f722c8017480cf194969d70873c6

      SHA1

      35e07408bc3e1a3d50257876eea978b9cd0c7d95

      SHA256

      eff6e5d8852f07ee2f699361a6783485fdb25ead8742bdb119c637c73cccedb7

      SHA512

      95f187588484a19e651420da4694cfde07d4b1942fc26b541d00da321fe7d9da4e9c658a9d14afe60810c0b5f05a936179e0063928343e8610f835f3d335865c

    • C:\Users\Admin\AppData\Local\Temp\server.exe

      Filesize

      23KB

      MD5

      5eb67cac2f9ef8a548ba327896909cda

      SHA1

      b8f3612f2d00c581387b02a615ad178874b51329

      SHA256

      f5c542679e18756fcaaf434a1df9ecee261c8fa6788b75dc64c458e4eef15f2d

      SHA512

      40665518a5451f7bd86ca1e3ad58cec178566c0f45fde647e76c2bb8d81611ca61fe1974cb97988065239005ca63fc9de0c449d45357ee90a8a99ccd30a5415f

    • memory/2236-12-0x00000000737B0000-0x0000000073D61000-memory.dmp

      Filesize

      5.7MB

    • memory/2236-0-0x00000000737B2000-0x00000000737B3000-memory.dmp

      Filesize

      4KB

    • memory/2236-2-0x00000000737B0000-0x0000000073D61000-memory.dmp

      Filesize

      5.7MB

    • memory/2236-1-0x00000000737B0000-0x0000000073D61000-memory.dmp

      Filesize

      5.7MB

    • memory/2824-13-0x00000000737B0000-0x0000000073D61000-memory.dmp

      Filesize

      5.7MB

    • memory/2824-19-0x00000000737B0000-0x0000000073D61000-memory.dmp

      Filesize

      5.7MB

    • memory/2824-17-0x00000000737B0000-0x0000000073D61000-memory.dmp

      Filesize

      5.7MB

    • memory/2824-16-0x00000000737B0000-0x0000000073D61000-memory.dmp

      Filesize

      5.7MB

    • memory/2824-14-0x00000000737B0000-0x0000000073D61000-memory.dmp

      Filesize

      5.7MB