hxxps://drive[.]google[.]com/file/d/1ah5uF8wfMGoxIiesDS9ZyQao2estxetk/view?usp=sharing

Analysis

max time kernel
306s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20250211-ja
resource tags

arch:x64arch:x86image:win10v2004-20250211-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
12-02-2025 00:09

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1ah5uF8wfMGoxIiesDS9ZyQao2estxetk/view?usp=sharing

Score

10^/10

bootkit defense_evasion discovery persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uacdisable.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	uacdisable.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
101	3568	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2671265011-1578681955-3068118665-1000\Control Panel\International\Geo\Nation	Typia.exe

Executes dropped EXE 3 IoCs

pid	Process
3308	Typia.exe
2456	uacdisable.exe
400	mbr1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2671265011-1578681955-3068118665-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Windows\\Typia\\mbr1.exe"	mbr1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr1.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Typia\mbr1.exe	Typia.exe
File opened for modification	C:\Windows\Typia\mbr1.exe	Typia.exe
File created	C:\Windows\Typia\mbr2.exe	Typia.exe
File opened for modification	C:\Windows\Typia\mbr2.exe	Typia.exe
File created	C:\Windows\Typia\main.bat	Typia.exe
File created	C:\Windows\Typia\__tmp_rar_sfx_access_check_240934890	Typia.exe
File created	C:\Windows\Typia\typia.bat	Typia.exe
File opened for modification	C:\Windows\Typia\typia.bat	Typia.exe
File opened for modification	C:\Windows\Typia\main.bat	Typia.exe
File opened for modification	C:\Windows\Typia\uacdisable.exe	Typia.exe
File opened for modification	C:\Windows\Typia	Typia.exe
File created	C:\Windows\Typia\uacdisable.exe	Typia.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	400	WerFault.exe	130

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uacdisable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Typia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1832	MicrosoftEdgeUpdate.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2372	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4248	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
4852	msedge.exe
4852	msedge.exe
2628	msedge.exe
2628	msedge.exe
2968	identity_helper.exe
2968	identity_helper.exe
400	mbr1.exe
400	mbr1.exe
400	mbr1.exe
400	mbr1.exe
400	mbr1.exe
400	mbr1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	1592	7zG.exe
Token: 35	1592	7zG.exe
Token: SeSecurityPrivilege	1592	7zG.exe
Token: SeSecurityPrivilege	1592	7zG.exe
Token: SeRestorePrivilege	3988	7zG.exe
Token: 35	3988	7zG.exe
Token: SeSecurityPrivilege	3988	7zG.exe
Token: SeSecurityPrivilege	3988	7zG.exe
Token: SeShutdownPrivilege	1832	shutdown.exe
Token: SeRemoteShutdownPrivilege	1832	shutdown.exe
Token: SeDebugPrivilege	400	mbr1.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
1592	7zG.exe
3988	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3308	Typia.exe
2456	uacdisable.exe
400	mbr1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1572	4852	msedge.exe	84
PID 4852 wrote to memory of 1572	4852	msedge.exe	84
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 2016	4852	msedge.exe	85
PID 4852 wrote to memory of 3852	4852	msedge.exe	86
PID 4852 wrote to memory of 3852	4852	msedge.exe	86
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87
PID 4852 wrote to memory of 2596	4852	msedge.exe	87

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	uacdisable.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uacdisable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	uacdisable.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1ah5uF8wfMGoxIiesDS9ZyQao2estxetk/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffde1746f8,0x7fffde174708,0x7fffde174718
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --service-sandbox-type=collections --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,14247604082444037379,11730426222917153347,131072 --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUUzRERDMjYtQUQ1Ny00NEY3LUExQUItQjkwMDMyMDZBQTNDfSIgdXNlcmlkPSJ7REQ3NjdDREQtQTQ2MC00MDM5LThGQUItNTkyNDY5MEVDMzg2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MTc3NzkwN0EtNkYxQy00QTQ4LTgzODQtNDU4MTgwQjVFNzgyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MDYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDI3ODAwNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzA4Mjg2NzY1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3492

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Typia_2\" -ad -an -ai#7zMap27482:74:7zEvent30752
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1592

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Typia_2\Typia\" -ad -an -ai#7zMap410:88:7zEvent30700
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3988

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4248

C:\Users\Admin\Desktop\Typia.exe
"C:\Users\Admin\Desktop\Typia.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Typia\main.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Windows\Typia\typia.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4416
  - - C:\Windows\Typia\uacdisable.exe
      uacdisable.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2456
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2372
  - - C:\Windows\SysWOW64\shutdown.exe
      Shutdown -r -t 10
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1832
  - - C:\Windows\Typia\mbr1.exe
      mbr1.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:400
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Windows\Typia\mbr1.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 528
        5⤵
        Program crash
        
        PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 400
1⤵
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
004d3d2aa9e0e8431f47901abb90f0ba

SHA1
ce129345619faf962a256a65da4624854a4e7ece

SHA256
d3b4ec4d327fc45c09cbf9a0ebf587fe7f031e89bea48b9a9b74230b87d168ab

SHA512
3741e30d0d3ac72b645d43e086a294e31091c6b6a80f74b88a1f27e60490a70c17baca25387e0b54f6f90abd1eabdd8ed885bc8d554c7286f07155afdcf01381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4cafc69c423e360fae1761e5c427cae9

SHA1
3cebbb7de72319b47f2e9111c50a8db628cf4350

SHA256
d3b9d572d6851da285d9b31ffab1a8fa414bffc689ee4b2c0118c51e26372175

SHA512
549d61aa7a5526bb989de432522a0241e17669c5844b01bc4e6e768398dbe2cc46e3add8f3fc5fc0979f8bd08444ba4a3a1a930958810cd46f2c19f28435c587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
842c34c418815318c562a961d891dde8

SHA1
00fb7cfaea93f454ddc3dd8c7fa9d33b28b2e601

SHA256
90e343c4c4cf79b202e0383d5aec562a871b14ea5bf6d24798f8cb186b9aeb16

SHA512
1dc138ba2815ec6cf7b16d78ab0efbcefc4d6d8fb0b366889e09993f2525278807fbde3ea6c4ca4bab746a8391781ee8249ea8b1aa2a1f78bebc3c13f1852ed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f95266dbf577063b269ece3a84fd9e43

SHA1
d93714bfedd58faab331fca79ad1d22e32c2b788

SHA256
1d9a790923d185c075d4e4026c147f4f90e073d60831c1aab9b7098d08994bec

SHA512
a495833ddd2e3b3ec549273752e1e73f6f9e07460edffc05c031925c0221b62d48a6e6ddad1c5bfb1e204afb1ef4e3fabf2c4c6e2e5ca42e96a5bf98da925b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
046f803483e1a8e3fcf8e4ca68665387

SHA1
1ae1aad907ed7838b20c4aa13990ec0792405569

SHA256
93ebc22bf6d9504799b5462f30c4db11bb5520f6753f87682db9ccb988875952

SHA512
7aea19f1f58db5c5c0082dbccb8ffe3bf9b3d38e51baf693e30278bfdef025564c2bf3f89be12a6ef88d635811a055dcfdcc8d7695c24f1c478b3bc4ecab3b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d7e75091971692803c8efbd36ec77a24

SHA1
197868306edd7b9fbe29f5c5705e8c0d8764828f

SHA256
ef6206d55f0aac3603f568ea5ce6d803ef55475dcf72ce8902418a0c707b1248

SHA512
aab0e455b6e27b184a7086528a6b34165343540624f061d73c34dd4ab1bba756289bc094a5d5f979edfd1a04ca08a2b7ee5dc3801fba9c379737e63dd27c6f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e3fcb7ca0c5235de9d5206492e5a441a

SHA1
903b77d09ef601c036a4879a22e5c19392b3858b

SHA256
782215a0b8500c611da12b514bcef74c62cd38bfe70f0944cf7ca6178a8ac068

SHA512
b4409ebfe12abcb658236d7976c0226eac20a1a60341b29d345896b8f3efb08a91528211fdd6566319bcf015bd6a5d8ff4403ffb613d62df4d531c1196e30d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4279afd09fb7402c32a11d7f89e4d162

SHA1
8f85e4608018cab4be2bfafaf6b5146d18875332

SHA256
bf150580b4f5aebefa1070184dbe09ac13c319805a98580327a8cc8a48629428

SHA512
dedd9a9dde002c684a903f7239c55ed8f9ffa8e0bba4d1eb016ae5b93c5a8a5922a22d25972e324913fff1b59d60ecd02101cfaa3842be45b502625347045fc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
86ce58ef4f82bd396eb83ce77c3bdf19

SHA1
a9d7efed79135e7c5ccebfa93d70c1fbf9dd92bb

SHA256
c468cb916a7bc7c9ea445cfe399ea3ab31dccf1331aaacc1225303024f4535cd

SHA512
513ac1563b16271ae0ea41696130e5a21fd7e518ad4d4ad1ca7692371e7293eda4e8d3c4425ff0dc1286fc70263e962b2a246768f00503c36c07437a4b4b359d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
401fd40e7734180f214bde1a1d416595

SHA1
bb18aeec306acda3d39c8210bc406224ecbc7151

SHA256
5ecba8f9701ca8ee8dfdafd6d0ac1c7db219dc5622a0cb7aa24ae5015a991f78

SHA512
4dc25a44122a0b1787a7952c40a3a47621e9bb329061aad725f222ecf063bd6953f3993afd31c11ef7951cd6724d286ef3415650f89a2b8fb651b77f079b26a2

Download Submit
C:\Users\Admin\Desktop\Readme.txt

Filesize
980B

MD5
aba62598d44e670d01e6a9cb681566f8

SHA1
1c9b9d5ad56dcebdc263323549d454edd0bc546d

SHA256
d686c4b8270027eeecb35f8b1d309a4a022de063125ccbf6474b09eb2999752a

SHA512
a12856cead95374d574835897281e2db7efb1395a41bb5d58e1735e10d59fdae2813983d027229f3c89c99b1704cbb879c98c5e8259e8cbb911a4bb902e7e7ba

Download Submit
C:\Users\Admin\Desktop\Typia.exe

Filesize
420KB

MD5
91d5ebcc8fb0fc79e7a444522e78f363

SHA1
0be03c0a0ef02ace96cbe75679224bed9ffa3603

SHA256
22b403ae358e179d9a6689c2b971cf68cfc9442aad863012d5c46a4da58e074f

SHA512
d2c9f12471fb2740e6ec1f08b3b797fc9e67ffff1ec79c6a9d0725ac63285a406cd542a125506715d67b7735b0b4140836c393c0d86492268b9fad93318e4c69

Download Submit
C:\Users\Admin\Downloads\Typia_2\Typia.zip

Filesize
303KB

MD5
c6c54d5dcf4c5280961c974f6b6b7788

SHA1
2509dd783817e2e2526b4de5eecad4656317b87e

SHA256
f8787f9aa9c55f401b62b9c622430f8eb10f0ce91bffd26156299a2859a76bb1

SHA512
bfcc8c018fac4639bcffa7f9c3688c591bd47c266fb17bab96066909b0b699c804c78eb75873661a3051a11d55518fe9ced8dfad59c283989a67765fa7b099c8

Download Submit
C:\Users\Admin\Downloads\未確認 529093.crdownload

Filesize
304KB

MD5
a893e31fcfe6c94100fb9cbf59fbac55

SHA1
f4797cd7971b8440f4650c2c6c7b8f4d1dce3ca3

SHA256
d0ad5cfa05ea1bab074d6ea59b137d1b69c8a86d0f6e064f9a884ef0c31e1755

SHA512
aa599ad9ab4938ac4f1c55bdecac01b8325ad83c13a180d0f8c1e7171e2bf5bfa63f75ccdf736b89c4819cc12c53db9bddfe0ffbb8718d161806f488cc6c3e8e

Download Submit
C:\Windows\Typia\main.bat

Filesize
659B

MD5
5eb7cb7418fd9bfd44da6155924339d6

SHA1
88456013a7e64e1440627556e8e064c13fd0ec21

SHA256
92c92dfe6a01ce50739cee43d1aa37d1c2d21ad24c00a258a95ad0e8cd825933

SHA512
1684f2f6da93204687b34c396757a618106326bdaf9c8394ca2a5d91441bfc59b83e963104ef5b0792f0d8b37a425b07214565268b2c70542eacc967c1851e10

Download Submit
C:\Windows\Typia\mbr1.exe

Filesize
150KB

MD5
cbaeaf0434341ccce26fb849befccf17

SHA1
ed687ade1fdedc906eb2f471a29fc40b83715ba1

SHA256
ccf2c81b568fa6dcc0599e01bf3d5144ce80f7937321561f3a9eb260833ce722

SHA512
cf425a10d57875c4057b011657e4e8668e6ce8f9af430de29d4b73985c3418d7930ee5d85ffcfacecd4d3d398f39687480063a62a70ea17fb4b551c6169d7f14

Download Submit
C:\Windows\Typia\typia.bat

Filesize
10KB

MD5
638559150e361e3ae60e9e2ec247696a

SHA1
53367db60a648f613fb259bd030463d2422d66f2

SHA256
801b50366134b3ecfcd436dc95d7479d87e0db4e7fdbbed507448275d25cd636

SHA512
9f3fce2b84440121dd0c4576d9c64cb55b64077e5476e8dd0edc1014085ccff4bc08147f23e121d6c9515a9126bf4357c00bb3ec265d161510b2373c843a1bbb

Download Submit
C:\Windows\Typia\uacdisable.exe

Filesize
199KB

MD5
26cdd7977ae1954bbb4cb74cb1b3b81d

SHA1
a64956edbbc2c5844824e37c608f93f0ead3a5f3

SHA256
d02729d08f56b6d6f245d6bf89f3d4131764148270ab8d863218fda25ba3cb07

SHA512
f5b879974db4bbe02f87078b1450f414300ed353a2452ca56f4c173dd8765057719fee0cdc174b629f8f10581460362f8fbb99a442dea582d5e1e844c2a9c4b9

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads