Overview

overview

10

Static

static

10

Bloody Kmax.exe

windows7-x64

10

Bloody Kmax.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    284s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-02-2025 23:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bloody Kmax.exe

  • Size

    7.4MB

  • MD5

    cde22b810942c0c6eef2e844a2fe8eae

  • SHA1

    633ec7f9defbda8c7045f69e0a5ac1654068def6

  • SHA256

    c773c6821f2962c2c89e482ead7edc03768a9c9835cdd264c3c2189f2c8dbd40

  • SHA512

    e666fd809335888e4cf725e45f10fc7353dd3801a703f39353985b7ef35c6de1915abb22a54b4b1608fee86dd1c1c7b6c7b0b9d5215910164e1fb2469c32e58a

  • SSDEEP

    24576:aaL3vVD8Lpq5u+B0cAUmhInhvctethPLqrzHBCBoNyUr4epjVGXWkY6V5vovNYiw:L9gvS3thO/EabZkY6LVm6fiMhZnLDUR

Score
10/10
chaosadwarediscoveryevasionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\read_it.txt

Family

chaos

Ransom Note
----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: KmaXx Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Chaos family
    chaos
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 34 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bloody Kmax.exe
    "C:\Users\Admin\AppData\Local\Temp\Bloody Kmax.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2300
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3292
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:940
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTM0ODUyMTQtMUUzNi00RTkyLUI1ODQtQTUyMjcxNTRGQzhCfSIgdXNlcmlkPSJ7Q0ZERDcyMjItMENDRi00RURDLTg5RTAtM0FBRkEzMTM5QzFEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzMyNzBEREEtRkZEMi00RjFGLUFBQzYtNERDMzNBRkM1MTgxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjE3MTI2NjEwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3264
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3088
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2564
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\MicrosoftEdge_X64_133.0.3065.59.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3872
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0xc8,0xd4,0xd0,0x238,0xdc,0x7ff7b6de6a68,0x7ff7b6de6a74,0x7ff7b6de6a80
        3⤵
        • Executes dropped EXE
        PID:3708
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4180
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7b6de6a68,0x7ff7b6de6a74,0x7ff7b6de6a80
          4⤵
          • Executes dropped EXE
          PID:3540
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff786d56a68,0x7ff786d56a74,0x7ff786d56a80
          4⤵
          • Executes dropped EXE
          PID:3644
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4672
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff786d56a68,0x7ff786d56a74,0x7ff786d56a80
          4⤵
          • Executes dropped EXE
          PID:2600
      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1232
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff786d56a68,0x7ff786d56a74,0x7ff786d56a80
          4⤵
          • Executes dropped EXE
          PID:4840
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
    1⤵
      PID:1376
    • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
      "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:228
    • C:\Windows\system32\wwahost.exe
      "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4176
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F340B872-86E0-49C2-9E98-077E1643E38D}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F340B872-86E0-49C2-9E98-077E1643E38D}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
      1⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:3656
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F340B872-86E0-49C2-9E98-077E1643E38D}\EDGEMITMP_40592.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F340B872-86E0-49C2-9E98-077E1643E38D}\EDGEMITMP_40592.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F340B872-86E0-49C2-9E98-077E1643E38D}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe" --previous-version="132.0.2957.140" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4896
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F340B872-86E0-49C2-9E98-077E1643E38D}\EDGEMITMP_40592.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F340B872-86E0-49C2-9E98-077E1643E38D}\EDGEMITMP_40592.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F340B872-86E0-49C2-9E98-077E1643E38D}\EDGEMITMP_40592.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff602286a68,0x7ff602286a74,0x7ff602286a80
          3⤵
          • Executes dropped EXE
          PID:1060

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Browser Extensions

    1
    T1176

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Active Setup

    1
    T1547.014

    Event Triggered Execution

    1
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Defense Evasion

    Modify Registry

    5
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Defacement

    1
    T1491

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Installer\msedge_7z.data
      Filesize

      3KB

      MD5

      a43e9ce8d33ed6eb2b8f5133450d64dd

      SHA1

      f2b9a2eab4b80d7bef0a6e076423993b77f66332

      SHA256

      39bace95aa685a42bb379404c0e4f2a11254a7d5ab9a9b5551d311d1dbc05bb6

      SHA512

      9db1c9de9521cd7bd4af5062693d3557ab196fd552bb6000c1d4266426127c9c7c6eada263e90f99bf941fb1c863d10463940e164a03e0742ee070a35fbcdf6e

      Download Submit

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E5512A5-9F26-415E-8DD7-A35EE39C3DB7}\EDGEMITMP_6F9F3.tmp\setup.exe
      Filesize

      6.8MB

      MD5

      1b3e9c59f9c7a134ec630ada1eb76a39

      SHA1

      a7e831d392e99f3d37847dcc561dd2e017065439

      SHA256

      ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

      SHA512

      c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

      Download Submit

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F340B872-86E0-49C2-9E98-077E1643E38D}\EDGEMITMP_40592.tmp\SETUP.EX_
      Filesize

      2.7MB

      MD5

      1a59a8af3c58b30ff0fe71db2196b24b

      SHA1

      6b0e5ba36f4fc5328ec494272054a50cafa13e68

      SHA256

      ba25974b29a25cb7bc1f58a0990a8ce758354aa6ec5b8b8af210f2c1466ba49d

      SHA512

      f173fe15db8d7aeef4f6fa62a41246550ccee207e6388095a5f87036362d4c95da646e1a7c68764054556e024da80b749646425076e9bfac42fb77be8f2c0355

      Download Submit

    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      Filesize

      3.9MB

      MD5

      ad5f7dc7ca3e67dce70c0a89c04519e0

      SHA1

      a10b03234627ca8f3f8034cd5637cda1b8246d83

      SHA256

      663fe0f4e090583e6aa5204b9a80b7a76f677259066e56a7345aebc6bc3e7d31

      SHA512

      ad5490e9865caa454c47ec2e96364b9c566b553e64801da60c295acd570017747be1aff6f22ca6c20c6eee6f6d05a058af72569fd6e656f66e48010978c7fd51

      Download Submit

    • C:\Program Files\msedge_installer.log
      Filesize

      73KB

      MD5

      88c4cdc7e59e4e69f0deaef4057c10fc

      SHA1

      6e8ce32373f0bcb4aae3fb7e5d56d18457454d27

      SHA256

      326ea3abc653ebf4aa88590a925acbd103dd3c53266f5f5a8d21d241ee8a2a98

      SHA512

      9eeb7d4d685d0d226643a614d9d9c97db0a4532716c16b084f2d99252ec044127212acf918c53094c81e0a29ce7c866d4d77ab9df310728d891810740ba464c4

      Download Submit

    • C:\Program Files\msedge_installer.log
      Filesize

      102KB

      MD5

      41a80feede33322410c553c864bee6e7

      SHA1

      d70143db6ce80cd7e20d903c9aa53ad80ca62fac

      SHA256

      0e5e6e9155046310e2849baafefdcdd89bd58ce7311ba0ce851633907c8de745

      SHA512

      bba0fb34ed43c194b88b7e14af3052c154c58932e68c23ff9e9de4bc9773e0a8683de1360a994bb0b4bc93469f82af5b70913106ad7be9530299e0c6d6bbd424

      Download Submit

    • C:\Program Files\msedge_installer.log
      Filesize

      103KB

      MD5

      4bc982fca3748ae51575d134b4d0b639

      SHA1

      09968fc994b7a0379d6372e9eee7348563cfcbdd

      SHA256

      785b3594c7340271b291ab529c0ed14ddafc983fe57668c514f710038e244a5c

      SHA512

      0b357abc20d7777c99d09d5142ff1d70727549cb7893c83d0cf1b221575c2ea0b1941d1b9ab69795723e57c28e5497dfe2908c1002152490aa2ecaef5571a84b

      Download Submit

    • C:\Program Files\msedge_installer.log
      Filesize

      108KB

      MD5

      465fdd69111b1f12f4740a7e98484912

      SHA1

      5a9533f75bdb480715ca8fbcca5645b375b17a29

      SHA256

      13eb677e7a5c3a9a8de0c309da62c3097260a40d11da10fd8fe38fc524b73b1b

      SHA512

      afbcdc6c09a46ee07a694da2b08067437e2cca38b200e873cfe1965c6d71b20ba60cee39327a63ce9955ae2ddf082efd88b5b39b63818e4522656654c45ee07f

      Download Submit

    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      7.4MB

      MD5

      cde22b810942c0c6eef2e844a2fe8eae

      SHA1

      633ec7f9defbda8c7045f69e0a5ac1654068def6

      SHA256

      c773c6821f2962c2c89e482ead7edc03768a9c9835cdd264c3c2189f2c8dbd40

      SHA512

      e666fd809335888e4cf725e45f10fc7353dd3801a703f39353985b7ef35c6de1915abb22a54b4b1608fee86dd1c1c7b6c7b0b9d5215910164e1fb2469c32e58a

      Download Submit

    • C:\Users\Admin\Documents\read_it.txt
      Filesize

      956B

      MD5

      21501b5bf2cbccf8dea4c2f064afb233

      SHA1

      ea75a95c8c1fbd35e05a8fc63e892801aa8ceaf9

      SHA256

      ef1d252cb05fa5030012511212d472855067477a6930e33ab034064de5c23b2e

      SHA512

      f0b0352bc047bd0b31a0bc188fff1ee9e039c0cf05f69d8cf252ab0036b343f9fc02e99ef42d72e6577e5a571e8544bc945c9ad16033b6da0c77418040f92520

      Download Submit

    • memory/228-549-0x000001AD06000000-0x000001AD0600E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/228-550-0x000001AD20510000-0x000001AD2051A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/228-551-0x000001AD20540000-0x000001AD20548000-memory.dmp

      Filesize

      32KB

      Download

    • memory/228-552-0x000001AD20800000-0x000001AD20A49000-memory.dmp

      Filesize

      2.3MB

      Download

    • memory/764-477-0x00007FFDC8400000-0x00007FFDC8EC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/764-15-0x00007FFDC8400000-0x00007FFDC8EC1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3284-0-0x00007FFDC8403000-0x00007FFDC8405000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3284-2-0x00007FFDC8403000-0x00007FFDC8405000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3284-1-0x00000000001B0000-0x0000000000918000-memory.dmp

      Filesize

      7.4MB

      Download