3730e9cba4a93bc985ef7cd2368ccbf5eccd4724f514b38b20e320e5553dd08d

Resubmissions

25/03/2025, 13:12

250325-qfl42aznw9 10

25/03/2025, 13:09

25/03/2025, 13:05

25/03/2025, 13:01

25/03/2025, 12:55

25/03/2025, 12:51

05/02/2025, 11:16

16/07/2024, 08:54

Analysis

max time kernel
114s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
Size

217KB
MD5

406cf11bdb84c3eae3e61f66ea596a46
SHA1

b6acd4fd42b3dca2c2cb75faf48025c2f4880184
SHA256

f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f
SHA512

c34a97b5d2854d862ca165136269302cda613833d83b8c9ec1d72774dd8717b5174a3077b69654435459a94d2d3f1111b9b3973bb3ab35c8826075fca0e126af
SSDEEP

3072:PhXD6M9my8NbPYOBLujYx5I8XDZW0956w/J+UdSZWa/rnV9Yxcqz3:PhT6+mntYOJ9FR60hd/a/rnV9q

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe"	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\imageA0SzjWEYekBjglKxIYQMfLyIJiLrUG.jpg"	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_1575208221\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_1575208221\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_1575208221\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_81368628\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_81368628\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_81368628\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_81368628\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_85605157\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_1575208221\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_1575208221\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_81368628\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_85605157\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4880_85605157\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873819710612211"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{8DA14F6E-9030-4DC4-8BA5-B03F774A04DF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
436	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
436	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 4672	436	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	89
PID 436 wrote to memory of 4672	436	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	89
PID 436 wrote to memory of 4672	436	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	89
PID 436 wrote to memory of 4624	436	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	90
PID 436 wrote to memory of 4624	436	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	90
PID 436 wrote to memory of 4624	436	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	90
PID 4624 wrote to memory of 4880	4624	cmd.exe	92
PID 4624 wrote to memory of 4880	4624	cmd.exe	92
PID 4880 wrote to memory of 1792	4880	msedge.exe	94
PID 4880 wrote to memory of 1792	4880	msedge.exe	94
PID 4880 wrote to memory of 5056	4880	msedge.exe	95
PID 4880 wrote to memory of 5056	4880	msedge.exe	95
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5172	4880	msedge.exe	96
PID 4880 wrote to memory of 5108	4880	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
"C:\Users\Admin\AppData\Local\Temp\f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Read Me First!.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @echo off & echo github: https://t.me/temon_69 & start https://t.me/temon_69
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/temon_69
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2c8,0x2a0,0x7ffd4a85f208,0x7ffd4a85f214,0x7ffd4a85f220
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1856,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2268,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2616,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3532,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5068,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4320,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4796,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5476,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5596,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5596,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:8
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6052,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4800,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:8
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5336,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5644,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5620,i,12282405911439951472,10774190420649264551,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
      4⤵
      PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4880_81368628\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4880_81368628\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4880_81368628\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4880_85605157\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
65044109d1beb8ed8d59560642cbc519

SHA1
0084485b0aa26069232fab51ee603682e8edfd17

SHA256
a1e0b448218678b30356cbbe4092ea091435e7450822a9748361b6e8b198962d

SHA512
96dcc68fe92f98c4329a8335cfffdb0849a52562431045ccc42076bda0abf3842491303fb669246bfd04e64113688d3f90000a09571dd76ff84b52e34e45f9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e62ab920b2561c0977ab331de6b69d2e

SHA1
c78e881a6e10785f1ab1d84b33fb16e2c7b25f09

SHA256
2e5913dbf6b75fd562168599014716994e2ee17246ae41b0d63cb6412fb70875

SHA512
bf2aa5569f95616644759edbe406ce56934cc050a3a255b141a0f00261b3d94b482f5c2ac50bd50e6f4604738e23f97ad7df6d669dc199df390dce77f4bf9ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57baf3.TMP

Filesize
3KB

MD5
3ba781efccf72218178583a200343470

SHA1
d1163ec5a63761f791743ed30fcd3d79ce18eb4b

SHA256
88182a3021c4727d33908a7179736fa97330d23bedd6a270127e7161daa9d2b9

SHA512
4dfabc314563192fb7cf3695c16b1b05bafc5c5f8f2dd006694213bf78bf7c57edf00ea1138fe2e221a7093c9007a69f2808074cfdf3589dcdb66117d009095c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
583578cffbbb46b4aab41b0932693e9a

SHA1
f523e377bf8af8f0dae1425ff1b267ff0506252f

SHA256
45845cbbea3bf6ef9cae025bb8fa7930743e03299cb149210837b3ee23d143e3

SHA512
b0c4ad349149bf3a19f4fcd19e18668e11c15d0bc02411d25db13b132d7f4470f02f0a3aa2d4a1bcff6efb2345a07d1e3510fe688b43cb64bf5a50baa864a3f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
be7f0bf2122dad46653f66653e1cd0c2

SHA1
e28c32499d8ba006e83516108fb35f0a3ef7e761

SHA256
ff77b1332a6dd4c5a7dfc6d5e0f49cdd1718d1fb9cc5b477e28386057ab05ef9

SHA512
9238b10761ba11db99559355f9e6fe3319205d1dd43ca49372769d0aa29b79b738e46be123e5b0b9af34f2ac7e88fcb51d53748bc1df0a12b690c4cdb18c6500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
796bf9648f6fd6700e8b26ab61aee3ff

SHA1
cfd48917eca13cc2edd157ba5f3b2afc0b0f73d8

SHA256
fc761053298a4b888af11af6a952d66bac26ae00d89b2526381f0f7785a2f73b

SHA512
4e41c0a3dd78efca66d9ff3eb5193dde1a8623c4e8443477873d81df576ebde49cd63b79c04c7e6cde99eecc7f293f6ace7c6a4187618e2b3566676d3b5c67d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
965533d87554c169814c0b036a401ab1

SHA1
b6c9fbf82bf3d6540197d438d63002e195d391e6

SHA256
5296c6320a5cce400e96eeb2198310f49c6c0538d9c01d0844d770d63369b980

SHA512
e79519f1e6a49c128cd336763fa82ef9e7b3b747f1f9f26d2394fe78d50e327e0b5666e4a79f542a792d38bef71008e13c7a8e4504b5cf298b1f199aca6f4e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
bf991c25bfd1767ee85d9dc34c90352d

SHA1
d1dfde6a2cb641add0cc1bc83419b0706972a7b5

SHA256
327bb93d08e278c8b7361dc82ac5c2606b8ec6e404b396da43afa911a2fb4959

SHA512
e9c1b8d992aed09987fa7e9446f856d283f2f5168901f906ef83d861b03f1d390f0d58a278b5416a9391ac4a31acce503f0a9a78fe47f38882c11f8892a645f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
68e820b8d1bb168d255343227d7853ff

SHA1
dece8f54eae7d8d8bb0d5ff6dcfbf04997b55dc7

SHA256
e53780af32d455875c4ce5949a2f452f1d229f0117a3bfdce584393b7fcd6804

SHA512
95719cfbff06c637b69ea67aedf825fb7dc75779a8e9b35ea0788d563f10fdb660c9d82d7848af6f463a4d3acf954367ab63553880989d6b5d763e3d0d992de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
a79a71d1ee75e474bfecc6465f13f906

SHA1
fb610254d11d93095fb59b09166810a15cfa56ca

SHA256
c4278d5259dca5d6077d07584888b3ccd328a6543f06dff9dc6146efe6f55944

SHA512
81e700b1f377fbfee11785d986cd01615e3cca3efb0a501161deb9c76e783749594767bccdb784ad6169078fbdff0a807c3d43ee355f8e295b4a38acfa00dbc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
41f23d2be416be59ad0410beb02aae58

SHA1
b8a7dc690de314b39af001c1fdc139e4dc2d06bb

SHA256
b0a8ecdb22e6e07b00ae129be60bc7d7da6d4ee97e090e134e6a18b79353f9d8

SHA512
b26549cd398bb9ba695357fb6a2fbf920e5f8e7b741aefe19ca9799ef0b1cd1a3456d388a68b7236ced67d104aa0e1030d028643eb1de2fb83c3dbcb554b5a8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
0ecefd01ff506020227770558e34e0e4

SHA1
1b0c8b80c919e142aa379ee66e879c0b19da60e8

SHA256
35d8f334ec1a57d8ed1fd3a529557a98a80bb066be6b351a6d6b1d341661a6a1

SHA512
aa3835fb1a5edf4cb69c05c50e06904c454200e7f764b863724cae04c3a1bb29ae23d229e19dc0fc8ec22285f95953a64ce266d144dd772a16edfbd98ab3e43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
6470719111d31f2e46e023d2fd2e51b3

SHA1
355f3236651a5b64499b83fa5c7f6fbb3b27131e

SHA256
e0d935681d5767e34ffe90d19cc7c0328745cb2c2f8a73742f4a67e0699cac9b

SHA512
708413c3c86d7475a9ce2ef9702881ea4e60a18710f6f2daacf6cb3e25adb246864d0c8ec017cc7ba6f95d493e3204493a54504af2213e17729776f2c95bc21e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
9a7a1a92ef64076cbfe0c5e9d9f48067

SHA1
8f51660c8bd0fe3cce9ce25b8c52374e25d7c80f

SHA256
927f351d304df713a5feb74be368e14d1af44c629afd71e2168072476a40b938

SHA512
d38f03a73e2b8a2f1e1d00c7e7d2e37ab93ea210b5a0864154aa02e55ec6559777de8cce7b7df634ed8ae3c2c184526db2e003e021cdf7f5a127641cd835082d

Download Submit
C:\Users\Admin\AppData\Roaming\Read Me First!.txt

Filesize
99B

MD5
1a17a3c217bc5f504586af0ec4caee22

SHA1
dfb396fb5cc735411bed8e75832315f796acc024

SHA256
db6180dca4a18393ff9ffdf9d1e9f1d0ace1fdae44b4f4ba712164ab63cebe24

SHA512
627ca1d41bddbf2f5885e431536217e711b75c17cdaa1265d257a71e370e4f3adbbce92d47a28df956e05fb6967e1d2f08b39115527a0a1a303d651d70f595e5

Download Submit
memory/436-0-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/436-17-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/436-5-0x00000000055B0000-0x00000000055BA000-memory.dmp

Filesize
40KB

Download
memory/436-4-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/436-3-0x0000000005350000-0x00000000053E2000-memory.dmp

Filesize
584KB

Download
memory/436-2-0x0000000005820000-0x0000000005DC4000-memory.dmp

Filesize
5.6MB

Download
memory/436-1-0x0000000000940000-0x000000000097C000-memory.dmp

Filesize
240KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads