3730e9cba4a93bc985ef7cd2368ccbf5eccd4724f514b38b20e320e5553dd08d

Resubmissions

25/03/2025, 13:12

250325-qfl42aznw9 10

25/03/2025, 13:09

25/03/2025, 13:05

25/03/2025, 13:01

25/03/2025, 12:55

25/03/2025, 12:51

05/02/2025, 11:16

16/07/2024, 08:54

Analysis

max time kernel
115s
max time network
117s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
25/03/2025, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
Size

217KB
MD5

406cf11bdb84c3eae3e61f66ea596a46
SHA1

b6acd4fd42b3dca2c2cb75faf48025c2f4880184
SHA256

f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f
SHA512

c34a97b5d2854d862ca165136269302cda613833d83b8c9ec1d72774dd8717b5174a3077b69654435459a94d2d3f1111b9b3973bb3ab35c8826075fca0e126af
SSDEEP

3072:PhXD6M9my8NbPYOBLujYx5I8XDZW0956w/J+UdSZWa/rnV9Yxcqz3:PhT6+mntYOJ9FR60hd/a/rnV9q

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe"	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\imageduIDzzvTVuwcZnTaBQtdgzBCaFOIxa.jpg"	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2029327614\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2029327614\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2029327614\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2095074291\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2095074291\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2095074291\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_184147626\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2029327614\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2029327614\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2095074291\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2095074291\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_184147626\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_184147626\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873819745207466"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-780313508-644878201-565826771-1000\{323B128A-0714-462E-AB32-0E0DA9DB04E4}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1600	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
5972	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1600	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3036	1600	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	83
PID 1600 wrote to memory of 3036	1600	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	83
PID 1600 wrote to memory of 3036	1600	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	83
PID 1600 wrote to memory of 3724	1600	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	84
PID 1600 wrote to memory of 3724	1600	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	84
PID 1600 wrote to memory of 3724	1600	f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe	84
PID 3724 wrote to memory of 5972	3724	cmd.exe	86
PID 3724 wrote to memory of 5972	3724	cmd.exe	86
PID 5972 wrote to memory of 1308	5972	msedge.exe	88
PID 5972 wrote to memory of 1308	5972	msedge.exe	88
PID 5972 wrote to memory of 4536	5972	msedge.exe	91
PID 5972 wrote to memory of 4536	5972	msedge.exe	91
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 2376	5972	msedge.exe	92
PID 5972 wrote to memory of 5908	5972	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe
"C:\Users\Admin\AppData\Local\Temp\f354148b5f0eab5af22e8152438468ae8976db84c65415d3f4a469b35e31710f.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Read Me First!.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @echo off & echo github: https://t.me/temon_69 & start https://t.me/temon_69
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/temon_69
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x338,0x7ffed411f208,0x7ffed411f214,0x7ffed411f220
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1900,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:3
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3836,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:2
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2400,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3088,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3092,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3468,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4952,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4944,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5368,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:8
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5996,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6052,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=744,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4520,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5260,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5308,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,5436304835634073511,1186318150539343160,262144 --variations-seed-version --mojo-platform-channel-handle=892 /prefetch:8
      4⤵
      PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
aa9afd16e8041e8c80250b50ea6899e4

SHA1
a3a698d431952253255c343f2b35f74e73e63088

SHA256
2bd7f856d73f78bc3a4de32b447b21babad42c009b19fcebe2f8cdeca2380926

SHA512
344de0888df8851d957ca6fab055eb9e2f1aa6d958022c2c30442cd6aad4d158d0a99f8908184abc60fb1e0ccdd3d9395d8c0d37fc317d3700974c3348d4a5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cb6bb44324edbe4437443b7a382cb77a

SHA1
c9540384f69be9bde71b054e4b5f0666c779171d

SHA256
6f4c9f9f481b9ed2115ad77fd63bcf0a6d1f115ea1a3ee293449833bcfe731c7

SHA512
29b1003734e68cd1aad0e9a95468772d613d133ac9d3be3743f59f0c657ff0bb26d9edb1c65d1727cfaeab4a700c796f4d869901a60f78723af2665dc67d878b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57b556.TMP

Filesize
3KB

MD5
12658d9bb9afc64fc4e48f9c5e0e71d2

SHA1
138bf092cd951a995bb0a6203e7de5c6abb05267

SHA256
bfb5476b47de357592c36f66e96baafd1c3ef83a3c838224a0a56e6616a32535

SHA512
f78651f0c59446806e0cf7a4b24d40b6a7df1ee6a3e7c9b0bec2704d9b224c509cf07560b5ac9c880068f7987cd13086efd0c6dd2675cee4e73b1b504d9cb944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
8cba55a72f8275d4540c53e648cf9b0b

SHA1
c5f5a2a98be3a9bae71a35922e75ae19530e3f22

SHA256
e366c262e1df5ac24730745409563bb8dc214a0145afba4e7129ee0e04608753

SHA512
4e1562d5fec9c8cb4902c1e4432710f90ca720799629a9b85c49a93c5ef550f74f63168680634d2d8a277a0f3ba87a93acf500950020e62cc89ed5310206db36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
cad3564e8bd5bf70a4eb0c6b10f2b0dd

SHA1
d40d30b6e3f9b6dec5ef587c2148f515229d11d0

SHA256
6670bbd761e73df81516986dc4b27691d8361a94e5ad312254e70c3e239a7c7e

SHA512
0e4f5bedb9c7dd601c82b304390937e6d09bbe87ae2acd45fe583c225ef34924b9501e6ae7ccf6039dc2e39816bb711117fc63fbfdf74f82a171639cd9ecfe25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
01ad935170ca796018e73c4df368fc28

SHA1
d93071a18eda99bfaac6d892bdd085849d6f95fa

SHA256
5351d331260ec46d87aba849bc0d26812c8c47487d65569c6193a58f21c94d89

SHA512
642c31bda4a67b1501473be68641644b35fe0a0b0aa4a50b37347f5a8c07b845c7c352ec52e977ce9f5838a4f3feca0afa50cb6ba868337f43e57a5df87760b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
3013c57c925b463978070066711dbb76

SHA1
9343268eb7971f177d7f55c4d19fe0f7c44a7d8c

SHA256
1be91bff94becc150df3c5f359389bc6aad99f013e06d0aa2a5ffce1850c09f5

SHA512
194e589d31cc3d4a6110d3314d85826b63dcf3900d277b31cb20e95a8f3bde09d362c1e7e0233ee07f63e4808399c3f5997319383f4ce3de0e4be30ef6ff940e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
e457146de107ce757349d55c1699d451

SHA1
408f9e465190d8eda82e3e649252e4d030cff8cf

SHA256
9be098071ea7ae0b09a363b220b313457cb0362ca2e4abdcdb900a9033cf880d

SHA512
d03a123daf64d69604785e2e49aec11c29ae865bfab628e4c01b3ec4b0bf6cd8c72c44732e30f78316c717bc3251d9770cb9efba4e038c9dbdc3052665ccdcb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
e69d1524b056067767a4015d9889195f

SHA1
efcee884501fedc376d62d0a7770be7eac674b40

SHA256
591b5d05cd0663ed69b925add8e67c72818c9e17e411c72093f2b1d409e6b503

SHA512
90b0da415ec3d899b1d9fd59013cd551b2b51ca8239306f44c8e984087c590edd34dd3bac6da79a636bf4c4b30f496de22165e21977de72f2984ef3adb9c476d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
f3214bd1b88d7362048971483e63d267

SHA1
ba7dbae254ea7146f5344494a9b9d189da7ab098

SHA256
60ffb0f6a3d3c0514161b218657b335e19206a14a424a9f14ee9eb850e42d9ea

SHA512
c5cfe8603fb798de51e0c3df1636735837159f9e46c1ce34516649441b626d84d673ce38b84b9b5160959f4a5425793ee1ad7808b51196f58c483f50c1093049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
ee66dd3e89b59c5e801c229f300b5eb2

SHA1
aa83998063f8ec7e5a8ed2bf425672e5c074dbe1

SHA256
49ffb1c95fc78a61d4027fba3375309a16b534dcde3a9c5eff4a49faaa567af0

SHA512
7339bcdf32574c25d16b9190fc35de2ce8575258913bbd5cc3ea20df749cf5e6ac93ae42f6fc035958e14455041fbb540f233221e8185ba3cf54e2d353ebe8cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
0ecf0567b7a96915bc3951ae1b721166

SHA1
ee0a5139f0fb0505ed32afc74488cfd010af1e47

SHA256
28de09f217470b2a91e47efb09ef294549650f0c3577116da7353e4394d69487

SHA512
a3bd67e82ae17f2e52beedd802523042fe09e000708e01801ee3d3583ae7dc57865fa3f9452094f927c28788660c686f96a0d05e920ddde5f8c072278d1bd163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
3341a5874036ad1a1ac2309f47a6445b

SHA1
140f257a3d1f5d5dd5f4aa172faee4de0d912296

SHA256
63ecd02e9673608f5c17503fe5f73973777ac32386f49009685c866fd3dd04ee

SHA512
d26bac02f7db734a4e069f3f82579c79688da0e18b79e455cad58aa9ca67eb48aa97ad60de2619f9745a90ba737ace184c1ada72eadbe97b7bf6f46a7b286d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
e9449ca7cf3ee90e1786996cf06401a1

SHA1
57efca6af690d9d0311689b0de4e34c643d21594

SHA256
548e2f0bfe1c80137ab523b9111f8a3b4c502198fb3521e137614a452ea589b1

SHA512
deb18faefb1d4bc89228f126ffb06b2a02584993e102f37c2fcaccf2f743d4129703af2232c249e214fab1131f81b97742c21bcaa002bb6493ea801b1d2ae50e

Download Submit
C:\Users\Admin\AppData\Roaming\Read Me First!.txt

Filesize
99B

MD5
1a17a3c217bc5f504586af0ec4caee22

SHA1
dfb396fb5cc735411bed8e75832315f796acc024

SHA256
db6180dca4a18393ff9ffdf9d1e9f1d0ace1fdae44b4f4ba712164ab63cebe24

SHA512
627ca1d41bddbf2f5885e431536217e711b75c17cdaa1265d257a71e370e4f3adbbce92d47a28df956e05fb6967e1d2f08b39115527a0a1a303d651d70f595e5

Download Submit
memory/1600-3-0x00000000058A0000-0x0000000005932000-memory.dmp

Filesize
584KB

Download
memory/1600-1-0x0000000000EA0000-0x0000000000EDC000-memory.dmp

Filesize
240KB

Download
memory/1600-2-0x0000000005D40000-0x00000000062E6000-memory.dmp

Filesize
5.6MB

Download
memory/1600-5-0x0000000005D00000-0x0000000005D0A000-memory.dmp

Filesize
40KB

Download
memory/1600-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Filesize
4KB

Download
memory/1600-4-0x0000000074BF0000-0x00000000753A1000-memory.dmp

Filesize
7.7MB

Download
memory/1600-17-0x0000000074BF0000-0x00000000753A1000-memory.dmp

Filesize
7.7MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads