Analysis
- user interaction
yes - max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 02:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Madium-Bootstrapper.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Madium-Bootstrapper.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target Madium-Bootstrapper.exe
- Size 6.9MB
- Sample260712-clltkaby8j
- SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
- MD5 eb557c8a6c10e7d92e2955fea2ac788b
- SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
- SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
- SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
- TLSH T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Madium-Bootstrapper.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4544 msedgewebview2.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1208 wrote to memory of 4544 1208 Madium-Bootstrapper.exe 87 PID 4544 wrote to memory of 3440 4544 msedgewebview2.exe 88 PID 4544 wrote to memory of 1328 4544 msedgewebview2.exe 90 PID 4544 wrote to memory of 1328 4544 msedgewebview2.exe 90 PID 4544 wrote to memory of 1328 4544 msedgewebview2.exe 90 PID 4544 wrote to memory of 1328 4544 msedgewebview2.exe 90 PID 4544 wrote to memory of 4564 4544 msedgewebview2.exe 91 PID 4544 wrote to memory of 5668 4544 msedgewebview2.exe 92 PID 4544 wrote to memory of 5668 4544 msedgewebview2.exe 92 PID 4544 wrote to memory of 5668 4544 msedgewebview2.exe 92 PID 4544 wrote to memory of 5324 4544 msedgewebview2.exe 93 PID 4544 wrote to memory of 5324 4544 msedgewebview2.exe 93 PID 4544 wrote to memory of 5324 4544 msedgewebview2.exe 93 PID 4544 wrote to memory of 5324 4544 msedgewebview2.exe 93 PID 4544 wrote to memory of 5324 4544 msedgewebview2.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1208.5440.11479038313138898256 /pfhostedapp:12a49d2bea7f1a4a60a78b3cef0c44614f9b54042⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView /prefetch:4 /pfhostedapp:12a49d2bea7f1a4a60a78b3cef0c44614f9b5404 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff897915fd8,0x7ff897915fe4,0x7ff897915ff03⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1872 --field-trial-handle=1876,i,16858857955831001148,18126555072074535531,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:12a49d2bea7f1a4a60a78b3cef0c44614f9b54043⤵PID:1328
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1876,i,16858857955831001148,18126555072074535531,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:12a49d2bea7f1a4a60a78b3cef0c44614f9b54043⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1876,i,16858857955831001148,18126555072074535531,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:12a49d2bea7f1a4a60a78b3cef0c44614f9b54043⤵PID:5668
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1876,i,16858857955831001148,18126555072074535531,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:12a49d2bea7f1a4a60a78b3cef0c44614f9b5404 /prefetch:13⤵PID:5324
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 23eefdad2e7c27981273650d30a57b639831f81a00db3f580f67e6bf8e75659b
- MD5 83cab1521410647790240b2bad6a243a
- SHA1 1987db80cc0b99a31a3137ebe1dc9466bdd16c74
- SHA512 dc5ea8ed169def8477b2972621c6d7b4588cd15a0d94d0a8d81de2d4ea96d5f4eed1f629b867f003659bb88118048c481f014ff9761303a540f5ae1b5e4c5312
- TLSH T179D02B37F2610ABDC410B07202C1F63D1E02B30F20034025942D862C690C0DB0B86CB1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 31a4ebb1985d06167eeda0ebb8e3c4fa49bbfa4d53cce1c6e382197393af74de
- MD5 7a8318c6256c2e6e43bbfd8ad4d0e0ea
- SHA1 d5f0f96016963afc415c49af646819fa73762bcd
- SHA512 cb93cbbcdeca81eb8e592aeb9ac006cac90740146e4702a814a5f5a7ab1ed5eb193580902d18c3e4ed3d80994f4680361798a57b665fe99689069d3c4e54507c
- TLSH T17DD01237369209B4C41070331182760D0C01D20B40064100542D852D2A080541B0B851
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 161acbae08692c88f2ddb6efc5e2c945bb9b712e68d83a89b38cddb2bded5e49
- MD5 e0fd1b5a7dceaea1575f3c785e4f640b
- SHA1 32f9ab8bae4d0855b95cacbda3dd27ac00b0888d
- SHA512 84f5768d59a965a137fa1de16199143ace7d4933f7c71ca5ac5606007b618d26548ef45302f47d4a197524bcf018dfb103849cdde6400e8b26a9358f0e56c2b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Default\Extension Scripts\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Local State
- Size 2KB
- SHA256 654f8ba55af3593e5ed596febdcaecbc2a263d13dc3cfe1390af3db298d75f47
- MD5 47efc2a62a82697b88dfd507f901a057
- SHA1 1b6391ccea20ba7b0783713bf0baa0c50f10d4b9
- SHA512 ebdbef27aacc85175f7535a9061c946bb8eab7f4432cf12816212ab958e8a5b2b62668e6bdab7598be85cf0e5d5c0a6d788a52d76c1cab92d05a68b32c97994c
- TLSH T13951A9736A10A6B79DF25A09B9497F53DEB55065AB532F10A7DE0B0C01CB51C2313C3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Local State
- Size 3KB
- SHA256 652140df5e3a4685620cbee7da8b76df444ddb0f3fd464baf32549fdb7eb2d84
- MD5 ed2276480f8e1ca63906c7dea5c7cfad
- SHA1 39e6fc8e44aeb8cb40578850103659387d111bce
- SHA512 0011980c1e998a220658c99cdc10781921a35b5462bed4b219bae888c3dec5098566334c8b29b924a5bb87e6d741bbf728e3fdfd3785a1746b55a338cbb74ccb
- TLSH T1F771C6776A60A9778DF29A04B9852F06FBE55036E6D23F54D6ED0F0C01C725C2313C26
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Local State
- Size 15KB
- SHA256 1166b251b5d4c0afc63e1a80600139236877e5ddefdb10c3f6edaa044ccbe6b0
- MD5 a995fc67c9e6662b46e6adae49ae68e6
- SHA1 2f2c48f19f85794bb9fc42bbfcd9417402e1f5e7
- SHA512 9f18dec817c1ef5f24ebb0a3452232c0fd2e1f208b317c43f6539593f715631899bcec83fdd38fa554f6a415bf59707bd148ac21fe3e2c2a0f08d8974314aea5
- SSDEEP 384:nsrv+89zHqlDNP9oid93NBSLtjwlW3uNk:srv+4UNbd9G+W3uNk
- TLSH T19672AE33E678A637DDB38509F44A6A077FB8609762C21B60DADA5B4C41CA4D92307E63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{7CDBF579-F7F4-4C67-AC36-E4D8C4978872}\wv2\EBWebView\Local State~RFe5915ef.TMP
- Size 1KB
- SHA256 bf58c8db4294ac8676110d25e7688469ddefbad607de08f69d7ba966ee92aeef
- MD5 50f9d894ea437a0992ac3a37096416d5
- SHA1 449d9748ffd8f40328dd92f871b8ae0d81f7269e
- SHA512 e89701b164c8bddcf8c7228eaa3861f4051010a92dfbe3e77804fb295b9b2ce5ebe9945dab8f61fe3c5afceec60bd5fc173e8150a3ffd495a9f9cd2dd9d6eb60
- TLSH T12331C6F396A05AB2BCF26A0A7601BE8BEFB1107693524E0472DF4B0C01DB00C263BD35
- MD5 SHA1 SHA512 TLSH