Analysis
- user interaction
yes - max time kernel
149s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Madium-Bootstrapper.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Madium-Bootstrapper.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target Madium-Bootstrapper.exe
- Size 6.9MB
- Sample260714-xt6h6aev3z
- SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
- MD5 eb557c8a6c10e7d92e2955fea2ac788b
- SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
- SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
- SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
- TLSH T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Madium-Bootstrapper.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4548 msedgewebview2.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1132 wrote to memory of 4548 1132 Madium-Bootstrapper.exe 87 PID 4548 wrote to memory of 3472 4548 msedgewebview2.exe 88 PID 4548 wrote to memory of 4440 4548 msedgewebview2.exe 90 PID 4548 wrote to memory of 4440 4548 msedgewebview2.exe 90 PID 4548 wrote to memory of 4440 4548 msedgewebview2.exe 90 PID 4548 wrote to memory of 4440 4548 msedgewebview2.exe 90 PID 4548 wrote to memory of 3568 4548 msedgewebview2.exe 91 PID 4548 wrote to memory of 4844 4548 msedgewebview2.exe 92 PID 4548 wrote to memory of 4844 4548 msedgewebview2.exe 92 PID 4548 wrote to memory of 4844 4548 msedgewebview2.exe 92 PID 4548 wrote to memory of 3544 4548 msedgewebview2.exe 93 PID 4548 wrote to memory of 3544 4548 msedgewebview2.exe 93 PID 4548 wrote to memory of 3544 4548 msedgewebview2.exe 93 PID 4548 wrote to memory of 3544 4548 msedgewebview2.exe 93 PID 4548 wrote to memory of 3544 4548 msedgewebview2.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1132.4864.1254972608339435602 /pfhostedapp:122cb098e83a877666005e859e85ed5fbd0e4a822⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView /prefetch:4 /pfhostedapp:122cb098e83a877666005e859e85ed5fbd0e4a82 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffeb9b55fd8,0x7ffeb9b55fe4,0x7ffeb9b55ff03⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1760,i,1206249888904443991,2181783067957208473,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:122cb098e83a877666005e859e85ed5fbd0e4a823⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2076 --field-trial-handle=1760,i,1206249888904443991,2181783067957208473,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:122cb098e83a877666005e859e85ed5fbd0e4a823⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1760,i,1206249888904443991,2181783067957208473,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:122cb098e83a877666005e859e85ed5fbd0e4a823⤵PID:4844
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3512 --field-trial-handle=1760,i,1206249888904443991,2181783067957208473,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:122cb098e83a877666005e859e85ed5fbd0e4a82 /prefetch:13⤵PID:3544
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 f9b530e4d852b85d924425c9c550613dcd067385e95d00e67a2a62f465d9e647
- MD5 43b3d472fbf93fb4d64e5b72e2a507ec
- SHA1 4c7ad61bd95a87af31fdfd969dc633342afb907c
- SHA512 b69f466caf2608c9ce098bf27e5199fd7ea2ff454709c622168de9490e9252e69381f8c3043720e64c20e6c8b505ffe723cc0b989f3ed22b381f7042ae8d4db3
- TLSH T143D02B23F210023EE02070F30142F13B5A01B70F1022806AA42CCB1D69190F74BC18F1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 a03b488a9a98000fd6fb23cdb3237cc11b44da49073489109312186ec19c34fb
- MD5 9e93db356d54552658df2875ff4f43ad
- SHA1 409e1dcb6bd42b13116db8de938469fce5c3ef55
- SHA512 3a7bcf9d9f08fe1bffe487a0daadba7daa58605dd9de8cfd31ff3f2cec5dfef6e01f8e134f9749350cf8033efc8c6d7f8815193ceffefe1721afe984339e8b44
- TLSH T12AD0122232410134D02020B30003710B4400CA1B412580856428CB1E2A140B00B02591
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 5282525ea741f2d7fd6e388635be5025da80eaec6f3eac2bd6b13f72e6dc3afa
- MD5 87b6204c164272034e0f387f87a13e56
- SHA1 0fc37cb50df551649c0ebd3803917bf4845ba72b
- SHA512 41360884a2ca03e4dd4e3110ec34f5773853652ea51e4d76579c6a8caa58f876b599f8c852aa1949d24a4b6e66d0732c78bb0007ce035b4a2a58fdcde2f91ea2
- TLSH T1F3D0043071441011F15150F300115113C1004D50053151D51050C70514510714341350
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Local State
- Size 2KB
- SHA256 c3a51544420b16aef51849158995296534e1dc224db3e52b92505bc7f2b691c4
- MD5 6fa1af566a14c4f8e0df45258457576b
- SHA1 dbd154930fc0f97087306262bc0758cfbff67c93
- SHA512 f96cb834aede5676a6e68a47aab13b110aec5884be135eab5d4f676bf60304a943225933b7f3cf762991897d057d0d7deaf4af3baf92e2073dca757753d27c2f
- TLSH T1B751A6336850AA7B99E34648B98ABF63CE794065AF426F60A7DC0B0C01CFA4C1357C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Local State
- Size 3KB
- SHA256 750c529dcb64448b8f28d6429e609579447fa1b0805233179f57a7c5d3a8d3b7
- MD5 f94280f0d3316e422c9d3b33e7e836e4
- SHA1 bb306e6a3623c9521fbe4a37712ab34c1d44a5f6
- SHA512 256e941bb7cbc459da6ef445a665a3e197e0496a7d342fa362c07212d57388e5269fcf3689608d3b0345a8c4fa63581cac37ca360d722ab11e388f195b0df5c8
- TLSH T1E871993768A0A97B5DE38909B9867B56E7954027EA857FA4D6EC0F0C01CF7881353C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Local State
- Size 15KB
- SHA256 97ead47fb4007ce66a56b73db344133b141f4ab107c42eef2aa622ff84616f2d
- MD5 3fb644c106716c82aa4e56dc7f07a8da
- SHA1 4b99120633438aefb7b37140c9f6f95d3e75d1cc
- SHA512 b5e8794fa9ee6419d8813886ee2e68973cb035b47487b624fd258ecf5f23d25ca1fb859a900fd6491e385f6f132563a46bf62d35dc4c721d1a24060f805a477a
- SSDEEP 384:Wsrv+89zHqlDNP9oid93NBS9CU9JSisdRNj:Brv+4UNbd94nSisrNj
- TLSH T16172AE33A878A6379DF38949F48AEA173B7C509656C28EB0D6985B8D458F4CA2307C43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E2BF6AE-9E65-47EF-948D-CEA1322024BE}\wv2\EBWebView\Local State~RFe58eb94.TMP
- Size 1KB
- SHA256 d8f11f7c8f360fd8eceba14ccb0a5e0bda84cd04325c0eae5a7059abbc4ec10a
- MD5 01b4af169c00216dd242a4b99aefbf11
- SHA1 175d14cf0a748f7f2a426f9986c2609cb6e35592
- SHA512 bb7b5f7176a0b295a0adfbc96c5690781d755a153f56e585fb9c784fef177efc88cd1094937c60aa7df8a819d6e552a523d97ca6a0d03464920b0f801674e564
- TLSH T10F31627394D0AE767CC2024E7282FFD79E64006A97024F9073DD0B0C069F58C952BC32
- MD5 SHA1 SHA512 TLSH