Resubmissions
17/07/2026, 12:26
260717-pmd7bsa16q617/07/2026, 12:26
260717-pmdkssez9x17/07/2026, 12:23
260717-pkxwnaaz2q6Analysis
- max time kernel
149s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 12:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Madium-Bootstrapper.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Madium-Bootstrapper.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
General
- Target Madium-Bootstrapper.exe
- Size 6.9MB
- Sample260717-pmd7bsa16q
- SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
- MD5 eb557c8a6c10e7d92e2955fea2ac788b
- SHA1 430df41170fe3e209f44f2dfa5c37f40f6edb101
- SHA512 c4f5a533f8e58c29082864b44bf94c51a7619c4cef87f07639c6d6a4f04aa5c17dd587004db69572d7ef87b34bfb62ab25a538c48de1c638220beab47a3a7024
- SSDEEP 98304:zKvnZ1DquE2Dk4GjV+AiO+vf04MQwySjcTc:G/bquE2Dk4GjVjFoPwlj
- TLSH T12776BF69A6BC00E9E466C1BCC2875223EB72B51517B157CF5A248AF60F63AD02F7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Madium-Bootstrapper.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4028 msedgewebview2.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1480 wrote to memory of 4028 1480 Madium-Bootstrapper.exe 89 PID 4028 wrote to memory of 4836 4028 msedgewebview2.exe 90 PID 4028 wrote to memory of 4792 4028 msedgewebview2.exe 92 PID 4028 wrote to memory of 4792 4028 msedgewebview2.exe 92 PID 4028 wrote to memory of 4792 4028 msedgewebview2.exe 92 PID 4028 wrote to memory of 4792 4028 msedgewebview2.exe 92 PID 4028 wrote to memory of 4232 4028 msedgewebview2.exe 93 PID 4028 wrote to memory of 1516 4028 msedgewebview2.exe 94 PID 4028 wrote to memory of 1516 4028 msedgewebview2.exe 94 PID 4028 wrote to memory of 1516 4028 msedgewebview2.exe 94 PID 4028 wrote to memory of 3640 4028 msedgewebview2.exe 95 PID 4028 wrote to memory of 3640 4028 msedgewebview2.exe 95 PID 4028 wrote to memory of 3640 4028 msedgewebview2.exe 95 PID 4028 wrote to memory of 3640 4028 msedgewebview2.exe 95 PID 4028 wrote to memory of 3640 4028 msedgewebview2.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1480.3508.4782410416714651200 /pfhostedapp:ba21bce7ced9b4180c80540a5c165899be2365e92⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView /prefetch:4 /pfhostedapp:ba21bce7ced9b4180c80540a5c165899be2365e9 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8495a5fd8,0x7ff8495a5fe4,0x7ff8495a5ff03⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1800,i,9492664701237070527,7600282518548773094,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:ba21bce7ced9b4180c80540a5c165899be2365e93⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1800,i,9492664701237070527,7600282518548773094,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:ba21bce7ced9b4180c80540a5c165899be2365e93⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1800,i,9492664701237070527,7600282518548773094,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:ba21bce7ced9b4180c80540a5c165899be2365e93⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1800,i,9492664701237070527,7600282518548773094,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:ba21bce7ced9b4180c80540a5c165899be2365e9 /prefetch:13⤵PID:3640
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 0457513963f9b2042e7a3df0b2cd4d61aceb9519c1dbea6d0c575a520cdbb08b
- MD5 31ee9a086269e6dec4ba5d060fd55a4b
- SHA1 7a1fa77602a7827657577a8be08379be6f0b8f90
- SHA512 892600c9dace0c45425d171684bb525619ef15cc28e3286af40b9997aa39a76cbdfea3ed1ad4ddf853ccf6ac83e34e9b396856c0296677a0974b01ebf6aee307
- TLSH T1BAD02B17F320873EF02030730251F52A1E01F21F51468019942C9F1C5D0C0DB0B81CA5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 ade5bc002c7f33a889509f8f9036951cfc0eea8af69f4579a8ac9dd83b20056f
- MD5 d43845cd37ee856ed4c63f48dd58b3a7
- SHA1 4aa563e1f2fa22601d23ec875fec06c4b4a5de25
- SHA512 12edc449f8953bba4b0c795a9e539dadb10c003827af34d1ded81a139c724d96a31980c3f7c0458f8deca0e0f4a627e1692f19641b51c9cb1a1611d982f01587
- TLSH T1CBD0121633118634E02021370512750A0840D12B824980045428AF1D1E080541906845
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 a70c753f0aa6360a5cf7333be8dc73c7f58726f5182a46fef2627261766b48e9
- MD5 9c3162e931a8c8d20229351c56bf57af
- SHA1 f1a368f1e2a3416195647fcf8c305e045c8c7aea
- SHA512 46c5ce9232aa93f295173a9a82f837caa58bdfb82f2405fd376a65cd193c9694534acf67fa042addb681c91b1650a2e3f19551151f499bb35ecf98232890e904
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Local State
- Size 2KB
- SHA256 fdfbd4cd409acb465b2ba75e925a546895d833b041eb014db80a83d81698581b
- MD5 529d738f0d365f3941777356df034f36
- SHA1 2d7682312175ea814c7baeb288444945740f50ad
- SHA512 c36c210ae3a4907578d573e2f6ff45e40dd2909434453fccca60b3061b356e0c41da448629a591b01cbdadc2fcdab9b1d79658ae154a6b0bca33f0a3cb2d93d1
- TLSH T1F551963369147B36A9E396097D8A7F63AF7580AAAA522F51AADC070C01C750C1717C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Local State
- Size 3KB
- SHA256 ab79259e623928bd686f027de0da751f16ee51fee21ed88abd093f1387ff1daa
- MD5 e1a514107e83033cb1465ce20f1055bb
- SHA1 794cd122065baa7af0bbb47f25641f0005b38e70
- SHA512 c7c3e34618611d6ae51812939a647c91b9bf8a25cfd064b0d925b45d00e90bdaf8e3eef4b2d54993fc602d04e81368cdb7e327a68aa8eba51e9a7639b77e2151
- TLSH T1BC7164376A64AA375DE3D505BC862F57BBA5403BA5857FA5DAEC0F0C01C72481353C13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Local State
- Size 15KB
- SHA256 1be3e856d4e65c2423f675b7085ddfb3c75d5d111080bfad8cc0f86aed1b5edd
- MD5 f20fcb6b2f645ff9c1e6b5441f9d898e
- SHA1 8179b58570af8eea90ba62cbd86c7a20f3200414
- SHA512 fdaf9e786f940a7789b97d0749301b38f2632b13c27e0242777a73c34571fa80b7dbd417e098a59f28e8f1a14f47eb124d2d270a5b655a715ee3f3dbb938d1b4
- SSDEEP 384:csrv+89zHqlDNP9oid93NBScKSiZTsOi5pN/:Hrv+4UNbd9J/0C5pN/
- TLSH T1C772AE33A53CB637ADF3D505B886AE073FB8509B56C20BA0E9991B8D05DE0C92317D53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{3E92A6CB-BAA0-47A4-BBB3-D17560979DC2}\wv2\EBWebView\Local State~RFe592409.TMP
- Size 1KB
- SHA256 ccca8872989e33e16cac13da8dc7b10a2f762ba17a5441f5aa929c2e90a115f1
- MD5 a57981056b8434036599c0387635b039
- SHA1 d0e69c89ad0be9e1ec873f6b55e7e915cfa42584
- SHA512 e4156999960ef61ddabf9374d86afc7814af09558b61fac1f23879fbe92b2c8789545cc522ca51c67ddc7552190696c2c228ead0bf5f5286f9aad715312a2978
- TLSH T178316073D6946B72BD87A14A7556BED76FA080BE92414F00BADD470C26DA00C9A3F832
- MD5 SHA1 SHA512 TLSH