b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vat.N0.20260804142245.exe
Size 3.5MB
Sample260804-pdk9aaag66
SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
MD5 c185dbe4fcb5da174009ada3aa4822c3
SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
TLSH
T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\O:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\R:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\Z:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\G:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\H:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\I:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\K:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\M:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\T:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\W:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\B:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\D:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\P:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\J:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\N:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\Q:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\S:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\U:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\V:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\X:	MicrosoftEdgeComRegisterShellARM64.exe
File opened (read-only)	\??\Y:	MicrosoftEdgeComRegisterShellARM64.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
10	api.ipify.org

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2600	tasklist.exe
1392	tasklist.exe
3116	tasklist.exe

Executes dropped EXE 2 IoCs

pid	Process
3412	MicrosoftEdgeComRegisterShellARM64.exe
1336	MicrosoftEdgeComRegisterShellARM64.exe

Loads dropped DLL 2 IoCs

pid	Process
3412	MicrosoftEdgeComRegisterShellARM64.exe
1336	MicrosoftEdgeComRegisterShellARM64.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4536	cmd.exe
708	cmd.exe
2676	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
688	1336	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vat.N0.20260804142245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeComRegisterShellARM64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeComRegisterShellARM64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3848	timeout.exe
5168	timeout.exe
3472	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1608	taskkill.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ԁ"	Vat.N0.20260804142245.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open\command	Vat.N0.20260804142245.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell	Vat.N0.20260804142245.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings	Vat.N0.20260804142245.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open\command	Vat.N0.20260804142245.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings	Vat.N0.20260804142245.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open	Vat.N0.20260804142245.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/S-1-5-21-2676125363-1719236920-1274912211-8281/SystemAppData/MicrosoftEdgeComRegisterShellARM64.exe"	Vat.N0.20260804142245.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open	Vat.N0.20260804142245.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell	Vat.N0.20260804142245.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeLoadDriverPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTakeOwnershipPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeIncBasePriorityPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTcbPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	1392	tasklist.exe
Token: SeDebugPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreateTokenPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeAssignPrimaryTokenPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeLockMemoryPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeIncreaseQuotaPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeMachineAccountPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTcbPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSecurityPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeTakeOwnershipPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeLoadDriverPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSystemProfilePrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSystemtimePrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeProfSingleProcessPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeIncBasePriorityPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreatePagefilePrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreatePermanentPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeBackupPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeRestorePrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeShutdownPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeDebugPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeAuditPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSystemEnvironmentPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeChangeNotifyPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeRemoteShutdownPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeUndockPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeSyncAgentPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeEnableDelegationPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeManageVolumePrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeImpersonatePrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeCreateGlobalPrivilege	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: 31	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: 32	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: 33	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: 34	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: 35	3412	MicrosoftEdgeComRegisterShellARM64.exe
Token: SeDebugPrivilege	3116	tasklist.exe
Token: SeDebugPrivilege	2600	tasklist.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2952	Vat.N0.20260804142245.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
3412	MicrosoftEdgeComRegisterShellARM64.exe
1336	MicrosoftEdgeComRegisterShellARM64.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 4536	2952	Vat.N0.20260804142245.exe	89
PID 4536 wrote to memory of 1124	4536	cmd.exe	91
PID 1124 wrote to memory of 3412	1124	ComputerDefaults.exe	92
PID 3412 wrote to memory of 1608	3412	MicrosoftEdgeComRegisterShellARM64.exe	93
PID 3412 wrote to memory of 708	3412	MicrosoftEdgeComRegisterShellARM64.exe	96
PID 708 wrote to memory of 2676	708	cmd.exe	98
PID 2676 wrote to memory of 1392	2676	cmd.exe	99
PID 2676 wrote to memory of 4148	2676	cmd.exe	100
PID 2676 wrote to memory of 3848	2676	cmd.exe	101
PID 2676 wrote to memory of 3116	2676	cmd.exe	108
PID 2676 wrote to memory of 2300	2676	cmd.exe	109
PID 2676 wrote to memory of 5168	2676	cmd.exe	110
PID 2676 wrote to memory of 2600	2676	cmd.exe	111
PID 2676 wrote to memory of 2164	2676	cmd.exe	112
PID 2676 wrote to memory of 3472	2676	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe
"C:\Users\Admin\AppData\Local\Temp\Vat.N0.20260804142245.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Windows\System32\ComputerDefaults.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\ComputerDefaults.exe
    C:\Windows\System32\ComputerDefaults.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\ProgramData\S-1-5-21-2676125363-1719236920-1274912211-8281\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
      "MicrosoftEdgeComRegisterShellARM64.exe"
      4⤵
      Enumerates connected drives
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3412
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\A18AA22EAB1E4EBAE7A.CMD
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:708
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C C:\Users\Admin\AppData\Local\Temp\A18AA22EAB1E4EBAE7A.CMD
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1392
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3848
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3116
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5168
        
        C:\Windows\SysWOW64\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq MicrosoftEdgeComRegisterShellARM64.exe" /FO CSV
        7⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Windows\SysWOW64\find.exe
        
        FIND /I "MicrosoftEdgeComRegisterShellARM64.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Windows\SysWOW64\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3472

C:\ProgramData\S-1-5-21-2676125363-1719236920-1274912211-8281\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
C:\ProgramData\S-1-5-21-2676125363-1719236920-1274912211-8281\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1448
  2⤵
  - Program crash
  PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1336 -ip 1336
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeComRegisterShellARM64.exe

Path C:\ProgramData\S-1-5-21-2676125363-1719236920-1274912211-8281\SystemAppData\MicrosoftEdgeComRegisterShellARM64.exe
Size 3.5MB
SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
MD5 c185dbe4fcb5da174009ada3aa4822c3
SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
TLSH
T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfCORe8.dLL

Path C:\ProgramData\S-1-5-21-2676125363-1719236920-1274912211-8281\SystemAppData\pdfCORe8.dLL
Size 3.8MB
SHA256 62b4dab833c0ea54fe9d4a65ecb1e705791bfe47b61398c0ea155d2445fffce5
MD5 12ad6745dc4d16f4f8e28ab0594f9420
SHA1 85bd848bb5c4375f711fd43fdcfd542708c018bb
SHA512 99046d16d500acf36bdc6fdced7a63cbfa46cc023f104c709e49eea46ff8596425c47bc227c0195337b8a1e53b7cb6df9dea3880a04606df19739ad0a1b388de
SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxxArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxxArDMxLkfIsEs
TLSH
T1F006D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 727B
SHA256 3987e97c336d4df885da6bd99fbbedc4b0e368ccb21b8aa9cf6b358349be04bb
MD5 932203a782310a1857131c0e61d2a8c6
SHA1 36854cdb4597a8025f70600ad6efeb4228d76e79
SHA512 a83a407192e35918013461a2607c04110e2d4fc139fb34036d40528e425782215479d5effd2a1a75f7bc5e332c5cd7cc3052d0e27f383b0ece76abc890b7b3bd
TLSH
T14E016013AC9898601E25EC8504E4781E36C6E028BAC7381B6DB02D89828DBEA16B9834
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 be28306753fbcd10dfdccc0d803daf45cb9d8820d5d9f5ce83f7716d37584923
MD5 2b5a8554c5d49029302e9f94d82f4f89
SHA1 82fb3450db1f737cb748fd5ac2ab277401951cb4
SHA512 ebb0c882ed5371a5fe14d5841b680727ff54fc7f5191b1cda4a7f7f5520789512e0b448d0e42b522c484eaaa3c4ee7c1f575cd2a9b78d47b1cfd21650cf9a565
TLSH
T11EF0D43F59BB645258138D1D29EEC5B361F4998E01C64C7D307958B146673CE904F00E
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
Size 727B
SHA256 9ae2e1c28447bfe69ff169012d873d11a0c43001af635b114493e8177e7e9373
MD5 e640a2aa40e65ccf8ae5c06fc697b3ec
SHA1 cbb210a91e4db8e6257acbec1a3e871694ccf7b0
SHA512 652b298f4d3fed401a2794dc3c731583d7904bbbe7401e8de2e1c32842b6d81282533ca9d2d14d169b160bd81784462ec7a8eef339b5414f1afa58fad3761353
TLSH
T1A80194C99DBCF2068D02EEE0DE28E270749353084E36074B0324043D6D4BBD285D9D42
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 8d048730b983105d77a346709c2f03ca8f061c0d7c12cf101a8335751211343b
MD5 a791979dcf39c58caa0d0e7b1d6e230d
SHA1 e8b7f1fc24cae513f7180b1f26a4f57c0a5305aa
SHA512 0fd0d3e443f268a75374ebeb3068b47903baad6af1b65cf12a51b834c9e73a49c8090ae18b6328a958abb4e7556cc32d3b83ee2bc5beef4b4998972bc5ab1766
TLSH
T153016516685EAEC07843AE819BF8CBF4223546D660DA66967C7420DF618A7C89453841
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
Size 727B
SHA256 53c60c9910c857fa3f02c1db2a222d556998d9914fb472f4e3324b39be887813
MD5 520b189a6d3e6f328898d98bb7105d6f
SHA1 bb479bc92117f57e5576e29f6b649a4b0ffc99cf
SHA512 32c9b881be5eeb391a0e8e3fce13bba7600ee9d47e46e3bd81beefa90ef20b16a112c18918de71e30f1bfe11c8b9315af8cb84ca2d4acbd9e5b36460b36680c1
TLSH
T10A01158104E76EE4E90C8DD46175E4B4B8ABABD408858D19121C41AF0676FB96F4613D
MD5 SHA1 SHA512 TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 400B
SHA256 4f09e56d7269c829e8a25b685ffe9e306b5840bfb89580c3248fd2e9cbed25b3
MD5 74c59d3c46eaa877315ff5971ff08472
SHA1 b45d1e688436d88caf1c84328831367dd8f85e0d
SHA512 3f5c19d41463cd7877208a1743f3db2ce5c7231f60d012442e74c4e31be86e7d1e0529d33757a4efb7edef2d6798f0a1b3499a33fb8a3530c492328d8627b40b
TLSH
T19AE0C6281EF2043DF3AACAB94BC1F45A482DF1869800CFB40E9009089A08F000E928F8
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 e730dcd3026e48f60b658ab027517ac21919bf958735cd28643d7739480ee6ea
MD5 0393c77af5a61afe860f8cbd93bd5dc5
SHA1 696c04423d7e0162af49543d4edef6d25a9262b8
SHA512 9695831e4007e4dfae7d47d62faf909cf127043e5ae00eec46ba20b153a9a0080ef07b123c7f3972376905a3aeac80f4796fab86ed2e5ab0f5b28df0afd9a1c7
TLSH
T172E0202027FA902FF1689B7403D9D095DF25F1176C5956BE1F91143D5D199414CA2D30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_318C19735AFB8DB0BA822A0091F55D60
Size 404B
SHA256 c9dae0dbda58d3112a010b3cb4f9d3b1c69059d1056508db68564152cd77b61e
MD5 b0b761da47f00794633459cb21bada0e
SHA1 d899a0d4b3861e303d84a4e4bf32a77cdba07889
SHA512 6ae8a8716e4088a1eb845e0448e9931c06e163ee62b9843a75cd589352568b11f6b28944ba56a8cb8451f3803c48618e67cd9ce8e16fe92bcc8d06c4521f526e
TLSH
T148E02D3032FF056EF1F4E4380BEAFC22687AF20F050AD3B806140B2AAB00B004CA2131
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 30cbe97e2f0a317c796d3f4937121f76161f8cc5b94a5396c9a4c223b6d529ab
MD5 0e6b3a06776c398b00ebc30980a69f3e
SHA1 20bb0cbe3e8b616c8a651cbb2c771ec94ca986b9
SHA512 b3109028eef158ea6ad529e8d4875e0cc1c9e32e1935697eece30346ab152e1bd907664d7e7774074e512cb4af8691da73129752e3c02599d4cb22208b22ebf6
TLSH
T145E06F2932EFB40EF1A0C83A4AFAA1721E49E201244883B90AD00308AB0AE005C10AF0
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
Size 416B
SHA256 9ac68a6df71741390e373394fb8387790e4682c8bc140d8a6c39db4bf933de7c
MD5 99bde885f375a4e06baaaee80997f44f
SHA1 99a864add428c07f14ca8d9ef8d447da6226d33f
SHA512 9321467acc4272ba1023d2e360075e076a04a896e4afffea19d1bc0966b9005bb1d96eb2801aa2ff478a1bb0c1f42a1bf3e05148c87b794d3de5adf1b3caccef
TLSH
T1F5E0D82822BEA51EF064D93547F9A9355E48F306141496B906D147486F17F009C15AF5
MD5 SHA1 SHA512 TLSH

Submit Download

A18AA22EAB1E4EBAE7A.CMD

Path C:\Users\Admin\AppData\Local\Temp\A18AA22EAB1E4EBAE7A.CMD
Size 1KB
SHA256 0cc10758ab083f6b5ba7fd03d6d4704f53b8e6b72a1fdf6c8162a7b30a92f084
MD5 40b86e881507797dfd0f36c91226282d
SHA1 d6bf6b9b32709e38ae92f41529b256d617dc8b47
SHA512 941b064bfaa714c9957488db25f99ed25120fe434a1b1da44063a153e6e6595d48e0c62d28d630c59c7ec44db470e81de25e9ce9520a261d950a649083ccd5be
TLSH
T1A7314E9EC4074E1D431442DF178ACC6BC680F447FD8571C0B6AC5BC42382A8E09A6BFE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3412-35-0x0000000005360000-0x00000000053B7000-memory.dmp

Download

memory/3412-36-0x0000000005360000-0x00000000053B7000-memory.dmp

Download

memory/3412-38-0x0000000005360000-0x00000000053B7000-memory.dmp

Download

memory/3412-41-0x0000000005360000-0x00000000053B7000-memory.dmp

Download

memory/3412-40-0x0000000005360000-0x00000000053B7000-memory.dmp

Download