hxxp://google[.]com

Analysis

max time kernel
507s
max time network
515s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 04:59

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

bootkit discovery evasion exploit persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

gdifuncs.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:\\windows\\winbase_base_procid_none\\secureloc0x65\\WinRapistI386.vbs\""	gdifuncs.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

gdifuncs.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gdifuncs.exe
Disables RegEdit via registry modification 1 IoCs
evasion

Processes:

gdifuncs.exe

description ioc process

Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gdifuncs.exe
Disables Task Manager via registry modification
evasion
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

5076 takeown.exe
1460 icacls.exe
1396 takeown.exe
4048 icacls.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	gdifuncs.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	gdifuncs.exe

pid	process
5076	takeown.exe
1460	icacls.exe
1396	takeown.exe
4048	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exegdifuncs.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	gdifuncs.exe

Executes dropped EXE 3 IoCs

Processes:

mbr.exeMainWindow.exegdifuncs.exe

pid process

524 mbr.exe
816 MainWindow.exe
2408 gdifuncs.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

5076 takeown.exe
1460 icacls.exe
1396 takeown.exe
4048 icacls.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

282 camo.githubusercontent.com
283 camo.githubusercontent.com
287 camo.githubusercontent.com
300 raw.githubusercontent.com
301 raw.githubusercontent.com
302 raw.githubusercontent.com
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

mbr.exe

description ioc process

File opened for modification \??\PhysicalDrive0 mbr.exe
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
ransomware

Defacement
T1491

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\Wallpaper = "c:\\bg.bmp" reg.exe

pid	process
524	mbr.exe
816	MainWindow.exe
2408	gdifuncs.exe

pid	process
5076	takeown.exe
1460	icacls.exe
1396	takeown.exe
4048	icacls.exe

flow	ioc
282	camo.githubusercontent.com
283	camo.githubusercontent.com
287	camo.githubusercontent.com
300	raw.githubusercontent.com
301	raw.githubusercontent.com
302	raw.githubusercontent.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	mbr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Desktop\Wallpaper = "c:\\bg.bmp"	reg.exe

Drops file in Windows directory 6 IoCs

Processes:

cmd.exegdifuncs.execmd.exe

description	ioc	process
File created	\??\c:\windows\winbase_base_procid_none\secureloc0x65\gdifuncs.exe	cmd.exe
File opened for modification	\??\c:\windows\winbase_base_procid_none\secureloc0x65\gdifuncs.exe	cmd.exe
File created	\??\c:\windows\winbase_base_procid_none\secureloc0x65\mainbgtheme.wav	cmd.exe
File opened for modification	\??\c:\windows\winbase_base_procid_none\secureloc0x65\mainbgtheme.wav	cmd.exe
File created	C:\windows\WinAttr.gci	gdifuncs.exe
File opened for modification	\??\c:\windows\WinAttr.gci	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2080 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4744 taskkill.exe

pid	process
2080	timeout.exe

pid	process
4744	taskkill.exe

Modifies Control Panel 3 IoCs

evasion

Processes:

gdifuncs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Cursors\Arrow = "C:\\Windows\\winbase_base_procid_none\\secureloc0x65\\rcur.cur"	gdifuncs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\winbase_base_procid_none\\secureloc0x65\\rcur.cur"	gdifuncs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\Cursors\Hand = "C:\\Windows\\winbase_base_procid_none\\secureloc0x65\\rcur.cur"	gdifuncs.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{AD0C075B-9A33-4142-9876-1601B4A20A80}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

gdifuncs.exe

pid	process
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe
2408	gdifuncs.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

AUDIODG.EXEgdifuncs.exetakeown.exetakeown.exetaskkill.exe

description	pid	process
Token: 33	3408	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3408	AUDIODG.EXE
Token: SeDebugPrivilege	2408	gdifuncs.exe
Token: SeDebugPrivilege	2408	gdifuncs.exe
Token: SeTakeOwnershipPrivilege	5076	takeown.exe
Token: SeTakeOwnershipPrivilege	1396	takeown.exe
Token: SeDebugPrivilege	4744	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

MainWindow.exe

pid	process
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe
816	MainWindow.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

SpongebobNoSleep2.exeMainWindow.exe

pid process

3444 SpongebobNoSleep2.exe
816 MainWindow.exe

pid	process
3444	SpongebobNoSleep2.exe
816	MainWindow.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SpongebobNoSleep2.exewscript.execmd.exe

description	pid	process	target process
PID 3444 wrote to memory of 1556	3444	SpongebobNoSleep2.exe	wscript.exe
PID 3444 wrote to memory of 1556	3444	SpongebobNoSleep2.exe	wscript.exe
PID 1556 wrote to memory of 524	1556	wscript.exe	mbr.exe
PID 1556 wrote to memory of 524	1556	wscript.exe	mbr.exe
PID 1556 wrote to memory of 524	1556	wscript.exe	mbr.exe
PID 1556 wrote to memory of 60	1556	wscript.exe	cmd.exe
PID 1556 wrote to memory of 60	1556	wscript.exe	cmd.exe
PID 60 wrote to memory of 2392	60	cmd.exe	reg.exe
PID 60 wrote to memory of 2392	60	cmd.exe	reg.exe
PID 60 wrote to memory of 452	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 452	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 980	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 980	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4244	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4244	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3284	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3284	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4440	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4440	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3388	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3388	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 5104	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 5104	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 5084	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 5084	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3712	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3712	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 1512	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 1512	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4348	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4348	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3272	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3272	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2864	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2864	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 996	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 996	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 1000	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 1000	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3752	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3752	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4276	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4276	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 1600	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 1600	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4584	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 4584	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3816	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3816	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2716	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2716	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3532	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3532	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2620	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2620	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2748	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2748	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3520	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 3520	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2268	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 2268	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 5020	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 5020	60	cmd.exe	rundll32.exe
PID 60 wrote to memory of 1444	60	cmd.exe	rundll32.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

gdifuncs.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gdifuncs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	gdifuncs.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4276,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
1⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4340,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
1⤵
PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4100,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
1⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5472,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
1⤵
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5356,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
1⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5912,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
1⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5512,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
1⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=1308,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
1⤵
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6448,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
1⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5752,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
1⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=5496,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
1⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6164,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
1⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=6864,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
1⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=3860,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
1⤵
- Modifies registry class
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=6884,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
1⤵
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=7124,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
1⤵
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=6308,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
1⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=6888,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
1⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=3820,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
1⤵
PID:3588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e0 0x324
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --field-trial-handle=6724,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
1⤵
PID:720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=7048,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:1
1⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=7336,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:8
1⤵
PID:100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --field-trial-handle=6856,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
1⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=7628,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:8
1⤵
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7880,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:8
1⤵
PID:2832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --field-trial-handle=7968,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
1⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=7992,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:8
1⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=8120,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:8
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --field-trial-handle=8096,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=7524,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:8
1⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=8044,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:8
1⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --field-trial-handle=8004,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
1⤵
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=8156,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:8
1⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7660,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:8
1⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --field-trial-handle=8100,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
1⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --field-trial-handle=5620,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:1
1⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --field-trial-handle=7572,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:1
1⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --field-trial-handle=5308,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:1
1⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=7560,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
1⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=1036,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:8
1⤵
PID:208

C:\Users\Admin\AppData\Local\Temp\Temp1_SpongeBobNoSleep2 (HorrorBob5).zip\SpongebobNoSleep2.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_SpongeBobNoSleep2 (HorrorBob5).zip\SpongebobNoSleep2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444

C:\Windows\system32\wscript.exe
"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\797D.tmp\798E.tmp\798F.vbs //Nologo
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1556

C:\Users\Admin\AppData\Local\Temp\797D.tmp\mbr.exe
"C:\Users\Admin\AppData\Local\Temp\797D.tmp\mbr.exe"
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\797D.tmp\tools.cmd" "
3⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:60

C:\Windows\system32\reg.exe
reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
4⤵
- Sets desktop wallpaper using registry
PID:2392

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:452

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:980

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:4244

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3284

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:4440

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3388

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:5104

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:5084

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3712

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:1512

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:4348

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3272

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:2864

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:996

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:1000

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3752

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:4276

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:1600

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:4584

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3816

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:2716

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3532

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:2620

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:2748

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3520

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:2268

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:5020

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:1444

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:4516

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:4848

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:2536

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3932

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:1040

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:3296

C:\Windows\system32\rundll32.exe
RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
4⤵
PID:524

C:\Users\Admin\AppData\Local\Temp\797D.tmp\MainWindow.exe
"C:\Users\Admin\AppData\Local\Temp\797D.tmp\MainWindow.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:816

C:\Users\Admin\AppData\Local\Temp\797D.tmp\gdifuncs.exe
"C:\Users\Admin\AppData\Local\Temp\797D.tmp\gdifuncs.exe"
3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2408

C:\windows\SysWOW64\takeown.exe
"C:\windows\system32\takeown.exe" /f C:\windows\system32\LogonUI.exe
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\windows\SysWOW64\icacls.exe
"C:\windows\system32\icacls.exe" C:\\windows\\system32\\LogonUI.exe /granted "Admin":F
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cd\&cd Windows\system32&takeown /f LogonUI.exe&icacls LogonUI.exe /granted "%username%":F&cd..&cd winbase_base_procid_none&cd secureloc0x65&copy "ui65.exe" "C:\windows\system32\LogonUI.exe" /Y&echo WinLTDRStartwinpos > "c:\windows\WinAttr.gci"&timeout 2&taskkill /f /im "tobi0a0c.exe"&exit
4⤵
- Drops file in Windows directory
PID:4672

C:\Windows\SysWOW64\takeown.exe
takeown /f LogonUI.exe
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Windows\SysWOW64\icacls.exe
icacls LogonUI.exe /granted "Admin":F
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4048

C:\Windows\SysWOW64\timeout.exe
timeout 2
5⤵
- Delays execution with timeout.exe
PID:2080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "tobi0a0c.exe"
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=6812,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
1⤵
PID:4816

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

File and Directory Permissions Modification

T1222

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\797D.tmp\798E.tmp\798F.vbs
Filesize
2KB

MD5
b893c34dd666c3c4acef2e2974834a10

SHA1
2664e328e76c324fd53fb9f9cb64c24308472e82

SHA256
984a07d5e914ed0b2487b5f6035d6e8d97a40c23fa847d5fbf87209fee4c4bbc

SHA512
98a3413117e27c02c35322e17c83f529955b83e72f2af7caaaff53099b583cd241cec95e70c3c0d6d440cb22cf0109d4e46dfda09ef2480427e9a9ab7a4c866b

Download Submit
C:\Users\Admin\AppData\Local\Temp\797D.tmp\MainWindow.exe
Filesize
92KB

MD5
7c92316762d584133b9cabf31ab6709b

SHA1
7ad040508cef1c0fa5edf45812b7b9cd16259474

SHA256
01995c3715c30c0c292752448516b94485db51035c3a4f86eb18c147f10b6298

SHA512
f9fc7600c30cb11079185841fb15ee3ba5c33fff13979d5e69b2bae5723a0404177195d2e0bd28142356ff9b293850880b28322b2ce1ff9fe35e8961bb3f7be1

Download Submit
C:\Users\Admin\AppData\Local\Temp\797D.tmp\bg.bmp
Filesize
2.6MB

MD5
ce45a70d3cc2941a147c09264fc1cda5

SHA1
44cdf6c6a9ab62766b47caed1a6f832a86ecb6f9

SHA256
eceedadfde8506a73650cfa9a936e6a8fff7ffb664c9602bb14432aa2f8109ac

SHA512
d1bf6cdade55e9a7ce4243e41a696ae051835711f3d1e0f273ad3643f0b878266a8213cc13ca887a8181981ba4937350986e01e819b4bb109330718ef6251149

Download Submit
C:\Users\Admin\AppData\Local\Temp\797D.tmp\gdifuncs.exe
Filesize
120KB

MD5
e254e9598ee638c01e5ccc40e604938b

SHA1
541fa2a47f3caaae6aa8f5fbfe4d8aef0001905d

SHA256
4040ad3437e51139819148ed6378828adcfbd924251af39de8bf100a3a476a63

SHA512
92f129a52f2df1f8ed20156e838b79a13baf0cbcdd9c94a5c34f6639c714311f41eb3745fdcc64eac88ce3e6f27d25f9a3250f4ababc630eff7a89802e18b4bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\797D.tmp\mainbgtheme.wav
Filesize
19.0MB

MD5
1b185a156cfc1ddeff939bf62672516b

SHA1
fd8b803400036f42c8d20ae491e2f1f040a1aed5

SHA256
e147a3c7a333cbc90e1bf9c08955d191ce83f33542297121635c1d79ecfdfa36

SHA512
41b33930e3efe628dae39083ef616baaf6ceb46056a94ab21b4b67eec490b0442a4211eaab79fce1f75f40ecdc853d269c82b5c5389081102f11e0f2f6503ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\797D.tmp\mbr.exe
Filesize
1.3MB

MD5
33bd7d68378c2e3aa4e06a6a85879f63

SHA1
00914180e1add12a7f6d03de29c69ad6da67f081

SHA256
6e79302d7ae9cc69e4fd1ba77bd4315d5e09f7a173b55ba823d6069a587a2e05

SHA512
b100e43fb45a2c8b6d31dd92a8ae9d8efea88977a62118547b4609cc7fe0e42efc25dc043bac4b20f662fab044c0ba007b322c77e66f0c791cc906eafc72fb95

Download Submit
C:\Users\Admin\AppData\Local\Temp\797D.tmp\tools.cmd
Filesize
2KB

MD5
397c1a185b596e4d6a4a36c4bdcbd3b2

SHA1
054819dae87cee9b1783b09940a52433b63f01ae

SHA256
56c7054c00a849648d3681d08536dc56c0fb637f1f1ec3f9e102eace0a796a9f

SHA512
c2a77479ca0aa945826dccea75d5a7224c85b7b415fda802301be8a2305197276a33c48f82717faddb2a0ac58300f5b849a8c0dffb5a4443663c3dfd951d4e5c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_8C44CCB290A14DAFA1FCD1EE59BADBFB.dat
Filesize
940B

MD5
51df6bd8fa551310c1258706b13c82d4

SHA1
9552f90469640ae2c8cbebe21c680f2927c8545d

SHA256
a31500ab5d1664b0e7a6f31a97b5bdb7c173cd342d15107e5a7d9221f357b0c9

SHA512
06e7b1dae9d4b311ca3fba2af6b792ec7947adcdeec10548626f04caeffac59a6c05925fc2886b7c6a450a4de0fe96666c34725959a914a9eb139a2e9d132189

Download Submit
C:\Users\Admin\Desktop\SPONGEBOB_IS_WATCHING_YOU 5.txt
Filesize
26B

MD5
bb6d68d7181108015cd381c28360dfc4

SHA1
192c34b9cba6f9c4b742f2b70d9731b8ba2ac764

SHA256
aea8fb9235900760ac374c6a4a10fba62c2a0ef5bea2dd7ef4db70fe55e0b317

SHA512
e3d6bf8f6ae16daa235e2bc7ce64da5a76ff0155fa89942a4e9d3f10ce70229e081c5029a6b67702a6b14000f62e6c9188ba394ee7183d0667ddac9e0224f3f3

Download Submit
memory/524-221-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2408-236-0x0000000000120000-0x0000000000142000-memory.dmp

Filesize
136KB

Download
memory/2408-240-0x0000000004FE0000-0x0000000005584000-memory.dmp

Filesize
5.6MB

Download
memory/2408-241-0x0000000004B20000-0x0000000004BB2000-memory.dmp

Filesize
584KB

Download
memory/2408-242-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads