hxxps://cdn[.]discordapp[.]com/attachments/1184579485820006440/1184593764526850198/Space_Therapy[.]rar

Resubmissions

14/12/2023, 20:00

231214-yq59nahfb410

14/12/2023, 19:59

14/12/2023, 19:57

14/12/2023, 19:55

14/12/2023, 19:54

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
14/12/2023, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1184579485820006440/1184593764526850198/Space_Therapy.rar
Sample231214-ymmm5shee6

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4104	winrar-x64-700b3.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 585539.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
3328	msedge.exe
3328	msedge.exe
4872	identity_helper.exe
4872	identity_helper.exe
2028	msedge.exe
2028	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
5536	msedge.exe
5536	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5368	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SetWindowsHookEx 54 IoCs

pid	Process
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
5368	OpenWith.exe
4104	winrar-x64-700b3.exe
4104	winrar-x64-700b3.exe
4104	winrar-x64-700b3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4708	3328	msedge.exe	87
PID 3328 wrote to memory of 4708	3328	msedge.exe	87
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 3648	3328	msedge.exe	88
PID 3328 wrote to memory of 4864	3328	msedge.exe	89
PID 3328 wrote to memory of 4864	3328	msedge.exe	89
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90
PID 3328 wrote to memory of 1672	3328	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1184579485820006440/1184593764526850198/Space_Therapy.rar
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x78,0x7c,0x80,0xe4,0x108,0x7ffcbd7d46f8,0x7ffcbd7d4708,0x7ffcbd7d4718
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5536
- C:\Users\Admin\Downloads\winrar-x64-700b3.exe
  "C:\Users\Admin\Downloads\winrar-x64-700b3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5205112708262696546,5088893807962335597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5272

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458
MD5 208a234643c411e1b919e904ee20115e
SHA1 400b6e6860953f981bfe4716c345b797ed5b2b5b
SHA512 2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 cd9cefbdaa7dda5e6bdfcd7f7eaf4f47fcbc7fa66b74170ac80384d68acd95e1
MD5 558d0ca0b91d1c003a32adebaf0aceee
SHA1 757a97ae79974215d1503f028483a45faeaecb38
SHA512 3d6adb466fe28e6213e9fd0a2fcd9c7b7da8e0642d9f3f7c7e65064fac3480a30214570634143a5f2558878f2bfb0ee5d07c3784dd72ee72caaae9d1573c7484
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 186B
SHA256 ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3
MD5 094ab275342c45551894b7940ae9ad0d
SHA1 2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e
SHA512 19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c4df23e4b638ba133319f4b9cf9ff4dfdd7df730c2887330864f67c65ed761fe
MD5 547b8f89c5e1ae5774fa4c006a8a5d7c
SHA1 b545fc39fca230221580a8933be4ad982c2c19ec
SHA512 dbdec546834dcd8079dee9944de11ab65c13bd2407c13a4cc90cc6e0110b6d7ed7dbb582e8c35f7b168f52771a20f2708aa868ee6dd2e724bc1d5fe74b903cb9
SSDEEP 96:nyk8sQTW1yeOqwpvWMoiVmdeHXTE1B+UWQyV+VD7AiEwb:nykn0UGWMXDgB+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6aa591d76e7ad18c30adbd920ba13a88852d3bed0444d864d3ee8a76cbb05fd3
MD5 91610a176733c459d9440a85b68000b1
SHA1 8e381e86b28d5f1622dd4087905d9e42d077e11b
SHA512 50c5d10f676d5b8d3ef227acba7f8a475adf43884796d2343685e51fecc81dc0da00f52cb4e2f55a4f4b59468c8b3c0ae1072dc8a98305b8697a4741137c505d
SSDEEP 96:n4k2W1yeOqwpvWMoiVmdeHXT4B+UWQyV+VDCzia:n4k10UGWMXD4B+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3f00f6008a40d2b3c2dbd40c204a51d5dffebbfd37ab2609b4478a1437c0c85e
MD5 ea73788740024ae9987f5e7936db3c7b
SHA1 9f57851e3add8b5898b193b914459685ff8c276d
SHA512 4998ef219951dad744336c65e5029625a8b8aa967e1c235db56385902051e06d318a935c127280b45daf55b87e5f9002755c609cec751b16ccfe409a41c6f01c
SSDEEP 96:nyk8sQhW1S3OqwpFoWMoi2R5mde/uP1jXTE7iB+UWQyV+VD7AiEwb:nyk1QxSoWM2luPhDDB+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 86c68710fff40db4e58288321599ed38f5e31a1864271383c3673b439d3f1e47
MD5 c3abf7d038094f0fa8d928903d53562c
SHA1 779ed8da178c9c10abed24a0f112368e9b3a3e3a
SHA512 f75b6697e210c8630ae53fe93979396b533eb16db2f0ee391f95337082133b46521b38996233efc1807947866b8f75325b14b947c860885624ab5b8cee75ef10
SSDEEP 96:nykrsQTW1yeOqwpvWMoiVmdeHXTE7iB+UWQyV+VD7AiEwb:nyk00UGWMXDDB+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28
MD5 5a6206a3489650bf4a9c3ce44a428126
SHA1 3137a909ef8b098687ec536c57caa1bacc77224b
SHA512 980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78
SSDEEP 768:nT8W/L8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNLlD8rUmu:nT8W/Lu1jaYLZmu
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 89843ca9087f029f4669e3ed792c58a526c382cde60df5bd50b75f5dcd118576
MD5 c78b356839e0e8fadff22225e56414f4
SHA1 b41439201510303228261e96c3951dbfaa4125cf
SHA512 6c18974fb4dfa84ac380db31b502e5ca21e276b422a4325afe6464a2af8d11f3c1c7d56cdc262eabd61b96c26d96d343a5825ea8b75e517b769164702b8018b3
SSDEEP 192:yfoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0F/Qgre2RU6WCySb4tE0a:yH9iIxuERzA83h09RZxY0FLRy31GR6Dc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e3f872f90047f8b1cf03d2baf786f8e05f8bc025e2804ac375832a71944908a8
MD5 862d9ed444ad460cec679436f2f1bfff
SHA1 126df8788f6f2d6936b7f859a8510f34896d1ef4
SHA512 71c3dfd767c40300ce00348f9000141d390da28db215b8bc46c0c1e2a035bfd3a36afc2f92eab9203f68555be7ffa9ef796f6e1d27d9b423b0b26d2cc6f30d50
SSDEEP 192:WoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0F/QgWe2RU69b4tE0LQNkg:S9iIxuERzA83h09RZxY0FoC1GR6Dc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b14982625ceddcfdf862c08123a1a5697327e32b9dd8b04c6253c4ca5710fa0d
MD5 e5dd17953a3cda1111329b4c84d64235
SHA1 617ebd752ce38f97305533e86e82465035d179f7
SHA512 ca6ced8851de61a8e257335975153c02fb6419b5b81336b59f42985097f90569d7e0a13a8ef44ad24161c43584c8c55660db5534d5c6afc249077f212ea62aca
SSDEEP 192:MoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0F/QgWe2RU69b44E0LQNkg:89iIxuERzA83h09RZxY0FoCKGR6Dc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3beef16e18a8916009e27904a30138c41ff0c37aaa100dea9709ee8fc9e41437
MD5 90b3ca3776aa9c1b34c4ce9759ecae64
SHA1 51e7e520a56cd54f65d747e59f44dd3652470118
SHA512 ff9986a58d96ab566981fef75c27a888eeb724424b036ec9eaf38cc93331525766f81aa51b49eb983cf5a54a5fce3f2b8331cccde021ab15cfc4a8d09e6e7042
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0F/Qgre2RU69b4tE0LQNkg:A9iIxuERzA83h09RZxY0FLC1GR6Dc
MD5 SHA1 SHA512 SSDEEP

Submit Download

winrar-x64-700b3.exe

Path C:\Users\Admin\Downloads\winrar-x64-700b3.exe
Size 3.7MB
SHA256 beeb7f5eff6716b54128dc92aaeadd68d20001649e41c56c373527beff6c5bfc
MD5 3421eef3474535bc8213cd6fe86a3f5d
SHA1 dab1e29251b4c735703f2cba84c12802052aeaa3
SHA512 ed003ec720d92717bd1f94976fc7b1fe43294816acd27a279e0d9dd68baf7abd5558dffe716d7e8945c56ef2a6e70e67642fff5ceb4b7c16a4835e2006edf6f8
SSDEEP 98304:A5HBfKE7mv7W/u8m2z45NrgBMfhOh2ny07fmcoQNjR+4:eYvzW/AN5Nj5mYyPytF
MD5 SHA1 SHA512 SSDEEP

Submit Download