hxxp://minecraft[.]net/download

Analysis

max time kernel
1796s
max time network
1179s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://minecraft.net/download

Score

8^/10

discovery upx

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	TLauncher-2.899-Installer-1.2.1.exe

Executes dropped EXE 2 IoCs

pid	Process
2884	TLauncher-2.899-Installer-1.2.1.exe
5404	irsetup.exe

Loads dropped DLL 3 IoCs

pid	Process
5404	irsetup.exe
5404	irsetup.exe
5404	irsetup.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023409-469.dat	upx
behavioral1/files/0x0007000000023409-475.dat	upx
behavioral1/memory/5404-478-0x0000000000B00000-0x0000000000EE9000-memory.dmp	upx
behavioral1/memory/5404-1057-0x0000000000B00000-0x0000000000EE9000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{19792A5F-6A84-4CFA-8BFA-7058CB7D301E}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 977431.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
2188	msedge.exe
2188	msedge.exe
4896	identity_helper.exe
4896	identity_helper.exe
5424	msedge.exe
5424	msedge.exe
5852	msedge.exe
5852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	5244	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	TLauncher-2.899-Installer-1.2.1.exe
5404	irsetup.exe
5404	irsetup.exe
5404	irsetup.exe
5404	irsetup.exe
5404	irsetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1276	2188	msedge.exe	87
PID 2188 wrote to memory of 1276	2188	msedge.exe	87
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1124	2188	msedge.exe	88
PID 2188 wrote to memory of 1680	2188	msedge.exe	89
PID 2188 wrote to memory of 1680	2188	msedge.exe	89
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90
PID 2188 wrote to memory of 224	2188	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://minecraft.net/download
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9ca746f8,0x7ffe9ca74708,0x7ffe9ca74718
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,17085675899751146075,2805286793923051703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5852
- C:\Users\Admin\Downloads\TLauncher-2.899-Installer-1.2.1.exe
  "C:\Users\Admin\Downloads\TLauncher-2.899-Installer-1.2.1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1773458 "__IRAFN:C:\Users\Admin\Downloads\TLauncher-2.899-Installer-1.2.1.exe" "__IRCT:3" "__IRTSS:26403872" "__IRSID:S-1-5-21-3270530367-132075249-2153716227-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3a30371452d3c2b6d7cf4c51db6d58d6

SHA1
6fe18ab7bbd8f63ec4d163e942a8c669370cab6f

SHA256
ffbb0a10678698a3bc566f51768fa98c63c97efbeae6ad5e99447ed3ecc31a96

SHA512
b98fce6935b595028cfa0998d02c0bb7a57cb1740e2ad9713d8689e671e767f3b6b80f663bf6ac7c73d42c4f270e72682833cdc6d336a6c40ff29f8ae6e51cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fa626ffe816e0fabd21383dd496347da

SHA1
c2be57620cc734876876ea0555aa4001190457fd

SHA256
68813aa51bdf6b8279a5f80bbdc0bbb697aaa11e46b16f0342f1c6b240342637

SHA512
4660fc4a4622fbbf840c8fd85d6ba45ea9041e43c24e25d2efec71625e9b6bb18bf073f3fb058b2ce2a1b2fe14791c328ff8deb6ce5d2ac2a8edea293c00c9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5db906d91bab55cba5c3a02bd094b795

SHA1
07fadcc9dabf7a649adcd483b994628f33da8b0d

SHA256
00b583d079c0c2d3f014016e80259f68023e5bb3446eaa14a8156924bbe400a4

SHA512
6ed3832b696934e5caa569fd9da022bd11a9e3bbf54d6044e9c4763414ae14b93d3089439af0bf9f8ea98cb2630c7698fe7a63dc2f8426e66407e13d148ff5a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
0f6b94bc47725376412bfa5f1bc9bf32

SHA1
d3a769c4587c626be9f47529b6bd567db31791d4

SHA256
c75fe4e2ee1529c44a9d4d0e614f784c5f53b4e59a8c28dd33d9b9d7bb31a93f

SHA512
2623b59e4d93f7b6a887e6b080d1388920d84481fdaf115cc6b6a9f6698d4a14c9b80ee2678ac4223b567b719a2bdeab170cf549615b6ac70955e6e1cb0c7995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d3678adbf99c5ebc689d1a4532e763a4

SHA1
35b64657045b1f6e823f86ad6e3fe817f8a9a650

SHA256
67548859ee50d4fd04696682cc91b774261396c3c89e6a0ff4c668eb55ec64fa

SHA512
25ffb9fc11e383626b2cea6dc982f129f99d54ce4336438737036cb8736201c21de7102b8c4b29194eaff02aa82cfbc02cdcc2fe70e486804def7b1931c689dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2738571c7e75801825120044671def86

SHA1
7603d5ed82669c18dce9c41ffc7060bf737c8376

SHA256
9fb395e636e63f6ffb0150e784e534b8639e3b5d9468d11a115905ac0197c82a

SHA512
6d5ff7577644d1a563d022904bb3cf22ee1063524e310194d71b3929466794644fb82c5ff6275e5236e03fd51b8973397ddb143136dd4fe9bf9f85ea1fa00056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ce55792ed1cb32af4901641599c8038e

SHA1
d54cf20e24565bc2387fa5f9c77cf75414ec839f

SHA256
5bd1abf5d69d3ff75e1ae4c2f466dd04842b2616f333f38cdc3262d871cac504

SHA512
6fa7ef8a41141421b2c9e836baf78eb147457a1c05b3be3bed1c70c2d7a7968f92aa28469a9b93ff37179ef8b7638cb0dbe4a2e48532aaaeeb828be808d9b96c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6bd1b0ccb8eff15fad8dba556b4691bd

SHA1
91d99e0f81099072fc700f06c067cd6ea1ba0653

SHA256
fd8df56e1fd58906101bddae089e0f2161c8433c141c75a4627584b319901f2f

SHA512
6352a42fb9645949c682488f1cd47400b5928991f28ad4b40bfc080fbaa9e9f22d928a9061876d59dacf7896da861c484d8b7916c91968ccd673090b6557ccb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6ccf772336a923f80999e4de5199d530

SHA1
b94a772adcbf5231bcf7ef270c526ca35ecb4e9b

SHA256
4f7ed4e71f8ea84985116caa8ce212836842e3605fb4eda513f4be79da6554c2

SHA512
be3cd8cc667153f158bc6091c830b86f3e86443466820b378bf55afeea1397910987ece8a060201ed8a93e98af116a1f93fe81d79f0a1961e849c94fd1014366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ab15.TMP

Filesize
538B

MD5
5ccfcd6a832e261213810813ad215062

SHA1
077459f28fdd22e17c17aa3297eb639c6d7357c7

SHA256
c6c4f458dd117be59fac7a34ddb04a16478dd31856139c8ef1539a14aa1af156

SHA512
6e6a509d5526235a87a8d37f7604fdc1a8eb874827488ec702963f005b717ca861f842fbf33ab027fdcc4b433241250f8c09280c8dea173fe9ecb56d0e2993a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c60f961b1b46231e1a2e89fe920de672

SHA1
0350e0092ef865b8def3aad084a92265fd176ded

SHA256
35b696c21b51b93d0363e867b95a4ec2d3d16810fe8f0ac7ae4eb6ce73471705

SHA512
a61beb528595cabbddc9ef22e72144fe8b6ae71f35b964286d5cf08274d73bc15a0cd4410bcd8b79eb591711edcedafa6b174784180826cf7c8cec1f2c11c121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc02e8244abfce92cc93016cdc428604

SHA1
303ab013b9f4e2c096a1739014c79b3dfcd3badf

SHA256
aacd7788eaae2b6d5e08120a630f58e248c14fd7a052bbe5c802f9b1925a7f3c

SHA512
da996b926df684ea62750239c8d893ec24803455a39a7f9a5bfa64173311da6ed9a73e0ca95d139aec66597b725c142dd173ec134fbc923528bb71e126c99fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\200.ico

Filesize
116KB

MD5
e043a9cb014d641a56f50f9d9ac9a1b9

SHA1
61dc6aed3d0d1f3b8afe3d161410848c565247ed

SHA256
9dd7020d04753294c8fb694ac49f406de9adad45d8cdd43fefd99fec3659e946

SHA512
4ae5df94fd590703b7a92f19703d733559d600a3885c65f146db04e8bbf6ead9ab5a1748d99c892e6bde63dd4e1592d6f06e02e4baf5e854c8ce6ea0cce1984f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe

Filesize
1.6MB

MD5
6273b2c7648966796d6e2b2808e64bdb

SHA1
2b6e4488a8824ad418e203d56b751428790f8f5a

SHA256
205fa38f2ad078e658271148d22279b86c786b863040e8d2694bab21206fecfc

SHA512
80c9784965ea5a91a9c0e65fd9c2278f7c46b9c5cab4bb9a5789b4f738413542019dbce89269d6ed3fee24ac5bf0e473d22a87d732467d95975cba45f55c50e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd

Filesize
1.7MB

MD5
dabd469bae99f6f2ada08cd2dd3139c3

SHA1
6714e8be7937f7b1be5f7d9bef9cc9c6da0d9e9b

SHA256
89acf7a60e1d3f2bd7804c0cd65f8c90d52606d2a66906c8f31dce2e0ea66606

SHA512
9c5fd1c8f00c78a6f4fd77b75efae892d1cb6baa2e71d89389c659d7c6f8b827b99cecadb0d56c690dd7b26849c6f237af9db3d1a52ae8531d67635b5eff5915

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd

Filesize
97KB

MD5
da1d0cd400e0b6ad6415fd4d90f69666

SHA1
de9083d2902906cacf57259cf581b1466400b799

SHA256
7a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575

SHA512
f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.2MB

MD5
ca500b9b763d3a9a3acc00bf07f7d6ac

SHA1
f935ede58cd77f8ad10495d94e2b6f90d7fdb9f6

SHA256
4a6ed9f2a8e113a798d1347a6745bba59f605617a2f938b22e02f56b00f7981b

SHA512
e4aee29cf0187f733026c95499bc38d41e24118973dfef25ec540d476576d2035f03f4bad5440bc3a7a6e46284cf901f5050d3ff0070f2e05dd57ecc6e46e7f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
832KB

MD5
e24580daa39d62424a9479bbac025f3c

SHA1
0abd7db5403fc06ea683c88ef44f18d758361f1d

SHA256
fa1cc070ab39236f751a42570a5f8aac77313d23c5372b76bd905b2821e5878b

SHA512
486ed1647274eda88b91c90435aaa9678cbae066efce1ad0faea0f0945268de953227183cfae980897d3d9b54f1ea3b51a1e36eea6f5d30cc2eaefb30d4f7f0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
325KB

MD5
c333af59fa9f0b12d1cd9f6bba111e3a

SHA1
66ae1d42b2de0d620fe0b7cc6e1c718c6c579ed0

SHA256
fad540071986c59ec40102c9ca9518a0ddce80cf39eb2fd476bb1a7a03d6eb34

SHA512
2f7e2e53ba1cb9ff38e580da20d6004900494ff7b7ae0ced73c330fae95320cf0ab79278e7434272e469cb4ea2cbbd5198d2cd305dc4b75935e1ca686c6c7ff4

Download Submit
C:\Users\Admin\Downloads\TLauncher-2.899-Installer-1.2.1.exe

Filesize
15.6MB

MD5
6c316bc7700661d8d304912ff3ba6ee1

SHA1
19fa06bf12e8eb704bfd917e988012589f04d847

SHA256
24089553a141b9e5290ef2769ef3124cb18cb1e2d764bdd2c428e0faad2aa521

SHA512
24b02bee846e0d71c3702135ff085feed4ac7c0c43c124a05fadbec89b3b7e76e5c8242bcd5b7b1a2d69c6da40a1068f892adac8b42920b8182d54236e5eb155

Download Submit
C:\Users\Admin\Downloads\TLauncher-2.899-Installer-1.2.1.exe

Filesize
14.6MB

MD5
2ee25fb67d2f60df4a8479b4a08a4158

SHA1
71263a2aec28f0a9287db5bd4c02ba43f8bf5128

SHA256
51e9d940fc18f04af2ab57aefe5b2dd74b6d01277a13f9b7cd337f902f231cec

SHA512
aec54e622efa1f370a70c0c03d3c2126c1b5a42a4175c21ec273caef20ac8f9d8c581d7c9878b811ffe459e3a12a97c1545fd4ba885e24de12d15d04b96910b0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 573129.crdownload

Filesize
9.2MB

MD5
cd0369366097bcdcd4c79444256c5537

SHA1
7718e9571d1b1f3f2fb976a32ce2c3b389f95858

SHA256
5166eeb157d8a6a80fed0ffc8687d91fea5aa8857d2d1e4afb1e4419d01cfd19

SHA512
c4e069a87e8bc08bfc76cecc0bee1796cd0a896b460f0266d7775842d482242e7a7a3b1ca1234895b238e46f6f3d494493d392c5067381833d8714b473503f2e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 977431.crdownload

Filesize
25.2MB

MD5
5ceaa6dfd21a0d1a3d10de418b6b2d05

SHA1
a5738b6ffb703f859fd0d17c01b2b38a7dc577e5

SHA256
6d25afcca4c43805a962b71c947cc521e05fa4b942894fe96c3fbe3c7882817d

SHA512
eeec0be0daf07d7d51325c2c8ec058102b28cbcb39f055d9cdca4b50f7223f78ab442c23dad95b1306bb6ed2ece832b939a1cf43e10d58b9374d5b1b744a0925

Download Submit
memory/5244-1119-0x00000234A4D40000-0x00000234A4D50000-memory.dmp

Filesize
64KB

Download
memory/5404-478-0x0000000000B00000-0x0000000000EE9000-memory.dmp

Filesize
3.9MB

Download
memory/5404-1038-0x0000000006A50000-0x0000000006A53000-memory.dmp

Filesize
12KB

Download
memory/5404-1057-0x0000000000B00000-0x0000000000EE9000-memory.dmp

Filesize
3.9MB

Download
memory/5404-1058-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/5404-1082-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/5404-1084-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/5404-1102-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/5404-1037-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download