sectoprat | hxxp://macrium[.]org

Analysis

max time kernel
422s
max time network
423s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://macrium.org

Score

10^/10

sectoprat rat spyware trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3756-358-0x0000000000C00000-0x0000000000CC6000-memory.dmp	family_sectoprat

Executes dropped EXE 4 IoCs

Processes:

installer_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exe

pid process

4128 installer_24.2540_win64.exe
5772 installer_24.2540_win64.exe
6128 installer_24.2540_win64.exe
1404 installer_24.2540_win64.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 8 IoCs

Processes:

installer_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exemore.commore.commore.commore.com

description	pid	process	target process
PID 4128 set thread context of 1592	4128	installer_24.2540_win64.exe	more.com
PID 5772 set thread context of 6040	5772	installer_24.2540_win64.exe	more.com
PID 6128 set thread context of 5324	6128	installer_24.2540_win64.exe	more.com
PID 1404 set thread context of 5496	1404	installer_24.2540_win64.exe	more.com
PID 1592 set thread context of 2296	1592	more.com	MSBuild.exe
PID 6040 set thread context of 3756	6040	more.com	MSBuild.exe
PID 5324 set thread context of 2688	5324	more.com	MSBuild.exe
PID 5496 set thread context of 5744	5496	more.com	MSBuild.exe

Drops file in Windows directory 1 IoCs

Processes:

more.com

description ioc process

File created C:\Windows\Tasks\Hat Updater Windows.job more.com

description	ioc	process
File created	C:\Windows\Tasks\Hat Updater Windows.job	more.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 346589.crdownload:SmartScreen msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 346589.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exemore.commore.cominstaller_24.2540_win64.exemore.commore.comMSBuild.exe

pid	process
3688	msedge.exe
3688	msedge.exe
3944	msedge.exe
3944	msedge.exe
4468	identity_helper.exe
4468	identity_helper.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5396	msedge.exe
5136	msedge.exe
5136	msedge.exe
4128	installer_24.2540_win64.exe
4128	installer_24.2540_win64.exe
5772	installer_24.2540_win64.exe
5772	installer_24.2540_win64.exe
6128	installer_24.2540_win64.exe
1592	more.com
1592	more.com
1592	more.com
1592	more.com
6128	installer_24.2540_win64.exe
6128	installer_24.2540_win64.exe
6040	more.com
6040	more.com
6040	more.com
6040	more.com
1404	installer_24.2540_win64.exe
1404	installer_24.2540_win64.exe
1404	installer_24.2540_win64.exe
5324	more.com
5324	more.com
5324	more.com
5324	more.com
5496	more.com
5496	more.com
5496	more.com
5496	more.com
3756	MSBuild.exe
3756	MSBuild.exe
3756	MSBuild.exe
3756	MSBuild.exe

Suspicious behavior: MapViewOfSection 12 IoCs

Processes:

installer_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exemore.commore.commore.commore.com

pid	process
4128	installer_24.2540_win64.exe
5772	installer_24.2540_win64.exe
6128	installer_24.2540_win64.exe
1404	installer_24.2540_win64.exe
1592	more.com
1592	more.com
6040	more.com
6040	more.com
5324	more.com
5324	more.com
5496	more.com
5496	more.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3944 msedge.exe
3944 msedge.exe
3944 msedge.exe
3944 msedge.exe
3944 msedge.exe
3944 msedge.exe
3944 msedge.exe
3944 msedge.exe
3944 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 3756 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3756	MSBuild.exe

Suspicious use of FindShellTrayWindow 52 IoCs

Processes:

msedge.exe

pid	process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

installer_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exeMSBuild.exe

pid	process
4128	installer_24.2540_win64.exe
5772	installer_24.2540_win64.exe
6128	installer_24.2540_win64.exe
1404	installer_24.2540_win64.exe
3756	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3944 wrote to memory of 1596	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 1596	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 948	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3688	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3688	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe
PID 3944 wrote to memory of 3284	3944	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://macrium.org
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b894718
2⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
2⤵
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
2⤵
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
2⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
2⤵
PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
2⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
2⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
2⤵
PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
2⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
2⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
2⤵
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2456 /prefetch:8
2⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4696 /prefetch:8
2⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,2418637174342304049,12085005117215630734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5136

C:\Users\Admin\Downloads\installer_24.2540_win64.exe
"C:\Users\Admin\Downloads\installer_24.2540_win64.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4128

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
3⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
4⤵
PID:2296

C:\Users\Admin\Downloads\installer_24.2540_win64.exe
"C:\Users\Admin\Downloads\installer_24.2540_win64.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5772

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:6040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3756

C:\Users\Admin\Downloads\installer_24.2540_win64.exe
"C:\Users\Admin\Downloads\installer_24.2540_win64.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:6128

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
4⤵
PID:2688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:696

C:\Users\Admin\Downloads\installer_24.2540_win64.exe
"C:\Users\Admin\Downloads\installer_24.2540_win64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1404

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:5744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
Filesize
410B

MD5
275175f1474aafb1419e21cc70edb06b

SHA1
27dc18b39f8ef582ec66e91f43ab29395204a60e

SHA256
269b79f9fb5db8cc7b085b7ed1c7bf71c6e9aba106e6dd1581d2f89b0709713a

SHA512
1335c7ebffb2131dbf8f5d510201f374d6df6d19aee2629d27a4feed13f7714ce35b81bedbe5796b0c7a4f863663e8ea51209b70b07df5c91508a15cf647fa79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
432B

MD5
fcda916582d237522884b777f744afb6

SHA1
e7c6537d081ca499e916524e019cfa93c9eac446

SHA256
5a36c3be3238dca0dd868c7f7bf762b24191050aadc4aef0b27b97e1f31cb8e8

SHA512
88aaf940b4a8803c1b23408e15a93a1814339f37667c33b18d9438a650b9f16dfb65e504b9221d212135a33b2c3ffe4732b6ff2a89f1608ad004cf5805897b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
20KB

MD5
757215a28985459083244781c8cce2f5

SHA1
9b4b17498a4c7afb27409debf86b56e5b9263bfa

SHA256
e8990587c71e8a43d52aaf49bb303553baf85002249a0853af8cca6e5ffdc67d

SHA512
313c5abefc2d1d6df17639f42d5364a10b9cde33dfb3bad67d7dafd23767f47f3d0a892f3b0f8dfdf508be4c3a75cdf459dbc3b76cd010eae978ad5848d47118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
750B

MD5
1bbc5df9e9eebf64a3a1dd22198f8732

SHA1
e8b5bf8c22cfa29d546f81c915bf6c151a0ca5c7

SHA256
03380cfbf14e918a53872fbe0f29c2d1fea2cf128b2bd2cf998f2493b686d43a

SHA512
48dd4ac2da98cb11305002ca48d78e122e80f802cee46c68bcd0ca72414a8790be814f461f685ffe78f60a11fb7d2f5b202ed3f571b02f6c23ffa4309192d964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
08610ea4337281d7996a0b8d00346ef7

SHA1
1c2165bb9ecb0415fb8c13cdd343be83f536546f

SHA256
8508b558f157e0b7859648641c74b8147173f590f05abdad2cbad35cd49f4523

SHA512
8c535e565a06c683f379cea44f68be7661b045ad808201306c7d1272601515f1f93b9e6462cc172319901273f384801637f02b775554ac73de9a438c08d9d952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
27da8a70fcfe2a3d3b26ef8a9d1339fb

SHA1
6d6a5ca41d5ec675c7140f50721189cf575f7716

SHA256
aa75b09d1c1e0bc6cc508211603b8a4bc79ea9071301326bc1a110bfa1e1499a

SHA512
989215ba6142a0217d5a3e4cbd8c797328b610f35db785f52d3d80c3b5f7b43f14cf3ba60c66be14f6e5f8baec10cc37016fd0fcc15738763f806a9810423ae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8c0e604aa1e89e0d9cf152e1e4b2450a

SHA1
c09be15c339697fc48adcfdbdab9c34e4fad4898

SHA256
69168d10fd8a42ff0627c935879ab20ddfc8fa6a640fe509223318079a58b295

SHA512
2add99d4ae615b317ab02aed051197c67250643e9f5e0099208720cca2659b0f8f2197df9fed0b1e6b087c597abff0cd8fccb31a795c2e578312676e4bc97018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
eb9c91de0bf353ea70b5d4f6334fe8ba

SHA1
23d340618aebca24d16983aedeefd8e5479b1eaf

SHA256
894369865a66c5692d324567c3919429fff3b0f5b2f45861e85f5ed1ca7e6b9e

SHA512
3e6577cc5adcf0aa514964bd83af2c12cd52c1cb4d02f6439e36d46b6bbd6578fea35294ac20a7d2da1d24848230c069fbe7291ca922693f8bb507dcde802e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
92fb2651b0eb112d3109b8833d6153fc

SHA1
3e7a928476a0d6fafd9b046bcf02f570b4224588

SHA256
6896dc4043946551e51fda9d7fbb410ee8b485f013e87322a7f6cfc4842df5a4

SHA512
e5e0c941787b468d9f99743a4bbb0cfa0972d01971cd07d8eebf2ffb1d3d62a3d6177bbbf021946f059782e360e58d66bf5cd116f7c9614b5ac1f95faabf2873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
af24eaec53cff953c755b057e026d438

SHA1
fd6b9e550895500746e6ac166556f21150418b63

SHA256
ee105de5d0e18d5cc7fccdcaf1be70334f3a603d69ef6d9760dfd7034c42c309

SHA512
13ce4f0378a3fb824ac20ead6f8f027b9426008bf22d40c1e10faa8ff89d8d00f6ddb7e99bdd5b0088213c059222c35a70f2e8b77fbba707dc0e574b16644e80

Download Submit
C:\Users\Admin\AppData\Local\Temp\eda74a94
Filesize
1.5MB

MD5
18d15263cc4456271abb2bb5df0cab7a

SHA1
33438bfb32a8ce23a6d1a95d5afec63aa82ed602

SHA256
43947b0670f3a5c78448281d38d11aba76f83df37fd02ad86d296def2026b9db

SHA512
dd2154b226a62d8e0e5edf3d9d0b88062ec0322b40f04630e62fbf9671e33f433d574fec2fc751c6c065c58e179be6ba29aabf339d651586e36327e7d415da57

Download Submit
C:\Users\Admin\AppData\Local\Temp\efaca00d
Filesize
1.4MB

MD5
380f181f724df6f65cf097c6ae6d9b09

SHA1
714b54c59c7c43cabe064da09b67ff09f55ce769

SHA256
4b43e71bcef933eb5d60ec0825013709ba6e6f37c12b822625dcb9cfea0ba27d

SHA512
335a5850de0514dddf8c0fc42140bb38bae51c091be07b6384e3cc85eb7fcc6e2517e4a2fce0f1100649a778e3caf4b24f0dddcba64eb6276af94c1036b9ac32

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5061.tmp
Filesize
20KB

MD5
42c395b8db48b6ce3d34c301d1eba9d5

SHA1
b7cfa3de344814bec105391663c0df4a74310996

SHA256
5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

SHA512
7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 346589.crdownload
Filesize
18.9MB

MD5
a7abd1318ebbde7a1511c5af820050d1

SHA1
862d536c2d29e8e3f205408db013c530ab184d32

SHA256
d6ee3ff38c0aabee38c4243c82bbd4a3e094c1bb33b4ff69699b8e4fa0f5f0e2

SHA512
14234bed49fcbe5a722c6d69a97f9ebe87fdacd715324b40c2bea12af33a5d1d119015bf1a0675f720b0173f942407eb5e829f2cb6a7fee2282b504cba5d2e91

Download Submit
C:\Windows\Tasks\Hat Updater Windows.job
Filesize
302B

MD5
6c46db4b6e76aa78d08ede4a8afcc2e6

SHA1
6646c74a4668f4535bf96e3a85ea29c59e2ede0b

SHA256
b3d45088ee90952737dda9eefd39e1070718f29561a934ca0f0767b095617980

SHA512
fe300cc108fc40d113cbb0f00767e791d376c71302d02cd50ef0deab4f13183ab0419ab44dc2b16b47d397684e11b574c081246212cd2e6f75fb5fe1675f796b

Download Submit
\??\pipe\LOCAL\crashpad_3944_WREVMKPREAYUHBNJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1404-311-0x0000000001000000-0x0000000001543000-memory.dmp

Filesize
5.3MB

Download
memory/1404-338-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/1404-323-0x00007FFC9A530000-0x00007FFC9A725000-memory.dmp

Filesize
2.0MB

Download
memory/1404-322-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/1592-292-0x00007FFC9A530000-0x00007FFC9A725000-memory.dmp

Filesize
2.0MB

Download
memory/1592-305-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/1592-342-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/2296-346-0x0000000073750000-0x00000000749A4000-memory.dmp

Filesize
18.3MB

Download
memory/2688-370-0x0000000073750000-0x00000000749A4000-memory.dmp

Filesize
18.3MB

Download
memory/3756-363-0x0000000005310000-0x0000000005360000-memory.dmp

Filesize
320KB

Download
memory/3756-392-0x0000000007DD0000-0x0000000007DDA000-memory.dmp

Filesize
40KB

Download
memory/3756-400-0x00000000053D0000-0x00000000053E2000-memory.dmp

Filesize
72KB

Download
memory/3756-364-0x0000000005190000-0x000000000519A000-memory.dmp

Filesize
40KB

Download
memory/3756-360-0x0000000005830000-0x0000000005DD4000-memory.dmp

Filesize
5.6MB

Download
memory/3756-401-0x0000000005430000-0x000000000546C000-memory.dmp

Filesize
240KB

Download
memory/3756-362-0x0000000005280000-0x00000000052F6000-memory.dmp

Filesize
472KB

Download
memory/3756-367-0x0000000006010000-0x0000000006076000-memory.dmp

Filesize
408KB

Download
memory/3756-365-0x0000000006410000-0x000000000693C000-memory.dmp

Filesize
5.2MB

Download
memory/3756-361-0x0000000005540000-0x0000000005702000-memory.dmp

Filesize
1.8MB

Download
memory/3756-366-0x0000000005F20000-0x0000000005F3E000-memory.dmp

Filesize
120KB

Download
memory/3756-354-0x0000000073750000-0x00000000749A4000-memory.dmp

Filesize
18.3MB

Download
memory/3756-358-0x0000000000C00000-0x0000000000CC6000-memory.dmp

Filesize
792KB

Download
memory/3756-359-0x00000000051E0000-0x0000000005272000-memory.dmp

Filesize
584KB

Download
memory/4128-251-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/4128-245-0x0000000000650000-0x0000000000B93000-memory.dmp

Filesize
5.3MB

Download
memory/4128-252-0x00007FFC9A530000-0x00007FFC9A725000-memory.dmp

Filesize
2.0MB

Download
memory/4128-273-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/5324-324-0x00007FFC9A530000-0x00007FFC9A725000-memory.dmp

Filesize
2.0MB

Download
memory/5496-344-0x00007FFC9A530000-0x00007FFC9A725000-memory.dmp

Filesize
2.0MB

Download
memory/5744-397-0x0000000073750000-0x00000000749A4000-memory.dmp

Filesize
18.3MB

Download
memory/5772-272-0x0000000000650000-0x0000000000B93000-memory.dmp

Filesize
5.3MB

Download
memory/5772-296-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/5772-283-0x00007FFC9A530000-0x00007FFC9A725000-memory.dmp

Filesize
2.0MB

Download
memory/5772-282-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/6040-304-0x00007FFC9A530000-0x00007FFC9A725000-memory.dmp

Filesize
2.0MB

Download
memory/6128-300-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/6128-285-0x0000000000650000-0x0000000000B93000-memory.dmp

Filesize
5.3MB

Download
memory/6128-294-0x0000000074BD0000-0x0000000074D4B000-memory.dmp

Filesize
1.5MB

Download
memory/6128-295-0x00007FFC9A530000-0x00007FFC9A725000-memory.dmp

Filesize
2.0MB

Download