sectoprat | hxxp://macrium[.]org

Analysis

max time kernel
420s
max time network
421s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://macrium.org

Score

10^/10

sectoprat rat spyware trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5052-305-0x0000000001400000-0x00000000014C6000-memory.dmp	family_sectoprat

Executes dropped EXE 4 IoCs

Processes:

installer_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exe

pid process

4900 installer_24.2540_win64.exe
2412 installer_24.2540_win64.exe
1984 installer_24.2540_win64.exe
3272 installer_24.2540_win64.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 8 IoCs

Processes:

installer_24.2540_win64.exemore.cominstaller_24.2540_win64.exeinstaller_24.2540_win64.exemore.cominstaller_24.2540_win64.exemore.commore.com

description	pid	process	target process
PID 4900 set thread context of 4740	4900	installer_24.2540_win64.exe	more.com
PID 4740 set thread context of 5052	4740	more.com	MSBuild.exe
PID 2412 set thread context of 3776	2412	installer_24.2540_win64.exe	more.com
PID 1984 set thread context of 1520	1984	installer_24.2540_win64.exe	more.com
PID 3776 set thread context of 1028	3776	more.com	MSBuild.exe
PID 3272 set thread context of 4668	3272	installer_24.2540_win64.exe	more.com
PID 1520 set thread context of 4536	1520	more.com	MSBuild.exe
PID 4668 set thread context of 1344	4668	more.com	MSBuild.exe

Drops file in Windows directory 1 IoCs

Processes:

more.com

description ioc process

File created C:\Windows\Tasks\Hat Updater Windows.job more.com

description	ioc	process
File created	C:\Windows\Tasks\Hat Updater Windows.job	more.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\installer_24.2540_win64.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 451177.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeinstaller_24.2540_win64.exemore.comMSBuild.exeinstaller_24.2540_win64.exemore.cominstaller_24.2540_win64.exemore.cominstaller_24.2540_win64.exemore.cominstaller_24.2540_win64.exe

pid	process
1852	msedge.exe
1852	msedge.exe
1392	msedge.exe
1392	msedge.exe
2592	identity_helper.exe
2592	identity_helper.exe
1656	msedge.exe
1656	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
1496	msedge.exe
1496	msedge.exe
4900	installer_24.2540_win64.exe
4900	installer_24.2540_win64.exe
4740	more.com
4740	more.com
5052	MSBuild.exe
5052	MSBuild.exe
5052	MSBuild.exe
2412	installer_24.2540_win64.exe
2412	installer_24.2540_win64.exe
3776	more.com
3776	more.com
1984	installer_24.2540_win64.exe
1984	installer_24.2540_win64.exe
1520	more.com
1520	more.com
3272	installer_24.2540_win64.exe
3272	installer_24.2540_win64.exe
4668	more.com
4668	more.com
2684	installer_24.2540_win64.exe
2684	installer_24.2540_win64.exe

Suspicious behavior: MapViewOfSection 12 IoCs

Processes:

installer_24.2540_win64.exemore.cominstaller_24.2540_win64.exeinstaller_24.2540_win64.exemore.cominstaller_24.2540_win64.exemore.commore.com

pid	process
4900	installer_24.2540_win64.exe
4740	more.com
4740	more.com
2412	installer_24.2540_win64.exe
1984	installer_24.2540_win64.exe
3776	more.com
3776	more.com
3272	installer_24.2540_win64.exe
1520	more.com
1520	more.com
4668	more.com
4668	more.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
1392 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 5052 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	5052	MSBuild.exe

Suspicious use of FindShellTrayWindow 45 IoCs

Processes:

msedge.exe

pid	process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

installer_24.2540_win64.exeMSBuild.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exeinstaller_24.2540_win64.exe

pid	process
4900	installer_24.2540_win64.exe
5052	MSBuild.exe
2412	installer_24.2540_win64.exe
1984	installer_24.2540_win64.exe
3272	installer_24.2540_win64.exe
2684	installer_24.2540_win64.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1392 wrote to memory of 1140	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1140	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 2400	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1852	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1852	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 4408	1392	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://macrium.org
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb336a3cb8,0x7ffb336a3cc8,0x7ffb336a3cd8
2⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
2⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
2⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
2⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
2⤵
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
2⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4752 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
2⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 /prefetch:8
2⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,14420331523203933424,17137796572969250539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1496

C:\Users\Admin\Downloads\installer_24.2540_win64.exe
"C:\Users\Admin\Downloads\installer_24.2540_win64.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
3⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4184

C:\Users\Admin\Downloads\installer_24.2540_win64.exe
"C:\Users\Admin\Downloads\installer_24.2540_win64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2412

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:1028

C:\Users\Admin\Downloads\installer_24.2540_win64.exe
"C:\Users\Admin\Downloads\installer_24.2540_win64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:4536

C:\Users\Admin\Downloads\installer_24.2540_win64.exe
"C:\Users\Admin\Downloads\installer_24.2540_win64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3272

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
3⤵
PID:1344

C:\Users\Admin\AppData\Roaming\Monfm\installer_24.2540_win64.exe
C:\Users\Admin\AppData\Roaming\Monfm\installer_24.2540_win64.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2684

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
PID:3692

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
Filesize
410B

MD5
595b2b7794a0b04788c75aa8f0076a58

SHA1
ba783556d6bd69f69adf72e02b28be49eda4161f

SHA256
bc4bad840727fda53dc12d08840e47bfc0583be9bb1d512af15ccbc48790ce2e

SHA512
aaec254c32eed006381c75cdb9a559a82b5ff6b852aab10f2a84f0c54b44b24aaea74c29a0e8228425b9e8226b676c9a008ba4639a99c7ae78adcdf058ffd3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1e4ed4a50489e7fc6c3ce17686a7cd94

SHA1
eac4e98e46efc880605a23a632e68e2c778613e7

SHA256
fc9e8224722cb738d8b32420c05006de87161e1d28bc729b451759096f436c1a

SHA512
5c4e637ac4da37ba133cb1fba8fa2ff3e24fc4ca15433a94868f2b6e0259705634072e5563da5f7cf1fd783fa8fa0c584c00f319f486565315e87cdea8ed1c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8ff8bdd04a2da5ef5d4b6a687da23156

SHA1
247873c114f3cc780c3adb0f844fc0bb2b440b6d

SHA256
09b7b20bfec9608a6d737ef3fa03f95dcbeaca0f25953503a321acac82a5e5ae

SHA512
5633ad84b5a003cd151c4c24b67c1e5de965fdb206b433ca759d9c62a4785383507cbd5aca92089f6e0a50a518c6014bf09a0972b4311464aa6a26f76648345e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
432B

MD5
970c1c7af3038409cc21954ea5d747c1

SHA1
0c121a8c05b3ea806013777289386f3ec1778ffe

SHA256
70756a34e8b1d00ab22faddfb6545bd2456e0c248e98f06f5818ee2717869647

SHA512
3f9c0abceb8c255a14453f2358144be510107cd190d2a37ce9144193a70acd5d5d63641332a894a62644b6f101958a219fce2b81056bc7e7d53a5f0a96552cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
20KB

MD5
1940a3e36bd036408df4edabd6cdab94

SHA1
428b87d14826233edd2f0647c8589693085d547a

SHA256
8aafaa39cc792cbb02fcba81dd465acf7ea7ff903d5e67f823825bfb7f1bec18

SHA512
2287df9efa3bb8d3c13b89e5769677ecf6c057664ebac6fdce3e6c8f3f14c163c27b9c5f4255b05134ad070381ee3ae6497db33e0df7a8b1fd4b83355d1c274b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
750B

MD5
cdb99a060a654e0f349bdae87ab70ad1

SHA1
dc6f7de7705d00097091027d2c28d60bdf6ea6d0

SHA256
a01263726b3d9a114833c6187eb17f2dd7549a315f7ab118a8e6de4683997387

SHA512
cd3472f11e79ec80e7befc9d3c67715dffd36c2efde5ff7baf1d8f8a830c049905865d7e57acbd358a33afb4440c8d984e92dc91228a87580d3bae1ef96d8592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3c933cc10a962266ccc2bfecf496a06b

SHA1
7d201bef8a3c6a425e968276c57c8284df7ea474

SHA256
c6fc1a88bef977c01bc7bc8fc86cec542c5b64e5f855587c73551ff2662130ce

SHA512
54d8dcdd1920f5f30df69b69389c62a2b4453d636a1c05b3b4daba36c631b37625330fd518068a30d00d2d40cff2022fd683dbd58c1da30cb050db3ad7ccde77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5208db6a03e12663858375bc7164db12

SHA1
eef22a00dee5625c8c9e273ff7c1f5af422dd8d9

SHA256
dd7a9f8b80ef9d831b50d23a8072bfd5e9391c76c1d53afdd49647157e120726

SHA512
bb0b37dd45e8de321f5f01378ae1c333e5a9834006a8402b7a9402834a43bb48fd74f3de5f75c51eedcf41bf93056a7df9efc7ad704573d798dced980566e286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2acf60a93a9070fdf5a4ee03d5640750

SHA1
fc0775387fcccd122729dbbfaa3b88815aecab80

SHA256
6d1f93a7affd3e1bf8390e44658852ab58c047d79f74bd0504a15cc0670de515

SHA512
9b52725dc7dbc00453c6784ce41b05c753b7d47b13611864bf9ab54c1dce7e724a8fb12d34aa28c9935c023b04ef5d329769350778644deaefe53f7601189355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4eb3e0cd84ba256629e2e707160967d5

SHA1
99defef8964fd69361bae5ca2f56b904e0453116

SHA256
89158b396816cce6504cc352f6314f22a3142aec1023763a839a9bd47f334299

SHA512
c49faf85b8a6016429fb8d74dd1f1bb6ac2fe18adc2d4b7fadcff8609892e1a699592ad2c3a03d19547113bdfeaa1a2e3e0d1af099751d79ef9e9c8a63625d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9a24e9819a47bfd3e19a1e047886361a

SHA1
0915bc6dc73bc1195cfc407eaf86abec67a2f915

SHA256
33e70506a2300be9145825ede42b5887ea094264f4777a533938566813ec4323

SHA512
77de6050957e3777623d12f7b49add4e9cbd37b97cbddb9dd7929914a3b0a72cf70765b9a0f468c0d11df7661723973ca943cdb70730ce7d762c20281a224fdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
544152d5c15eb5ea05d0b1517bcfc594

SHA1
6171f3434d18791c1c8b9021590b0a3878bdc4fe

SHA256
7b662e93b5b8507577c8b82a350d204cff3f8d0b349ae32ae6108ef1aba7d507

SHA512
191c28dd0e64f80098df22ea3a2c77ae6c6bff899560747a797fa7ab030e485ac12e2c68f0924f3f791c908838ef3d5eb71222a08db04287f1a2a774f4064c19

Download Submit
C:\Users\Admin\AppData\Local\Temp\d19b4c48
Filesize
1.4MB

MD5
96b72c569407da193140fa1fe74d9614

SHA1
1fbd6e94c77b948917398f85ee0e37e91000a53f

SHA256
53f39bb0e90d2ec80ecae525cbb9a617be9e54a5dfd208f64842f650a95eef19

SHA512
83b1414c263dd0bb9af43173b8e802e6be0bace768f309273eb12ce9760df7b9601bd32e27ad6789ee9c3e57a146ea571a71ceffd0a5e12e63054de6c997fc59

Download Submit
C:\Users\Admin\AppData\Local\Temp\decd6d75
Filesize
1.5MB

MD5
18d15263cc4456271abb2bb5df0cab7a

SHA1
33438bfb32a8ce23a6d1a95d5afec63aa82ed602

SHA256
43947b0670f3a5c78448281d38d11aba76f83df37fd02ad86d296def2026b9db

SHA512
dd2154b226a62d8e0e5edf3d9d0b88062ec0322b40f04630e62fbf9671e33f433d574fec2fc751c6c065c58e179be6ba29aabf339d651586e36327e7d415da57

Download Submit
C:\Users\Admin\AppData\Local\Temp\e0a7c099
Filesize
1.4MB

MD5
580030cb12ce8bc99e970cfdb18c97d3

SHA1
6956222c74329beab0dce578451628602067a8a1

SHA256
6bf34b7d8b9ceeab5aeb389dbdc962784a137b4cee14007bcbef363d87489a8f

SHA512
816b53f14ab911156d7409f655bf4df6141c3fc810e2c6a2f8994392c8436d225b3f757edf2d09b479043546ce446cc1bc28cb0a06caba8c4211a29a8fb9d6bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB73D.tmp
Filesize
20KB

MD5
42c395b8db48b6ce3d34c301d1eba9d5

SHA1
b7cfa3de344814bec105391663c0df4a74310996

SHA256
5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

SHA512
7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 451177.crdownload
Filesize
18.9MB

MD5
a7abd1318ebbde7a1511c5af820050d1

SHA1
862d536c2d29e8e3f205408db013c530ab184d32

SHA256
d6ee3ff38c0aabee38c4243c82bbd4a3e094c1bb33b4ff69699b8e4fa0f5f0e2

SHA512
14234bed49fcbe5a722c6d69a97f9ebe87fdacd715324b40c2bea12af33a5d1d119015bf1a0675f720b0173f942407eb5e829f2cb6a7fee2282b504cba5d2e91

Download Submit
C:\Users\Admin\Downloads\installer_24.2540_win64.exe:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\Tasks\Hat Updater Windows.job
Filesize
302B

MD5
a8529627747c69c3a18b846c10186d7b

SHA1
5429bf8e62c81fa73dd0a913097f00be9a54918e

SHA256
beb9f4a2d5166e13b3c9e5de183ce8d01db20c5bcc5e8ea70c27916c6bdb8f9a

SHA512
9eb550fbb2c53bcca2a5f2a309067bdf44c47da386248b58e46fc1b59016d6e470511b73cdabfd8a0a8a6f7ac15a183c3a138ec5f2201f0df732da0997cb6664

Download Submit
\??\pipe\LOCAL\crashpad_1392_YSVMTGLDSDMCOGIY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1028-384-0x0000000072E40000-0x0000000074157000-memory.dmp

Filesize
19.1MB

Download
memory/1344-419-0x0000000072E40000-0x0000000074157000-memory.dmp

Filesize
19.1MB

Download
memory/1520-387-0x00007FFB42460000-0x00007FFB42669000-memory.dmp

Filesize
2.0MB

Download
memory/1984-379-0x000000006E860000-0x000000006E9DD000-memory.dmp

Filesize
1.5MB

Download
memory/1984-376-0x000000006E860000-0x000000006E9DD000-memory.dmp

Filesize
1.5MB

Download
memory/1984-377-0x00007FFB42460000-0x00007FFB42669000-memory.dmp

Filesize
2.0MB

Download
memory/1984-370-0x0000000000980000-0x0000000000EC3000-memory.dmp

Filesize
5.3MB

Download
memory/2412-351-0x0000000000F30000-0x0000000001473000-memory.dmp

Filesize
5.3MB

Download
memory/2412-357-0x000000006E860000-0x000000006E9DD000-memory.dmp

Filesize
1.5MB

Download
memory/2412-359-0x000000006E860000-0x000000006E9DD000-memory.dmp

Filesize
1.5MB

Download
memory/2412-358-0x00007FFB42460000-0x00007FFB42669000-memory.dmp

Filesize
2.0MB

Download
memory/2684-422-0x0000000000D20000-0x0000000001263000-memory.dmp

Filesize
5.3MB

Download
memory/2684-428-0x000000006E7C0000-0x000000006E93D000-memory.dmp

Filesize
1.5MB

Download
memory/2684-429-0x00007FFB42460000-0x00007FFB42669000-memory.dmp

Filesize
2.0MB

Download
memory/3272-401-0x00007FFB42460000-0x00007FFB42669000-memory.dmp

Filesize
2.0MB

Download
memory/3272-403-0x000000006E860000-0x000000006E9DD000-memory.dmp

Filesize
1.5MB

Download
memory/3272-400-0x000000006E860000-0x000000006E9DD000-memory.dmp

Filesize
1.5MB

Download
memory/3272-394-0x0000000000980000-0x0000000000EC3000-memory.dmp

Filesize
5.3MB

Download
memory/3776-378-0x000000006E860000-0x000000006E9DD000-memory.dmp

Filesize
1.5MB

Download
memory/3776-363-0x00007FFB42460000-0x00007FFB42669000-memory.dmp

Filesize
2.0MB

Download
memory/3776-364-0x000000006E860000-0x000000006E9DD000-memory.dmp

Filesize
1.5MB

Download
memory/4536-408-0x0000000072E40000-0x0000000074157000-memory.dmp

Filesize
19.1MB

Download
memory/4668-411-0x00007FFB42460000-0x00007FFB42669000-memory.dmp

Filesize
2.0MB

Download
memory/4740-300-0x0000000074380000-0x00000000744FD000-memory.dmp

Filesize
1.5MB

Download
memory/4740-294-0x00007FFB42460000-0x00007FFB42669000-memory.dmp

Filesize
2.0MB

Download
memory/4740-295-0x0000000074380000-0x00000000744FD000-memory.dmp

Filesize
1.5MB

Download
memory/4900-273-0x0000000000F80000-0x00000000014C3000-memory.dmp

Filesize
5.3MB

Download
memory/4900-290-0x0000000074380000-0x00000000744FD000-memory.dmp

Filesize
1.5MB

Download
memory/4900-279-0x0000000074380000-0x00000000744FD000-memory.dmp

Filesize
1.5MB

Download
memory/4900-280-0x00007FFB42460000-0x00007FFB42669000-memory.dmp

Filesize
2.0MB

Download
memory/5052-310-0x0000000005BB0000-0x0000000005C00000-memory.dmp

Filesize
320KB

Download
memory/5052-307-0x00000000060E0000-0x0000000006686000-memory.dmp

Filesize
5.6MB

Download
memory/5052-312-0x0000000006CC0000-0x00000000071EC000-memory.dmp

Filesize
5.2MB

Download
memory/5052-311-0x0000000005A20000-0x0000000005A2A000-memory.dmp

Filesize
40KB

Download
memory/5052-309-0x0000000005B30000-0x0000000005BA6000-memory.dmp

Filesize
472KB

Download
memory/5052-337-0x0000000005D00000-0x0000000005D3C000-memory.dmp

Filesize
240KB

Download
memory/5052-308-0x0000000005E60000-0x0000000006022000-memory.dmp

Filesize
1.8MB

Download
memory/5052-313-0x00000000067D0000-0x00000000067EE000-memory.dmp

Filesize
120KB

Download
memory/5052-306-0x0000000005A70000-0x0000000005B02000-memory.dmp

Filesize
584KB

Download
memory/5052-305-0x0000000001400000-0x00000000014C6000-memory.dmp

Filesize
792KB

Download
memory/5052-302-0x0000000072E40000-0x0000000074157000-memory.dmp

Filesize
19.1MB

Download
memory/5052-314-0x00000000068A0000-0x0000000006906000-memory.dmp

Filesize
408KB

Download
memory/5052-334-0x00000000084A0000-0x00000000084AA000-memory.dmp

Filesize
40KB

Download
memory/5052-336-0x0000000005C60000-0x0000000005C72000-memory.dmp

Filesize
72KB

Download