32ac64aad1c7b86f24b34ac815314b5ce085b698a8c07ca35a35b5b6e06ac935

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ST_External_Loader.exe
Size

19.8MB
MD5

9db1a30398521441b138523142a497c3
SHA1

aa69bfad573aad9db5a7a626730dbe0b62455097
SHA256

32ac64aad1c7b86f24b34ac815314b5ce085b698a8c07ca35a35b5b6e06ac935
SHA512

2221440d675514fe5061da9dc2b3e3e47dec6240da31d36166b4bd946da7bd03871fbcb6c734777afc7cd22272a8cbdbf13ef929c98c22088190cfd5c06cf483
SSDEEP

393216:s3VgprYo2N1J8nXzrorjPB4I44aqJsLIAazsNSNUy:85J8Dro/PBMsVsgNUy

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\Taigei64.dll	ST_External_Loader.exe
File created	C:\Windows\SysWOW64\drivers\drv64.dll	ST_External_Loader.exe
File created	C:\Windows\SysWOW64\drivers\vgc.sys	ST_External_Loader.exe
File created	C:\Windows\SysWOW64\drivers\vgk.exe	ST_External_Loader.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\OkGosFqwySQulIBxhb\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\OkGosFqwySQulIBxhb"	vgk.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	ST_External_Loader.exe

Executes dropped EXE 1 IoCs

pid	Process
1732	vgk.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	discord.com
22	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1668	ST_External_Loader.exe
1668	ST_External_Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3169499791-3545231813-3156325206-1000\{C978A02E-B0F9-4AD1-BE9C-F6BCE6BF5DE4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1668	ST_External_Loader.exe
1668	ST_External_Loader.exe
1784	msedge.exe
1784	msedge.exe
5084	msedge.exe
5084	msedge.exe
3744	msedge.exe
3744	msedge.exe
2712	msedge.exe
2712	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1732	vgk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1732	vgk.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 5084	1668	ST_External_Loader.exe	85
PID 1668 wrote to memory of 5084	1668	ST_External_Loader.exe	85
PID 5084 wrote to memory of 5004	5084	msedge.exe	86
PID 5084 wrote to memory of 5004	5084	msedge.exe	86
PID 1668 wrote to memory of 3748	1668	ST_External_Loader.exe	87
PID 1668 wrote to memory of 3748	1668	ST_External_Loader.exe	87
PID 3748 wrote to memory of 2132	3748	msedge.exe	88
PID 3748 wrote to memory of 2132	3748	msedge.exe	88
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 4592	5084	msedge.exe	89
PID 5084 wrote to memory of 1784	5084	msedge.exe	90
PID 5084 wrote to memory of 1784	5084	msedge.exe	90
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91
PID 5084 wrote to memory of 3044	5084	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\ST_External_Loader.exe
"C:\Users\Admin\AppData\Local\Temp\ST_External_Loader.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/staffbesting
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3c2346f8,0x7fff3c234708,0x7fff3c234718
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3980 /prefetch:8
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1167095871601467007,14992711270275965076,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6252 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.staffbesting.store/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3c2346f8,0x7fff3c234708,0x7fff3c234718
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,12653805755213167303,3082213340048473851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,12653805755213167303,3082213340048473851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3744
- C:\Windows\SysWOW64\drivers\vgk.exe
  "C:\Windows\SysWOW64\drivers\vgk.exe" -map C:\Windows\SysWOW64\drivers\vgc.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
46KB

MD5
365e6cacd993aeff945e88baceb2f327

SHA1
46b1169f2e2c61c576e72a5288233f9ff5b0ed2b

SHA256
0f82a04bbfd4a4bf5f3d302fc32f39bbc2ed655ecb7430f32828d0e4814da511

SHA512
65cf29383b299f54561f354b65cfb2e412a49d9a009dace0197962fa0d5a86eade5bc1c08789e6f4d271bcb3d97064b3cfaf540ad183baa5c462ffb8d7cf6769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
32KB

MD5
d46476a43a9b8817f265aa94dd2e4d1d

SHA1
a5d0aca7ad4bcd2a6dfd383493fc5092b37ed8b6

SHA256
de4f98832d29fa3061aac8a94163b645232e794af76bfde78b1daf4fb90c4aac

SHA512
29719a4fd78898ee2c73cca586a2e1d3ebe6514085bf79e608d2154ccea135b7fa0eebbae9dbab7b55aac97670f1c9ae3a1b6df8f0277d7379bb92ed656a0983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ed26be0cfc722b4d0fa3fbbff1f7752a

SHA1
eaf1237012f8d077c0596af5bae14fd437e3977c

SHA256
736c2331faa621e3a65fce1ce8abe100b99ad01a73851efa0916c8aa0775c6a1

SHA512
23a3dd096f91c3f0b44155403ed830d19a9d30f553dc0abeb9253447fd6df67a44b9c2f7dc02213523a9c8448b8306a55a55b06af109929a51f3ab1893abc0df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2b07016aabfd2569d3547bd9dbab5947

SHA1
ae322c893d7e5b4e05f858327c1777e81e00a4ce

SHA256
bc81c7ce09c43bdf068170c7fb83085acaf49b9e1697d44d7e20a1e8946fcad5

SHA512
36e2b1fbf34ab5db20f60a0bddfe6b654ddd589a453ae18943661085a03162a58d8c2df177ca5134a4d45237d7aa59a974f42df969cf1566502e35011ecac0cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ea846b8e9615c8ae930899e32a7b49b9

SHA1
710a166a71abae13373050908056710b2ee4c456

SHA256
da88cd8bc8ecb201937f2a862e995a878fe1df40ed9289e7583469cb953f297c

SHA512
66c6f03f808c498fcf491b22834f894fb312aed8fc8aff3844417e153a632911da6a4146ac73be79e5ebc12bdac12e68dba6933bd7b09109950ac7799f644d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4b2823b9708b69d0a542733251cb6c16

SHA1
ebf582638118a7a45df39d1381e8d0939c661ee3

SHA256
7b92aa83731cccf3a93dc30c9e6509797eb5117a406f57ccf992aa4430c9aec3

SHA512
6e39f0bc3276db3e1746317db576d7931b11214213cbef057995b1b1bff3ac61c0b7746cd3977caacfc46dfae58aeee549982c89a07db2cb4d982248e871eef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41fadbcef4ecc8f552eff6cf976e7480

SHA1
8166ba5bd3246059598689de0cd13f30093f2a67

SHA256
6d05bdd7b47584fe38569f19b8b7d5c1d8794cc9c16af15def5101ac11adffd6

SHA512
662b3f7ae6ff6e4ec72702e24a73ab6938355bf4cf976c7681c029e990d1c85e8e1e91c3da5089b2559e13da8c55be149c0b0f67abc5ef836ebeb75cf50b28ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b60f86418e3da60a1ebdd720bff78181

SHA1
92c5bd348393d7f8b8f80be4ec69acd8d7c00472

SHA256
8ef20274eef10f162dd687251d379af5e8bb9234840f59ef88fcd1518207b14a

SHA512
e63b7c6e26bbc758472e303559406559ef6acf91feca0c93a81a9f77ea2a2bcc77a3a52fb9f23f8860ac1866ea30e9b7daf23a3d3e821d5b1c488c313c57e066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f781820a9b0554ddbc5f2668c974c5d4

SHA1
b96299562edeb782d19cd41ed5a24ea8e642beca

SHA256
a97f249dd428f8b9aff340335ba7ba03438d7cc26bd078c54487c1771ce97f03

SHA512
58fedb14f81333d6fc78a3745c93ba71afa47a045dc8b89b4d3cd55740c0e4f51826d41d79bd726fc09ef2e84898749584280b557afcbc7f35f8ae73f14a9d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d88d.TMP

Filesize
1KB

MD5
3ffe38344fca3286b8b933e71085b263

SHA1
1b45d457e3322743a7a0e50a993fb7397d92f34c

SHA256
d925f2c136f18ffb94425864e019374472b324a70103cadce59c83b366251cf4

SHA512
d0bca658daf0073a1cf0a9bb916c278df2c9510b90a3490978be25892a6761cb34dcad08e9ca8753885ca7b20b695fe6ee7a3091aa44149a62e499d71f313cc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a5b834cc606b7a2fe58191da3132ade7

SHA1
dc6ebc33a3403433fe3aef73ba1d8dffe8b748f6

SHA256
0c5a07550950d1f58740b6d681eb25113f930b5457acdb84a1a8e6f955fd0c27

SHA512
a1500c3884d03e91ebcf566c2dddc0af3a0c90f71d29d058a9bc8eaf5a88b022e4c19b5de4ab3b8da4dd941946df51a2ca22b7691b8ba06ebbacf0d704f2197c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b79e8d3f1718ca12530d0571e693d92

SHA1
ccff22f5b31e476cff43eb0707aa4f2f17424adc

SHA256
c4bfb7349c73a444befaae68a13a50ba56b88f468d8f853f3da2f4eb8737f5f3

SHA512
f1139f032d3aa120077f2e6e8109f87b6e4b6fd5d2522c8200b911dab824677791d98d53d7d0cad63de9dd1e94034306838409a57df0066d08276a8d64a248c7

Download Submit
C:\Windows\SysWOW64\drivers\vgk.exe

Filesize
134KB

MD5
34cfbe3ff70461820ccc31a1afeec0b3

SHA1
5d32e91c039c9a6f723ba3c04c1179d02e6a0ce9

SHA256
6ebcc6896b243c761da4fc28a26249b0c146ae17aff7697c09bc447008e831df

SHA512
1ca4661be645e7e954d89c83f1fd126a5e936533052d4e330c9faccb83bb5942d28265375cee743e468b1625a0c1f10888e7957fe88c718e8501a86a78cdc06e

Download Submit
memory/1668-281-0x00007FF72CA75000-0x00007FF72D560000-memory.dmp

Filesize
10.9MB

Download
memory/1668-288-0x00007FF72C890000-0x00007FF72E922000-memory.dmp

Filesize
32.6MB

Download
memory/1668-0-0x00007FF72CA75000-0x00007FF72D560000-memory.dmp

Filesize
10.9MB

Download
memory/1668-7-0x00007FF72C890000-0x00007FF72E922000-memory.dmp

Filesize
32.6MB

Download
memory/1668-3-0x00007FF72C890000-0x00007FF72E922000-memory.dmp

Filesize
32.6MB

Download
memory/1668-6-0x00007FF72C890000-0x00007FF72E922000-memory.dmp

Filesize
32.6MB

Download
memory/1668-2-0x00007FFF4AFC0000-0x00007FFF4AFC2000-memory.dmp

Filesize
8KB

Download
memory/1668-1-0x00007FFF4AFB0000-0x00007FFF4AFB2000-memory.dmp

Filesize
8KB

Download