discordrat | hxxps://cdn[.]discordapp[.]com/attachments/1254334525543288915/1254336947875217519/solarabootstraper[.]exe?ex=667bc2d0&is=667a7150&hm=9e37d9feda8ac823db279851a858c2d999a629b641924f99d34c335af2ab7d6e&

Analysis

max time kernel
121s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
25-06-2024 16:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1254334525543288915/1254336947875217519/solarabootstraper.exe?ex=667bc2d0&is=667a7150&hm=9e37d9feda8ac823db279851a858c2d999a629b641924f99d34c335af2ab7d6e&

Score

10^/10

discordrat persistence ransomware rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzOTEzMTk4MTc4NzI5OTkxMg.G2PouQ.rmLVRC29c13dyUDlcJhFL4MtNpJCMM3OTOmuyI
server_id
1254334525543288912

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

solarabootstraper.exetest.exe

pid process

2424 solarabootstraper.exe
3256 test.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2424	solarabootstraper.exe
3256	test.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

Processes:

flow	ioc
19	discord.com
37	discord.com
41	discord.com
47	discord.com
2	raw.githubusercontent.com
12	discord.com
40	raw.githubusercontent.com
42	discord.com
45	discord.com
48	discord.com
21	discord.com
38	discord.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

test.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpFB05.tmp.png"	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\solarabootstraper.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 67606.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
4836	msedge.exe
4836	msedge.exe
1500	msedge.exe
1500	msedge.exe
4932	identity_helper.exe
4932	identity_helper.exe
4904	msedge.exe
4904	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid

4
4
4
4
4
656
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1500 msedge.exe
1500 msedge.exe
1500 msedge.exe
1500 msedge.exe
1500 msedge.exe
1500 msedge.exe
1500 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

test.exe

description pid process

Token: SeDebugPrivilege 3256 test.exe
Token: SeShutdownPrivilege 3256 test.exe

pid
4
4
4
4
4
656

description	pid	process
Token: SeDebugPrivilege	3256	test.exe
Token: SeShutdownPrivilege	3256	test.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

msedge.exe

pid	process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1500 wrote to memory of 2800	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2800	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1472	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 4836	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 4836	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2660	1500	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1254334525543288915/1254336947875217519/solarabootstraper.exe?ex=667bc2d0&is=667a7150&hm=9e37d9feda8ac823db279851a858c2d999a629b641924f99d34c335af2ab7d6e&
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x48,0x10c,0x7ff820c53cb8,0x7ff820c53cc8,0x7ff820c53cd8
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
2⤵
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
2⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
2⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
2⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
2⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5704 /prefetch:8
2⤵
PID:128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,7708646041541016059,1428019447106243560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:984

C:\Users\Admin\Downloads\solarabootstraper.exe
"C:\Users\Admin\Downloads\solarabootstraper.exe"
1⤵
- Executes dropped EXE
PID:2424

C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe"
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9a91b6dd57fc9c4880d34e9e7c6b760f

SHA1
77a09da6ef4343a8b232386e000cd2d6b9fc30a3

SHA256
0170297f0103d4e415653f86dedc31b0827580042f86862206fd3f6f135b543a

SHA512
9fc3b9be931b3edebc4a6809d62d805046bdceb4c27a7db21cfbbcb0e5e253ab529c54d64e465e60904a6ab3b83156e26b97f852c9526f46f037944f806a7f0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
bbfb66ff6f5e565ac00d12dbb0f4113d

SHA1
8ee31313329123750487278afb3192d106752f17

SHA256
165401ef4e6bbd51cb89d3f9e6dc13a50132669d5b0229c7db12f2ec3f605754

SHA512
8ea206daabc7895923f3df9798bfd96f459bf859c78f3e5640fad550678b5090539f2a1b590883cd9797efee999acccac16d499772f61f5390e91bcc44d60560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8f222cb3b714c3256a9e47ba2d0b98f2

SHA1
2721d9563658c196ca3a4c7cb55602e8380db064

SHA256
09a377ce317399b88f1a8a35b4513d938440680ea4be72a22f00a900293a986b

SHA512
3df10a7a10d6bd14187c5cb930486f3ca9ea1ea43980ffb6f3186659a2658c6f61c65fe4859b0e27ab6ce90cec3148635104b0b408415cdeb27abefacd2b9601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
09c5c5d422e34a5611e8bcf017e930c2

SHA1
c3ab49616feb70c18590f508843ffd122ae0b67b

SHA256
88bae11202ba31be365155dd4a93ca8a033aa518173d2881044c2c7f50074cc3

SHA512
460a4856b624dde4472cf51a1e000f777a0023286b3575eae16a4365b4d4fa6625e1f9b31c16c14b5147f463bacf86e87bdf2e6d23854e9a84191dd3e235d0d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2f7d8802ffa6a6c56f4bc77638c90cc2

SHA1
bffaf22795e100c069de5c8a782d72d3f6fb24af

SHA256
dd2fdaaea7ed0496f004ab2f3ce6904ce66ffaa9fb22885339b3060c86c69fe9

SHA512
395ad37b149b625754cde824df5377b1c8f0070a3c014a23dad45168475aaff0c7caa347f4cf024e2421115a859929ed758dd051f29e57ff959dc4ea9d473855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
165408f4d3e66e4d1a11d65f4aff94e6

SHA1
8977fddc4035ff76cefcc939c34434e896211311

SHA256
c4d7b6b60b5469c766966d19869b044cf09b4e2bddddcdf5d6a29c8370dd0cd4

SHA512
925dd7d144a08fe3f3b1a14aa72f09d5a23a6a262709519380513ac9cd0185ff78d13dfa392de5d0140f4e7be1748896378ab400db50f778d5c8cd85cd9a31fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
fad084bd7fce2ea50cb49139a9fb4235

SHA1
0b973d63465ced1dedf1d744675665370e365afb

SHA256
33453722b64b443a4ea111d1e9788218ee8dc17473bfe3072e5459de7aeebb10

SHA512
8c42d99c0040c1b1d61b407eb8fbf46a5d8f61eba7c9670ca8165c4c909dab08fc7465aedd527c576cbf1ac3a912aa107f53963308945f5b50549aa911437e13

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
Filesize
78KB

MD5
cd0398fb5a04ce43be2b1183e7dfad06

SHA1
e1e9ac1f1f2533f3bfec802cae2cbeeeac65c181

SHA256
c4fb94399b109d19585a03233be7663000aae8c7c7f8661ce744c59bfa8ced08

SHA512
50bfd2614078082fd83e43e61a36b086eae0fec2399fae5655c6442a474ffb7c25cabe43b4c484c85acc4fac72c2f2613dc00e85045242dfcdd91093519699bc

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 67606.crdownload
Filesize
497KB

MD5
48258af1b1134dffa388c6f2590325c3

SHA1
e2fa6a4351d7b358e6b20e9194b63b54751458d4

SHA256
d0452f63e207ead4ba0828fba9cd46d54c08906ac3f35f1c0b27dda2d60fbc83

SHA512
1eeceefb8843f72b55e1b517039ab53cd72af3bb294fe9b06ce0a6207749506bf299cd913a4a1088ffa002069821d346ec3fc045fa701014110beec03d7d208c

Download Submit
C:\Users\Admin\Downloads\solarabootstraper.exe:Zone.Identifier
Filesize
229B

MD5
d1a3dba820e810bf857af29be2174171

SHA1
1c14f3fb4d2f99de64385f405a768cba12bd6993

SHA256
24b83d81b6ed1f53babbae3ac4af8e18dd376a5f1a2bdb1d4859d4cd2e2e5cc8

SHA512
e39d2d0ab8d6e3caed651b4ec7ff1d9754b452ad6b325e58fe3f8a73a8c9cc686385190153f5ca647880fcfeca57eeac4fae35c8b83a5fb5f71a941c2cfc162a

Download Submit
\??\pipe\LOCAL\crashpad_1500_ESHBZUOVYQMVOGER
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3256-92-0x0000019DA9270000-0x0000019DA9798000-memory.dmp

Filesize
5.2MB

Download
memory/3256-91-0x0000019DA8A70000-0x0000019DA8C32000-memory.dmp

Filesize
1.8MB

Download
memory/3256-90-0x0000019D8E300000-0x0000019D8E318000-memory.dmp

Filesize
96KB

Download
memory/3256-185-0x0000019DA8D40000-0x0000019DA900A000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads