hxxps://cdn[.]toontownrewritten[.]com/launcher/windows/TTRInstaller-v1[.]5[.]10[.]exe

Analysis

max time kernel
1680s
max time network
1684s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.toontownrewritten.com/launcher/windows/TTRInstaller-v1.5.10.exe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 115316.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
3152	msedge.exe
3152	msedge.exe
2016	identity_helper.exe
2016	identity_helper.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4504	3152	msedge.exe	81
PID 3152 wrote to memory of 4504	3152	msedge.exe	81
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4260	3152	msedge.exe	83
PID 3152 wrote to memory of 4804	3152	msedge.exe	84
PID 3152 wrote to memory of 4804	3152	msedge.exe	84
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85
PID 3152 wrote to memory of 4988	3152	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.toontownrewritten.com/launcher/windows/TTRInstaller-v1.5.10.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadfb446f8,0x7ffadfb44708,0x7ffadfb44718
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2208475146534243641,3874223940546454250,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
193B

MD5
b6234d4824355ec597bb4ae172062d45

SHA1
c7f44b45a7e0fbd795e9d87dbd909ccc30518835

SHA256
2ad09a16d31654c4889408db8bfbb1c5a1f13d9c62568903c1dfd127cdebdaa8

SHA512
337d32af3428d78fb0e1812f8a78842ac2891482357ba7d1a4b22d126c599bae70722a2a4f9ecc232adfe53bedfbb884e6d80759cb2490c0b91db9ae76f86dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5f10eba9468673bba839e453991c9e6

SHA1
cc52030397cacbd8785be2aebaae824e54f94088

SHA256
19dff92c1568bf44a3c89537130fa2bc2bc70015de94790ce3178e591ab2aa5a

SHA512
0e8ca5c5d162cccea1cd8b38bcaa455a143391af48d29ca9e66fb41bbd88bc5db29c6f1b88d3e7e15e7fe364ce877890443f5827343603ed795bc1e132e8ff42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49b0ac0e87fa4fa44e90360a6d0c66ea

SHA1
7479751aa77fcca37d9e00cabcd864305988bcea

SHA256
ae8807d51547efd490df0b02a7a1fa26b540c98a2d3ad062d0c56a532efc2e22

SHA512
e223599cb9f00fef3e576506eb22afcf320a97baa5ac0ef7694333d1146489b961b08cacbd892523dbf7a59956b5c9408115506d20dfc2d08d25738069f8470d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1df99538ce4d44eb236d3738e673043d

SHA1
4ca97bb819f44be499b034c2ae696d381fe4012e

SHA256
698d8f4a1075e164837c1e7774116a6c82998fda8d14487aaae655e867e5b4df

SHA512
0584a6cf0a3971232b5d6d026f11798e073765b1b63306f3e13116c8725937727d44ac94375df131ec5c30c9e012822fbd43b54abb01e108258e58b211d854f4

Download Submit