stormkitty | d633cf3249a08f878a33ef419131e8affd85600923170109317906cefeb1e62f

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04-08-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Raid-Tool-Box-main/PussyKiller.exe
Size

74KB
MD5

7acd7ca811c678a92d62d556cae858dc
SHA1

b05d0fd47d2d905234db53614f725e3744c93b3e
SHA256

736f8b467d09e4805d336c56b49ec183355dc433e04b93904d2e8d5876d5b9de
SHA512

24fe70950fc092d9de383f5c80c70bdc4bd5e342b927e2fb495752e0036c3d2eb0547f60467ef5019a686fffd2f8057105d13dd566172f9438ffe4434748166b
SSDEEP

1536:rNtW7bvrmSbUMiuidaw6v3ZfXR6/A8Id0FWGV09auvIUxjFxtbm:rzTyXRKA8Iwg9auvIUhFxty

Score

10^/10

stormkitty discovery persistence stealer

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1944-0-0x0000000000720000-0x0000000000738000-memory.dmp	disable_win_def

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/1944-0-0x0000000000720000-0x0000000000738000-memory.dmp	family_stormkitty

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000\Software\Microsoft\Windows\CurrentVersion\Run\nvidiaDValueOn = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA Local Drivers\\DriversUpdateProcess_x64.exe"	PussyKiller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
21	discord.com
28	discord.com
29	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-6179872-1886041298-1573312864-1000\{AAE1451C-EBA7-4734-99BB-6C82CD930C24}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
2280	msedge.exe
2280	msedge.exe
2256	msedge.exe
2256	msedge.exe
2552	identity_helper.exe
2552	identity_helper.exe
4728	msedge.exe
4728	msedge.exe
4852	msedge.exe
4852	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	PussyKiller.exe
Token: 33	2140	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2140	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4816	4768	msedge.exe	92
PID 4768 wrote to memory of 4816	4768	msedge.exe	92
PID 4796 wrote to memory of 2124	4796	msedge.exe	94
PID 4796 wrote to memory of 2124	4796	msedge.exe	94
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 1936	4768	msedge.exe	95
PID 4768 wrote to memory of 2256	4768	msedge.exe	96
PID 4768 wrote to memory of 2256	4768	msedge.exe	96
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97
PID 4768 wrote to memory of 3572	4768	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\Discord-Raid-Tool-Box-main\PussyKiller.exe
"C:\Users\Admin\AppData\Local\Temp\Discord-Raid-Tool-Box-main\PussyKiller.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7fff8e653cb8,0x7fff8e653cc8,0x7fff8e653cd8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,7075626571392720369,4170210622904588199,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff8e653cb8,0x7fff8e653cc8,0x7fff8e653cd8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,15239296292852971515,5651873188113039095,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,15239296292852971515,5651873188113039095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
107KB

MD5
72170ad9b85a3caee9f8c20d7d856ce6

SHA1
90dbfa2de316339ad7cbae74cb6a0c9ca119881e

SHA256
3b033a28c7263ae12d097607402d806b348c61b86af44cae09654e932dfd1d8e

SHA512
0d151a30d47fd98a5ad6be68b67c8a58b1207ab208c7651c33bbe35fdfd887b06c1e7f92c1bc97b9fccc15ba02fde5585228ef74744a482617d3d8db41fcc44a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
428KB

MD5
5f0233c74b3ac598f7cb4da1b41ca8ed

SHA1
80a8be90a7c0f985f0380947b61bef3a46b64c20

SHA256
872515553e9937e0bdd623b3f117cf1f3faf6c3914e4ea1989d10487cdb6c8e2

SHA512
c5ed13c71886c2f85859629821ed2ea57076cf65c0e7d8f4a7ec59cc832837f5fe453d85029f43f0abbb8fe9ac2eca8dae9441cfecc85591c69fadb411187710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2c9404cee852d11f83b2bfc34b83d58e

SHA1
dcbef647c83193e4e2457d572ad5b52ae98dea80

SHA256
bd25306d06ec8c1f32d1324d6304be9b0ad7c3a7f1a8554bfcd897d54b93e848

SHA512
99ab740c208b2e29f299546647e8253314aa0c1171e61613a03bf525aff1324c2e542c641a46aa358c634653632585809d421f37bc6b54fb56465953f526a015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c08c6499d2adcbc1ac2a79ac61e58d8c

SHA1
8761fe34addbdf7ad58eba99c55e027400d87373

SHA256
2bdfdf63e8c464e031bcddfdf04bfd6e187e9c78311f072e1f7f14d1d0792c64

SHA512
509a83b397c824d6de24235cf7da70128194a6e4a29d0553f093fe2c2cb065553f851481b2eb437928381ca7a0053eb0bcdd11ad3cc72e052ef1a1aa92bca0f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3d1144515af6d4968299e00af2bfd0e8

SHA1
aad536045dfc7c43dba23a2725cce02ef090b8f2

SHA256
27361facbf53bf66e59f3c1d536c2776cd4bebdd98d42e731ec616687a97a386

SHA512
8f8b1b2925cd2f71885d54a9aa409c145ded08e2ac7c47977c97d0b49e4ecfc1da515ef93c26bf5a35718a1260629b80cd4db61fe73bd3049e9c2783cc2810e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
353c4f1a1a6694c8ee43e791153440bb

SHA1
5a39601c16c064edb378a946508a59aacfec0aff

SHA256
c1a0d680e1a19c590e8265889960a520d38ccc9665f1a9f52b8d2b1ce37ac19f

SHA512
68f9d80fa9a93be1e2fd07652e11dc122fd4406026e8ab8dedbecb59a3093f5df27d5b85eab982f3abb6f6af92455bc9696aae20cd154f587f7f8845ad50296b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2e12fb04a005366930613881b30364a

SHA1
c1369bb5586db867dd01d96ccb635512475c59fe

SHA256
ede7d39c73d1011492133c4ffe1c3d1ba4da21347b8145020b440644e6af7f3f

SHA512
8035a46bde8770b3a335e66eec05f0a1398b797bda8acac598b954b344b20e882eab777cce014486133ca15dcc867a77b63ad1b6e8037192ca9243ec89158d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
191b984d00c7234acf11c3fb44795a64

SHA1
49d2b8b2d6c4072d0e6eb85cae7f5d499b835ed2

SHA256
580b2e81caebd56bfc8653cf88b82dd2be34c07a54dffbf6778ddcf63859930a

SHA512
88438724b076a2fe0727bc747b6328934e1a479b84b793cd837f94988888a1bd1824278093f8b2b0723cdc638be4e603afa30a750be4921daf12f233ad8fafbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
240235968950dc5bf04c5e51c845c263

SHA1
374499a1c5b8e7962e1819022199bfd04a961069

SHA256
604dba12866cf15c0bce1f18bacff141a64dde6336cf28d9a72087243982a66f

SHA512
8d994a2897322e89aad7da7f87615c39d4908c230fdb52fbc148040e252273e85454a1a2ce997a02a924e532c18912b78d98f98fe37d630e395169115e6f82af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d71e6680a7aceccee685e9d4b11ab882

SHA1
b3be6676bb94fb7617dcf9d2d4032b78c28ef228

SHA256
fb9f9e4bd6a89194b7496673b9518cadef90d9f01edf8dbaac86236e53707d21

SHA512
29b3e2c1dac211aea9dbae733d0b5c5de46c16816e2f5cda710949d8c0ff2a91b6bfd741e1add19889a886771937c385829ad65908e29ff52ba91a85894dbf32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
96f94a68fa1fc6fdd5da2c20e42cffbc

SHA1
b3d10a7c778b955f6c204fb7e0869445401e3695

SHA256
31bdd45ca4b7e31fefb5581eaacc20b95fcf0b2d595831ec3a89fedb6a4c1840

SHA512
5c8d3693017b3278cc0b9f21b0c99dc323591b98cc83e1d0c851d681b85a6dc881595a3595053e48e3584562d2a337852b7cc0488268602678effd040f2e752b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b6d55313c0e3226dc6b911430feccb2b

SHA1
0956733654f7afe88f0bf81926d182412d10f643

SHA256
8594d63a0067659d77bbf53624b9e067866a0d7396b245edc15c092d4d9d0548

SHA512
04c5f54593cd765f9e0a440ffb1f9e7dfe5b23526324a5e9dbd5c8ad4165657069f9ca64469349c68f740b928bc9a1973c65f807bb49f37d932c4d5fba1b2148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c914e05b97c58a1fca98c9badc262233

SHA1
6e5d4e2140837000fadbf93f45421f747ad39cb6

SHA256
435ffdba558c6e138596b5aeef1ed61eac8ab062e386507503022216da01c0a5

SHA512
72a0c15f195da63e1aa6da0ed97896688f0ea03ba14066bc7a8cde021b601b39ca136ed12c970e6390e5937d05cfd8da3fab8b4f0285202553df720b56e58a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59572e.TMP

Filesize
1KB

MD5
9691679180f2d8b3704c7aeb7226d95f

SHA1
25db8d160b8d35c77a0f8ae1c42e9fb12d172157

SHA256
f65f91dbd05ce2caa3e5a340f84577f0fa78c78c75b9ed46bf011e9a1ced8e47

SHA512
37a438fe24c1127f882310b9fa7b95abb432fc79ad0624c7ac23cfceb451c04c6bfe8d65f3d6360aae248c238dab31d18064bbd7527d4de7a290d3f83d4c861f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1ab10550045e706b0ae0ecd98204dc17

SHA1
7371a878f33faad2856b52eef0f61a965419e03c

SHA256
7fd00f7b3cd260250eb7de0e2818ccd2035dac1368f8142cb84b7b8d4d1a7aad

SHA512
84e67c0b067606a1d4e00d89c88d86586e58ae3b6b5f7a792dfb0b6953cdb31e20aef2ed2ac09ba5686c88b9632b20b3846d13c6f98a494aa4773ba6a48e4678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
97de068cec29c6a723a6960a5fd4f67b

SHA1
d9fe2915315a2e93909ca42c6c876e5072ed8597

SHA256
a63a69881666d29d240873617f5d7b084c2c5753f52b077e02f781d9c5c11a88

SHA512
ad44736306ebe029b28d3b61cf6728faff6cdbcee0cba28cc1bb4290ae535b6baaf3cc61deaacf1bb3ff0bd58e3c15705b9bd4ddaeba4c4a37530be8fa022aed

Download Submit
memory/1944-0-0x0000000000720000-0x0000000000738000-memory.dmp

Filesize
96KB

Download
memory/1944-5-0x00007FFF8EE30000-0x00007FFF8F8F2000-memory.dmp

Filesize
10.8MB

Download
memory/1944-2-0x00007FFF8EE30000-0x00007FFF8F8F2000-memory.dmp

Filesize
10.8MB

Download
memory/1944-1-0x00007FFF8EE33000-0x00007FFF8EE35000-memory.dmp

Filesize
8KB

Download