xenorat | hxxps://mega[.]nz/file/0lVF2C5S#tRrh4fU--cDJCl5c0s7U4f6O3q1U-tsuNOdC51qF9sQ

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/0lVF2C5S#tRrh4fU--cDJCl5c0s7U4f6O3q1U-tsuNOdC51qF9sQ

Score

10^/10

xenorat discovery rat trojan

Malware Config

Extracted

Family

xenorat

147.185.221.19

Mutex

8912d

Attributes

delay
5000
install_path
appdata
port
64704
startup_name
exploitz

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	RetardScript_v2.435.231.exe

Executes dropped EXE 9 IoCs

pid	Process
5460	RetardScript_v2.435.231.exe
5660	RetardScript_v2.435.231.exe
5728	RetardScript_v2.435.231.exe
5756	RetardScript_v2.435.231.exe
5784	RetardScript_v2.435.231.exe
6076	RetardScript_v2.435.231.exe
5800	RetardScript_v2.435.231.exe
5264	RetardScript_v2.435.231.exe
5912	RetardScript_v2.435.231.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetardScript_v2.435.231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetardScript_v2.435.231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetardScript_v2.435.231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetardScript_v2.435.231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetardScript_v2.435.231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetardScript_v2.435.231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetardScript_v2.435.231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetardScript_v2.435.231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RetardScript_v2.435.231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\XenoManager\RetardScript_v2.435.231.exe\:SmartScreen:$DATA	RetardScript_v2.435.231.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 67397.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5604	schtasks.exe
5960	schtasks.exe
4960	schtasks.exe
5908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
3536	msedge.exe
3536	msedge.exe
4896	identity_helper.exe
4896	identity_helper.exe
5280	msedge.exe
5280	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4408	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4408	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 2004	3536	msedge.exe	85
PID 3536 wrote to memory of 2004	3536	msedge.exe	85
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 1924	3536	msedge.exe	86
PID 3536 wrote to memory of 732	3536	msedge.exe	87
PID 3536 wrote to memory of 732	3536	msedge.exe	87
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88
PID 3536 wrote to memory of 1044	3536	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/0lVF2C5S#tRrh4fU--cDJCl5c0s7U4f6O3q1U-tsuNOdC51qF9sQ
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb974046f8,0x7ffb97404708,0x7ffb97404718
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5280
- C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe
  "C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:5460
- - C:\Users\Admin\AppData\Roaming\XenoManager\RetardScript_v2.435.231.exe
    "C:\Users\Admin\AppData\Roaming\XenoManager\RetardScript_v2.435.231.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5660
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "exploitz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1B15.tmp" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5908
- C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe
  "C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5728
- C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe
  "C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5756
- C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe
  "C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13171270581896416933,9973407808081144780,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5872

C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe
"C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6076
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Create /TN "exploitz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3CF4.tmp" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5604

C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe
"C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5800
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Create /TN "exploitz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6368.tmp" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5960

C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe
"C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5264
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Create /TN "exploitz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD0C3.tmp" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4960

C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe
"C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RetardScript_v2.435.231.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
5d95c7efe925346f4547b97c4df1290f

SHA1
5008d92dfd6791c2085d543adfa5e471524b856e

SHA256
87058badcedbb3deee72a4a3c2676ef8be4d51d4a13b30d64a2ffe7c455b0485

SHA512
9ee1a2f4d82e5fd3918ad5fcaa5ae37217fa1c79f82bb388ae8f12ac8a83940fb485acfcda61e1439d20076cffa1ff9d70ff330651a3e8fafc3cd859099d7c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7a04b91056e0a434310889d0e596d97

SHA1
7bf7188005ecc3c0791fa67fb759967ef5dcfc4e

SHA256
f789d6640e605453a43b7a70e0980777e4c2ee23250d316401c1c24646be30b3

SHA512
cc38f43497efb9af6cee19febeeadd96a47007b5ca3242f1803b0b1bdaec0790065c330505db190de754c329946165ecce32efc16ce6ade69e8989fc509e2266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9c07caa5f32534f0e6efadda5fbc299

SHA1
bc69d786c549e3273f698e60e3777ce2ab74c386

SHA256
7383099fd48db072cd06804d9fa50e194bb0078d257f552823f4335e9a7f95f2

SHA512
940fbfddbc33850e971049910f6fc3626b5597a3743acf992475a035cf6a118f472de976a9fcb24306c84eea62d9242df99cefa92e4b118122d4c0429907357b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3d281fccfa2b5beb6e1d7cfd22a0b49

SHA1
70a6e9193aa4dfca1fc2b0cccda8c6aca1a764ea

SHA256
ed80d436cca9d896fb35c56a07b90514da68d21552d771aeddf5a5bd59f9e49f

SHA512
4a1340183540562b55fe479059219aff0c23aaf752e219016120600a2c24ced638ebd1d91c150b1f05e439278f1dfd15468640b3563aa6a06643f6e289e6f80c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5e2eb3d3cc8c410e180fde97f5f1d920

SHA1
9888cf1e06e516642397e9c781bcb5d799335d83

SHA256
9a19963d972906027bce3e389f4f8042a8dfb239959cb24c6f551ba804f3993e

SHA512
9631369d8f835424a5585748805cff22995b9194fb476f3f8ab434b66c5fc43976cd07915d24cd2a356f3b9b947e420463f7db064aa1b6f4c77bf8345b1f1268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58056a.TMP

Filesize
48B

MD5
1ab5cf669215ad80d16ab9defa5a44b1

SHA1
32f6f4e5e1312fed717a1a33249f26d51cc093a9

SHA256
a9d8584fb79dbfa4c251fd89f62f0ea3f4c0c22a60471d774f7fb3187369a983

SHA512
313fe716c0533d3f59e02343b4ce5845a07ef8b2b0743cba22ab23c861f39033a7cb4846475ea33a1ffe458d6024ab16600b4f0e08962fcef649a2139be95fef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bddf7afa6cce1c0fc6bc6d11a4fedeb9

SHA1
5757324e294fc968a061f4b7d16be40201cc22f4

SHA256
7a0c8db285611e56361340c9c71ccddafd7498e6e75d4059ef18d4c079f8597f

SHA512
c3fc55f50feaf06e9a9562ac6ee1270b97db055a49a4c0077ca9872f57bb618daeecdf124fe917ec27d9f3292611c2571f7e718de47988f800f7b90be1749801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c856898faeb2e0bac3599890a7bdf9b2

SHA1
34c385bd6a694d3c0898387af4d5187a7e01d0b1

SHA256
5a06c64e9e231b0240bb61a6ba4e3bef51ed4ebe52888630319d67ac78499de4

SHA512
2f50889e7f10b47d27e9b5c44c09b60c076bf57825ed230503cf875d627364f334379bec88010bd1ffc3428d16c72a8e6ef9ac066833ed16d9f13b70f27a4660

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1B15.tmp

Filesize
1KB

MD5
61aa72a0677e45031335da23360be9f3

SHA1
db52f9bcc06f610e5eae6dc5393516b8ef363b5b

SHA256
946f578beba8710da4a3d88df0c82ea3a6071d26a67f377076a90813463a9796

SHA512
61523a84f3d681bcfebc74ff182b84e2f69d2074868a3ea6de0b6b3dcaf15b7af58085c5cf4a8ac6387569b7b9b8466d8b515e4fcaf19dc81622376c6781e7d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3CF4.tmp

Filesize
1KB

MD5
22dad3bf6d0be77444b7a027e72cee40

SHA1
63a81a370dcb00279ff69a496213a5355dbc9367

SHA256
67b93ef4fa6c459e4a1f6358aabf1215ae0bed7ae464389642a48cf755989a5a

SHA512
2780a0b6ed0d83d553f69749c46d79e439b1d8878d032539b8b8fc916fb0685ab6be7a7c15485d8a3e6e2954f64108e28198b273e99d30014cd86dd151b1bcb8

Download Submit
C:\Users\Admin\Downloads\RetardScript_v2.435.231.exe

Filesize
45KB

MD5
bb8515aa7d976c4fa8a18d2fc95eaa2c

SHA1
1dfe2ad238abbda0a29d9d47e6d8fbfc352905d1

SHA256
26b4eff350425bd00e65df43e8360c4d0682a35b6aa19ad7d8334c616180bfa3

SHA512
ce342632eb6c8da4c0d0afbe9c5106f9a9edf9bfc8eecddc7cd7296b65ae13a90cb9b733199fe5e38b988232c338ab446907c201f05996ac04066c542d9ab348

Download Submit
memory/5460-204-0x0000000000010000-0x0000000000022000-memory.dmp

Filesize
72KB

Download