hxxps://github[.]com/ThunderScriptSolutions/ThunderAimV2/releases/tag/ThunderAimV2

Analysis

max time kernel
155s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ThunderScriptSolutions/ThunderAimV2/releases/tag/ThunderAimV2

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
968	ThunderAimv2.03.-.version-2e10d35f26294ab6.exe
4728	ThunderAimv2.03.-.version-2e10d35f26294ab6.exe
5484	ThunderAimv2.03.-.version-2e10d35f26294ab6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 313347.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
724	msedge.exe
724	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
5324	msedge.exe
5324	msedge.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5200	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5200	taskmgr.exe
Token: SeSystemProfilePrivilege	5200	taskmgr.exe
Token: SeCreateGlobalPrivilege	5200	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
724	msedge.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe
5200	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 3532	724	msedge.exe	84
PID 724 wrote to memory of 3532	724	msedge.exe	84
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 3340	724	msedge.exe	85
PID 724 wrote to memory of 4988	724	msedge.exe	86
PID 724 wrote to memory of 4988	724	msedge.exe	86
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87
PID 724 wrote to memory of 2988	724	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/ThunderScriptSolutions/ThunderAimV2/releases/tag/ThunderAimV2
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa23db46f8,0x7ffa23db4708,0x7ffa23db4718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,2875467918112926482,6161759815953188936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5940

C:\Users\Admin\Downloads\ThunderAimv2.03.-.version-2e10d35f26294ab6.exe
"C:\Users\Admin\Downloads\ThunderAimv2.03.-.version-2e10d35f26294ab6.exe"
1⤵
- Executes dropped EXE
PID:968

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5200

C:\Users\Admin\Downloads\ThunderAimv2.03.-.version-2e10d35f26294ab6.exe
"C:\Users\Admin\Downloads\ThunderAimv2.03.-.version-2e10d35f26294ab6.exe"
1⤵
- Executes dropped EXE
PID:4728

C:\Users\Admin\Downloads\ThunderAimv2.03.-.version-2e10d35f26294ab6.exe
"C:\Users\Admin\Downloads\ThunderAimv2.03.-.version-2e10d35f26294ab6.exe"
1⤵
- Executes dropped EXE
PID:5484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
27ac782239d02c6fb5d8af2d58371489

SHA1
1d3ebf196b3f7b1c6bb7ade997a9d0951f1b16a2

SHA256
edbdc1298339f3a871f24a0ebe17c24a52ff91b675ece1202ec900c598f8ba64

SHA512
2956365ef4017ecfa6bb131b724c05905abb38d48ba703a151fcaf8b438102c526a7b940e4f1dea19da794b35c6a35e5a99bf93a4b8c58acc45b7c54a5ed1fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5acef80095b84a22b3e1810da9bf5c3b

SHA1
c9b99a8853c67b526619d8a28ceaf9e93805890e

SHA256
74bebdace66606411825853a26448cb50249a28f251450c8e73570cae0efd36d

SHA512
de148b41f6c292a5ccd464944e77f7140bc78d1dbef7edfa4651614e29abb3556cd3c54c397b6d48df3d2097244f1f2aed3b26ecd64e2617dce4e80671f1aca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1a221d9362a8caf114de376d57ad6001

SHA1
54f67b90f22b8feb9e1574b3019f9232332b19cc

SHA256
bd18b2727b3dbe0d168d5d3a974728fda51323da234123f7a49af5f46173d01d

SHA512
41ac6d1d615bfff5565b2b42620cf090d079266f760293033ab1fce63b27358019d5fc603445dbad7aae5fdb6567ae6cb0b6577b9d5fe349bedd3169ffd33d11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0cd5fd9535be3720322344a0659075fd

SHA1
2027a0b29a72a870cc78b4b8095f3f5bee8d54f9

SHA256
f14086c4aed60ea8e617a2e92e5ac29edef5dd8d661b57b2d369536019f4248d

SHA512
645dacbd70f6fde96d7f83de4e0b52666bc46d9970ca5cffa6775aad203257e5310b53e8ddb59523a9b1cb4747c0cfa59eac3af134343a92601082c4706cdaf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b4b71c33d981e68d8559b43bc1fb2c3f

SHA1
e490c3892de66c0d9de8245eb5f491de25b77717

SHA256
00ec66f38125e6d29030aae836fa67d9235aaee0ce6f7229945496a58910edcb

SHA512
975e018e27c6413c346265a136aa43b38a14fc2c361dece9f47d32f694284b7f89050be26c6e5696bafabacf4a1e778f436d8f5af2502234b19831f38d664102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9335ee8e6b079cbfe3653412110a239c

SHA1
e5490a976147f73f4e41586a1dade0a963cc0590

SHA256
62ed53bcf11f0e1f239c7d529004c1761b2d10c7ad3ed65aa25f2f542bb91e83

SHA512
cb1ff7ee0a7a25ec169af9023cbfbaee304a456da105264a59638653c31ea61312a120d9f9327b608c17477731c44cd8b9bbcb374478393c51eb96be9c1e091c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d21363cccf006ecda0f2f0c43afc20b0

SHA1
e6f72de569cd9e9c10de71a7ab62c784c569427f

SHA256
495940bdf5ed5ca8f0058327d351a7d41e4ed24f5c43d19b6e80ec9e31f7c162

SHA512
98acd049c2adad7ec1f5071fb43ce492585c9fbc25816254d2c43c6c7f47688908658c898b426e2bd38708ca00b7782065a8c7f3ecb5f323cf60143f13bfb88a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c22890e258b8538773cb71cf3569d6b6

SHA1
e3d2e16885e16b83c2e64d8ac6e5e1dd4da6365e

SHA256
6d2b05ec3883601a838a03b20199d3b8640654fb0a74f411fba09383954db5f1

SHA512
9916331d470e9a30ce9738763fefc119c0dc41e2237d992b4a9304bc099e4d078c3a7c26840d80cdf64665efe89ece5e911784b19f0a43795b54de7cc44d7168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
b9ecfb8f8d150c4739a71b92244459eb

SHA1
cea4b40837a7e1cd465cc42c2e033516443dd2c2

SHA256
6464ab59fb45c0b21ea655311c3792ed3fa56b504caf59a01cdb6c215814f5eb

SHA512
f36d41ec2d0672f6d7cf53bfacf353af7ae24397da2943404f019cdeaaf204ec17030ab60ce34dc6a5767b00dae939d1b5a8145d44621c738534b51af51612ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f20e61a8f3c2038ea21e65c54cd68204

SHA1
b7c50f7f108688317f114be4fd8d0324c2331d41

SHA256
c98bde16222c65641111c5dff478e3ad7bbdcecc4e808337c47607bb9edb1dc2

SHA512
6eeda5f38496161cb225459a4cb14657afb517575d8b48587e9ef784b8084c48040157119d3eef2b18cca731666ca029ae90b799e9d886149640595ca64dd2c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d4c5.TMP

Filesize
874B

MD5
ce9d814e59f77342a0d0324f7c72bb73

SHA1
e16099a0e39187b3c6e14341af1fb2b9bffc30da

SHA256
bef2ed405d81e5178dc17c3720869c31a4f250bbaa7cb1a8c0a3aa900e07afa2

SHA512
809d303444111ca52ff23e94c4dd8333a7d3c1c196be90d4989ba448b576297ed4e66ce3b0e66e5370442e7928afbe4618e7686c9ee0eec5ade096a90250405e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4d42c1c-0408-423a-a179-8e325f51d399.tmp

Filesize
6KB

MD5
3fe994cbc6af89933a7fb9b8f1df551a

SHA1
0af29103a66268712baf402a010c684daa4f6109

SHA256
814f250b29d3f6cba44e52d730e00d60d935e06d0804b97a01f4380a5b74d50b

SHA512
1a67116f053260f84d44fa1f7a7a7393393ca5cca55e48fa06ebaf34a2eb8582e2e3bd73601eb3147dc276c78d0073d5eb2a9bf331668ec847a5e3a809832a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be675e3ecda5e85e41071cd3c700ffdb

SHA1
de9f3ba0e59aad2113cf1118152c3a1bd36062b3

SHA256
1e8f90b3d233909b1c5475ac6baabda3d5f599749fa47b95c0bb776e7be1d0ef

SHA512
248a6b9b9e162c117253e0b7dfcf107f9a240667e580f0bcfaf1dd8c2df714f251063c295db13d2a9569e5032d91cb516e54eb04ae907082384ffc16b7248f13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a1f17043326b7cbef5af8fbe7dbbbb67

SHA1
8cedcc0675ac6e7cfe9a7287d69d0e6f1dd3503c

SHA256
667615191548def1b45e4b1eb9e60683ba020f0caf97871c9568b1c2450b9cf2

SHA512
e3a71f01f5e36f7c4243bf21d884cd4b3579d035805dfc7cdd040079165ba1386cf4a73c3c8201b60417c1b705a64ce663a64c63850369dc59b7ec7eaf432859

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
eaa9c60ee2f79f8e321954d8d492c23b

SHA1
81c654760c3330706ced844900bb9a891c3fc5ac

SHA256
631028ac43b4cd90775d2d62c1e0a17d4836a1fe773190d8ffc0ecf97f10e183

SHA512
720ddf1bcc97cf413f3ea4efc1ace732b8b29d1f9d8fc8804f245a50ec4a0e6a5b76024fc92c5e616e4f2233d45b18e54e91b4268ea03f47d90827481f024010

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 313347.crdownload

Filesize
1.3MB

MD5
82ac7682bbd201f916939e6019f59b04

SHA1
c77d1ff66bf5b85fda67e1fdf23fc2906c048fdf

SHA256
f50189354a7344abc273fb4a2f5c28d9397b2363f05a5a32e5389a5b4d4758ce

SHA512
d09e0d658ed5ae656684edcc1da1bc05b7551fa84e4bc4fc88c8dd258182df6c3d999daad81bde0dffd84559bd9477854250217eab3a1e3f7962d9f405f5ec05

Download Submit
memory/5200-321-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download
memory/5200-327-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download
memory/5200-326-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download
memory/5200-325-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download
memory/5200-324-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download
memory/5200-322-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download
memory/5200-323-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download
memory/5200-316-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download
memory/5200-317-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download
memory/5200-315-0x000001F7E6EA0000-0x000001F7E6EA1000-memory.dmp

Filesize
4KB

Download