hxxps://cdn[.]discordapp[.]com/attachments/1283504291218329663/1283504490351431843/SRTgmyL[.]exe?ex=66e33c34&is=66e1eab4&hm=8909a192a75efd74b0997de9585b498d0d082dd55ef74da50ce761f6c8d5b46f&

Analysis

max time kernel
600s
max time network
685s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1283504291218329663/1283504490351431843/SRTgmyL.exe?ex=66e33c34&is=66e1eab4&hm=8909a192a75efd74b0997de9585b498d0d082dd55ef74da50ce761f6c8d5b46f&

Score

8^/10

discovery evasion

Malware Config

Signatures

Downloads MZ/PE file

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SRTgmyL.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SRTgmyL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SRTgmyL.exe

Executes dropped EXE 1 IoCs

pid	Process
64	SRTgmyL.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
105	discord.com
101	discord.com
103	discord.com
104	discord.com

Maps connected drives based on registry 3 TTPs 7 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	SRTgmyL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SRTgmyL.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\DeviceDesc	SRTgmyL.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\FriendlyName	SRTgmyL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Disk\Enum	SRTgmyL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\Disk\Enum	SRTgmyL.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SRTgmyL.exe

Checks system information in the registry 2 TTPs 1 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SRTgmyL.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	SRTgmyL.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	SRTgmyL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SRTgmyL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SRTgmyL.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{27071BF8-3C9C-4486-9371-87846DF123E3}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 852103.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2088	msedge.exe
2088	msedge.exe
4316	identity_helper.exe
4316	identity_helper.exe
4380	msedge.exe
4380	msedge.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
64	SRTgmyL.exe
2024	msedge.exe
2024	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4328	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4328	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe
2088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3140	2088	msedge.exe	83
PID 2088 wrote to memory of 3140	2088	msedge.exe	83
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 1872	2088	msedge.exe	84
PID 2088 wrote to memory of 2304	2088	msedge.exe	85
PID 2088 wrote to memory of 2304	2088	msedge.exe	85
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86
PID 2088 wrote to memory of 2328	2088	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1283504291218329663/1283504490351431843/SRTgmyL.exe?ex=66e33c34&is=66e1eab4&hm=8909a192a75efd74b0997de9585b498d0d082dd55ef74da50ce761f6c8d5b46f&
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3c4146f8,0x7ffe3c414708,0x7ffe3c414718
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7242960133660233486,5347590990646238037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3208

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:4772
- C:\Users\Admin\Downloads\SRTgmyL.exe
  SRTgmyL.exe --spoofable
  2⤵
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Checks system information in the registry
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:64

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x4b0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9c0ac3d08cd164240e1d868cd4b84436

SHA1
9c1476c69c9136899c7873569700acb89599e64d

SHA256
c5e4d69ebfe0474570765e531b35530263ffc7aac521336becfc119e577632c6

SHA512
a4d8ed10e742ea6a3b75ff3149751aa10d096c1f39642ae2875a515a97b4697ef7d240853fcdf0cecb67c76436a2ed536b155f167d6656a95282f8e56e1434ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c5bf6c81a4ac5b11c20010e9699c5a2c

SHA1
8b399265899af656e0b258339f0a0e4200b18eb9

SHA256
b2329ba9d546a96c7f4c5e53888c319ae3f21597e9d2c206fe268aa9a33cbc2c

SHA512
04df442064223eaf32ef51ad42bc2481e8aef3ee24c41fa2c32b241b478885e42416cf50f1c557802db7f35195340efe72167a38c6c86049b3bf687bdfaf5b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2dccdbd81984a0c41fdd9370189fe23e

SHA1
c6f6dad028d6fc3fd2dfa7ea6924b7405a3e018b

SHA256
3050688ab66c9c90e6c109088df6542ec67fe4a7ad538754d487d6356b947bd1

SHA512
9dff8eb0075c7a12433d0dfe3ca6fa2858da4cb9d2a5d4f496d7d62fcf59a26c3aa17b8b998de32171d83b41a0f76e587ccc776fb0cb765dd4ce689aaad81e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
483a3fa935c9628eb679cd076398a51b

SHA1
0b29c4a148dd7296982cb33d383348cf029f0444

SHA256
bca6f7b565bf884a139cfb454a910872209fbc074d015e6df9ac137630f24d6c

SHA512
99d745513f7f255ffb84fcf114d27bdf1dd4d8314fd0f065d831929fde78c28bb39ed8d8b3281342cdb91c8ecf7163b1a3576ec7d5b1a58326f0436d9b5472f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7a58b242567e483d26d2a7dbf30e130

SHA1
e356060889f095dc4e5977ccbe43a9900cc5258a

SHA256
ba83834ba4afa6b9ea2bdcb18152c44163c49e37d00a3861e0f01a3fcd82e05f

SHA512
0fadc34b41ec396a171ac50b96c6df9dfe801a54d5a6f302797eb41e145ad3058535f5efe2a5eec2d00f9048a50a2cb87f57fcdb62b75c18aa1c64619ffd6d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
80ad8120fa70e1bd12e2fc267c6ebd4b

SHA1
d8e3ad5f99802e0dd82af56dfecac0609a7b4f8f

SHA256
bf0ba48e5e7abe95db97ecf3b9645eba1c349206e6e2f7462ad254e8a350f173

SHA512
6f865b9ff043082f84b652539b230c22870692cbd3e4d8682d5c4ae5d2c0cd4261447bc17fface14a6eedf65b97005345364b159f0ad3ec1ae3898755d8d700b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
470ca916079ea412a9faafa64ca4b17f

SHA1
dd48604a38c30a8dd67821de81165ee650c88a80

SHA256
ccc9a4e5fc6aa0d801da4c3a429fad73c6ab8e82a05633c2329db4655e83517f

SHA512
894ff8e6384f19fe3839ed1b001a5ade5a468f8d150036af3d946385f41bc4a7ceddadcad2ec0c6ea568de4a63988a67c2c36ab888cc2ed7ff45044eccab5f59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
50a07aed1c4c62cf675fb26a124b5305

SHA1
2165966a430f2d3ec94b51b9f045faeb329e60ff

SHA256
1b3ad12af60be65caa4c086da4ddbba66fd923fbade494952ee70c98db083370

SHA512
9761071472c6bc7253270cb89470231a658a674a511ca28ab6d594a69009bcb3c620fe58597872c476a218da0e715f95d26e3380756ba4fbb8a72ed36e0a8c8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0b23694324cb5abefbf8f6bb809ec31

SHA1
538100f348ab1f07ade2629c5340be6fce285e9f

SHA256
8c01a2c1a01c8da4c4c0192f286363eec78439ab0cb1b05b6719fe3166f02052

SHA512
069d7749b1cb0ec432076d69d509b0a5bd561fc8ff56c154ac2cdb64698502c08443838e008c34514615c9e96a93239be12ad9da571c00ecfff2d0b9333bede9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a42a150173fe3aab11a3e95d7de2c93c

SHA1
6046f67512656ae6813ffc7ac83e05843c0d3a42

SHA256
bf469f3cf653e38111abc87a9a925fb17258c79237e3cc70f00eb89aa6e8c0d7

SHA512
0d0019124d0eb5cb221a72668aba89d1f8385ee7a6ddfa2ad3d4892a0f2b447420ad92ffa1f8adee4954b3027b62c52545e5ec076dc613ff6f6076aa8986ad8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
64af855cfa4756af3fd3c516e0600627

SHA1
87540e77e12bc4d879a467cf40ce126786e7784b

SHA256
de4c4d7408c88ef127d81423627dfc16b345d838380af58330934c17952bd977

SHA512
20ef77dbdf568233c82781a7d77455a8156d3c9502059a1b1e58d6db52054854324acb09f46d9666567c55f17dc9789847ece273d6042dc463d088bd345d995c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d5359c5972ace0db48d7d05f99eccbfa

SHA1
24ab662cb52ce24a9d640bd2787c3940e168aa81

SHA256
abb4943e10c5cc0631d88d77460d2bb3585ef74f7341e95737f2b4899fff8dd8

SHA512
f5fb0ae3cb17fadfce356b93b9c1e6ab22e76834b9470be6e8c9bbfdfc6d886d931ece9d9e815f0e10ed08ba8d9faf65c98effd8be1a528d361c254b0face07e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595e43.TMP

Filesize
368B

MD5
a51037729883c2dd4a443bf2cf52459b

SHA1
d1b54bbe2dedc3d5e535c7c936a65976b5d3da36

SHA256
c77992be12c7eb4ed17977a8812ce0fd9c4ed440f3e69a40a5f29a6b1a21a34c

SHA512
90f24ea7299b9bd0d82361ad80bd342d1d517551b04e02e32e18cd0b02e9b92bdde6d3768e1040b6a69fec3c3055b43950c3f1e944fba84a91072f6d9fdbd46e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0c8a0b7882c6669ac179577164696c90

SHA1
576b1d6bebfb603e492fd17a66132efb83a6ab9b

SHA256
a1822a7de1d377b909f4b6b9837b5a41fdcc12d22fc02e5c96ab7f0171cb6280

SHA512
91affd60d42a8a635129f6401a1f2d7445049f39824f42746a2d28c18cfe7ec86e3c6760d5e93597f2e2029490575a70d21fa05df543bd9b0eb2d775494f6b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2bb654f0e806c4d49dd5fbfbc2611878

SHA1
7017a278903643a5c7e8aabf4034908ce9969227

SHA256
82c06fa596cfa69193c25e04db72d8f96fa870339ed536498e15433dd6da6dfe

SHA512
18909aa3d95ce0eabd598b8d8b0546dca626cc8519487a5df25d6409ccf6d6a860538768d1e4b61170c125d2761bd0f86597fe69d121cf22da903917feb10135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ddf64d3c6bcfd478781c4612d8f9515

SHA1
3181cd661981b008a40425bdfa7b401202c89cca

SHA256
ded6c570dc467b306f884b3e439f83e40bf4f327927d01de7ab38534d6410f7d

SHA512
ec8f5ddd23f3eae7a1c1838046822a75c81015c549a9f2abcd705f472460a5330a159a97aed7e05a22a92017fa1adfcb4c0d6e418f4cee0bc15c8154f6651cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b5c58c66bfbf1c7e2bc395160682444

SHA1
7f458a0281c4e3be4fcf6efc4541d6832f2aceaa

SHA256
320275e8f8cf512a8ce2460a19207c2f5a79786f5f663e59460fb55c653f4351

SHA512
b232392d1e63c6dbc072bb495fd660d4d62cfda3b90b666b8f538ced0e2ee05c7171b5d7e4536f4a480d630166edc64f50e9e70cad76faea6509164782cb4fb2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 852103.crdownload

Filesize
314KB

MD5
4adc348cf014d5c2eacca085fc6bd8b1

SHA1
dec45001e19130a25e0f15091b8291c8e560388b

SHA256
3d3e48e16326f5ab718e63bff2a4bb109b3c1942147f14e103467e2ec42a1401

SHA512
49334197fe250876360fa52ded719c0c6eeb5367ffe589cf3ee963ad91808ca10788161e8c69f25cabe2aa16c4b0f701af5e52cc29414b81ea38305e65ca5e29

Download Submit