xworm | hxxps://file[.]io/YJiR7x7FBEh2

Analysis

max time kernel
417s
max time network
422s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://file.io/YJiR7x7FBEh2

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7777

79.110.49.242:7777

Mutex

FoLsAL6LmWQmvVuY

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023d5c-209.dat	family_xworm
behavioral1/memory/3776-251-0x00000000005B0000-0x00000000005C0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 6 IoCs

pid	Process
3776	matcha-version-k73mbjsaD301.exe
7160	matcha-version-k73mbjsaD301.exe
6216	matcha-version-k73mbjsaD301.exe
6044	matcha-version-k73mbjsaD301.exe
1836	matcha-version-k73mbjsaD301.exe
5812	matcha-version-k73mbjsaD301.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
503	ip-api.com
541	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 897378.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
1112	msedge.exe
1112	msedge.exe
1716	identity_helper.exe
1716	identity_helper.exe
5244	msedge.exe
5244	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3776	matcha-version-k73mbjsaD301.exe
Token: SeDebugPrivilege	7160	matcha-version-k73mbjsaD301.exe
Token: SeDebugPrivilege	6216	matcha-version-k73mbjsaD301.exe
Token: SeDebugPrivilege	6044	matcha-version-k73mbjsaD301.exe
Token: SeDebugPrivilege	1836	matcha-version-k73mbjsaD301.exe
Token: SeDebugPrivilege	5812	matcha-version-k73mbjsaD301.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 2900	1112	msedge.exe	83
PID 1112 wrote to memory of 2900	1112	msedge.exe	83
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 432	1112	msedge.exe	84
PID 1112 wrote to memory of 3612	1112	msedge.exe	85
PID 1112 wrote to memory of 3612	1112	msedge.exe	85
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86
PID 1112 wrote to memory of 1676	1112	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://file.io/YJiR7x7FBEh2
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8314946f8,0x7ff831494708,0x7ff831494718
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7624 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8552 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=8604 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9028 /prefetch:8
  2⤵
  PID:6220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9056 /prefetch:1
  2⤵
  PID:6260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9272 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9220 /prefetch:1
  2⤵
  PID:6420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9644 /prefetch:1
  2⤵
  PID:6500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9628 /prefetch:1
  2⤵
  PID:6508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9928 /prefetch:1
  2⤵
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9224 /prefetch:1
  2⤵
  PID:6920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5244
- C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe
  "C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9580 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10208 /prefetch:1
  2⤵
  PID:5660
- C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe
  "C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9060 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9152 /prefetch:1
  2⤵
  PID:1756
- C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe
  "C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,18440241076340795599,13152280001808402315,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7016

C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe
"C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6044

C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe
"C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe
"C:\Users\Admin\Downloads\matcha-version-k73mbjsaD301.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e9daef3d55d77d93056b36c14296e4a2

SHA1
fa134026879179f665db3c1b5102c98916bd7ac9

SHA256
f061bf33e6fea35bd9acc857638d919395761beaecf93a0ddfdac03d84d28e86

SHA512
efeaba4d9b902cf11fbaf4d1c78f34deb313e66f3f3fd4bcb677e52d4e00b11eb2712b4c93c1543a9b42e8fa883ac19079a9607a71b3ab92baf7317ee59c601e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c4a34e69975ecf8e1de5384921b313f6

SHA1
15ffc3351435948f1ef139a35490331772209f1b

SHA256
bd0547c8421bb2caabc8c1647957a4e4e0794566aff802385839d865429102c0

SHA512
4f52c18cf4efabb1a624a1d6014423730d81647a24468a2755c4e1a149b73cde8248a48ab6bd747667ac48177644ece4d1c9b9d35faad7e5e30e804f8f7cb4f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
f27f55b6993f5ae016aff49f1ab915f8

SHA1
663823908dc642222cc9d06210cad083d62250ed

SHA256
c396ca627675ce80a5bf8d75871a878c1f2c675d22cbc781a4eba067d46fa7b2

SHA512
f5db49113ccc31e3ba68eb1eee2c755af750493d5b619fe2ccd9a630cab340bd94691ec7623d78ac759bc0a49a7a2a31d3b141c91795786649f7f52fc843cad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
f1cad6dd69e854dae500d8da97e2cba2

SHA1
730a8f6fc2e11582d5e039ffcf11adb2d236f5f1

SHA256
2c4e9c8a266dadd3ac5c73e60360266bbfaf139a12effab0a0ed4b2635b1b7f4

SHA512
6b87e492ceb7b9f54ebd03ae734022a135bd2ff92ceef070aaca352a0e4995d65b180aa1bd39a017c88210abd29ff90b32ea84bd8f11ecd7ff304d48538fc5cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
486e715b3ca5475b7273a7d2bf69cbb2

SHA1
97b9ae511028bd2255643bca365962fb31e5ab7c

SHA256
e12e3098819f17ab2bf05ac9502cee7e4b80f13f97b306eed0d5d40fd52544b0

SHA512
35c93d7938c08aa29effb2422fbda14bd66721befcf9c1cc251deea91f6a503c7a4d590ea4f2fc06b260fe19bd807c9d51738f3d8b477f1599cabb5ef2e6531a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4bf32bebe444aaa89dc3873ce6c9dad0

SHA1
1501b0e8081e00996b4a89d644da2bbcc72d8516

SHA256
fea2d96982079a006a7812fea8f302c7d4b23b5a79f87021dcc2d6398bf79658

SHA512
c14567ebbfd530cdcc75847eeca68f0fff303628268576c5750007d3371631962b139c6df0b993eafeb6980a23985c2725289e7016c82553bb21ae97ff3a7f78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
789d7b42be3ec877443f93b271993f0a

SHA1
d3f928156015799c6739332659ae9b469b3658b0

SHA256
31ad2f7def580383613bc322d67738418e46178d0f8f2cb09c0b3ab21ac1f3a8

SHA512
32a3d7ddc75bc9e4f09402e49255c2c5ca1848a9af5aaa807861880b5f3ccc2efcb0ee9dd6c758c1c6ffde7b3b38ebdb23db9e223713d50d63273611800d1961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58150a.TMP

Filesize
3KB

MD5
76798903d33a0338aa58afe22fd468b3

SHA1
b376147ab86f3df53c931b777c88ad6e9b3ddaf3

SHA256
c3d2c8381d3a30b60b38069408f22a9867cd92151cf1d9ced9ff79428ca98131

SHA512
549ba8aca0c10abc4045b2857df0f648c19a918bd407b4e97c5cf3aba2b5030b81236c2d79b1917257da9d677f0bd32b1d6e4d310676ff38c3d7a84a8747be3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0348832-c73a-4aeb-bea2-0fab3287c08c.tmp

Filesize
5KB

MD5
9ee39582bc01eabab1c4b0ab303b6047

SHA1
13f99b77e4c743406a7387e948ac7745ad1663a7

SHA256
7bad47950f42a2927570c07b2c3e602859a1f29bc128bff2cb2078bfd87b891e

SHA512
73210717431b69d1fd8259f315aa3c973e10b41d5bd81c34e65ad36fdeddc887e5e8509f0c2a63fb8c77d6828061b7a891e0d9b60a604eadb07f5150ddd67700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
be29925fb9860b195078e9264e240ef9

SHA1
8275b69e0d671900785731b72fb061e4f033c44f

SHA256
9fbea1bd1b851b4324ace12b85dd94adc8f397e91457f8414c35236f6d6465e7

SHA512
40c874b1f9fc3ab9d0202a79895a70b41954f0831cc7e07583263f39c4baedc1595e5ef78d5dc8f08ef19e5d7973a488bb1e7e16f3415512aa140c6b9b4aa938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
926597c4da561038503ebdb597fd3396

SHA1
93a0a5caf317988afc20837e272892d37c621151

SHA256
dd2eb1a0ac43ae30648f4558d7f9177bf51ef11e19ebc1985ef936ae2493c4b5

SHA512
44a8346c4423cbb6d1b7ab8e4ff689b1c78bb4fdb5cb7d59d590231376afd91cb9031b49477cd3f7b5306d9aa8451e85094f65825bad23eebfe5b3fe0f985c06

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 897378.crdownload

Filesize
39KB

MD5
073ed9d2622655ef3361165c9e8a18fe

SHA1
0c8a6a9a637cf0a550e5f52d6e1c8ef933398e67

SHA256
be77152df06ca534c08c058837335dd2a699d12a04c5593fa79a1d1236b533c8

SHA512
a0e7ee55f5fec9458da7ac4cf05c73d057f405e9c3643ba4cbe0d3eefd38b1ce7afdd4ffc37cd06094dd5ed57fe55d41ad6b4d55c7d96549ad0c5d855fc2b435

Download Submit
memory/3776-251-0x00000000005B0000-0x00000000005C0000-memory.dmp

Filesize
64KB

Download