hxxps://cdn[.]discordapp[.]com/attachments/1307614621120856109/1307633817116348416/SteamtoolsSetup[.]rar?ex=673da764&is=673c55e4&hm=73252d00b855426c9ea488a4787e8cba2efdb24e1753b0fcf8b9871c0d6245b5&

Analysis

max time kernel
372s
max time network
371s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1307614621120856109/1307633817116348416/SteamtoolsSetup.rar?ex=673da764&is=673c55e4&hm=73252d00b855426c9ea488a4787e8cba2efdb24e1753b0fcf8b9871c0d6245b5&

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2564	SteamtoolsSetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
3656	msedge.exe
3656	msedge.exe
1924	msedge.exe
1924	msedge.exe
860	identity_helper.exe
860	identity_helper.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5684	msedge.exe
5684	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5672	OpenWith.exe
444	OpenWith.exe
5316	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	1956	vssvc.exe
Token: SeRestorePrivilege	1956	vssvc.exe
Token: SeAuditPrivilege	1956	vssvc.exe
Token: SeRestorePrivilege	5316	7zFM.exe
Token: 35	5316	7zFM.exe
Token: SeSecurityPrivilege	5316	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
5672	OpenWith.exe
5672	OpenWith.exe
5672	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
444	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe
5056	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4564	3656	msedge.exe	84
PID 3656 wrote to memory of 4564	3656	msedge.exe	84
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 4800	3656	msedge.exe	85
PID 3656 wrote to memory of 1408	3656	msedge.exe	86
PID 3656 wrote to memory of 1408	3656	msedge.exe	86
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87
PID 3656 wrote to memory of 4972	3656	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1307614621120856109/1307633817116348416/SteamtoolsSetup.rar?ex=673da764&is=673c55e4&hm=73252d00b855426c9ea488a4787e8cba2efdb24e1753b0fcf8b9871c0d6245b5&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef75646f8,0x7ffef7564708,0x7ffef7564718
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,5689840854506471251,16767072028759787980,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault9c2c81bchdfcdh4710h9077hca5b627c3520
1⤵
PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xd8,0x12c,0x7ffef75646f8,0x7ffef7564708,0x7ffef7564718
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3196644587900184901,14617676843411530472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3196644587900184901,14617676843411530472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  PID:4084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5192

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbe84a733hb9c1h4974h8bb1hb06facd3f64e
1⤵
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffef75646f8,0x7ffef7564708,0x7ffef7564718
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4722413268836502413,7786910684268072777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4722413268836502413,7786910684268072777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\SteamtoolsSetup.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5316
- C:\Users\Admin\AppData\Local\Temp\7zO4C4D795A\SteamtoolsSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO4C4D795A\SteamtoolsSetup.exe"
  2⤵
  - Executes dropped EXE
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b8ef0103f228c9db6d2d0ccde16d963

SHA1
2c5e720e1213d0afcb04b67141bd8dfc72a236ca

SHA256
2fdcb0f33f3a49674cab1ffd8429af5fb1b29bc041fcbdb3aa6b6bd51d4a7d45

SHA512
3b1520fff4aee7e24a9d52df2bd928321080cadfc2fe8dea65cf06094f66de21dd759edf09ecb73f6cb1edcefefa8c5a77da5b5c23be67ba61f5a6e2b7581cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
355f6fc0b87fc1f4b712742c193db600

SHA1
bfe9b8a3f357c325687c038704d12b9735423020

SHA256
4725b22968b6a8d2318840af119c2b3dbaec52a478a2e454e5b8a196cbd59f19

SHA512
a7043378e1a70a5957a384e3e5a217a8c9142fbe23721855b7b610c9c133189a13bf3f70b24a2a586761d6cbe49101259b92d0953a213d5706c5cf44ba53c576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a417f7f3e58ac5d3df0b1ec4a0c295b

SHA1
3d3bf7508dd34b0ec360ba29ce526c3c8ffada5e

SHA256
05723e15a9b8b9781c848e2ab383589157af7a4f9e33e019355b67873f361aa5

SHA512
7dd1567474eb9a3e095f36e7396d679170ff27d7fcb99a2c107d65135eebe527bcd3a2fec37aae1711f55639a69da73a4561396b75ceb6942d8e965bd2f93af9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7eccbf28da5f008b93204c65ce232ed5

SHA1
0a9d461408c3a5f111113e54ec85103b0efbed01

SHA256
0df5a13a1e59f6f34563db578ab457f48dcaad42ff4a146dc73de5e4ffd57bb2

SHA512
0e38788d4ac58231bdbfc623665394c123b1bf5a356927a3db151bdb901d73d22a9f6a11dbc4a00bad6379433adccb7e9cede9971ff5c53b522f03182ab01396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee362d2bfa3d68175deb48a9361585b3

SHA1
bc95aa12a7b16a2cd8ab9aa6b40b81373b5bf843

SHA256
126b5af5ee8497030bd225a498008211e884c69c39725e3a874833962918ee87

SHA512
275a98392197238dd2d7f1b8bfd89b3cb241d0d1770354fc0123c2d94b091c72c79137da6b8a85de35395e7f2561c5fe8ba6de61c9208264ab788213ee45c8df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ee37ee8c8610b066df069972199d6318

SHA1
e599803351c8cbff813a653ddf8bbe3acc229512

SHA256
c20d368a7fcbcde146fe0d72f41c290bdb6c5d31181fd3c6b28f8e44c68068f3

SHA512
86b810f2eef6f1e451986734698b2e29edf22df9b65036cf2c99ca70fe6b571e3248998f3bae8fd5e284addcefed6fc891267ea3065977fcd68f0dad0b32bcf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
27a5f235defb76486815ffa24ce18744

SHA1
01e2403964c6a6c47ea3adb6750a521efc50e848

SHA256
804e2c415fa39ee419b4878325f44e2f05dac4bba63da1c58cce2eb949a1da66

SHA512
5f166148d15752a1a0f55e3562c6f3508f60183d2aafb23690fc7f4a2231a3e74e58b7ab89b3bb1eb50fb3d0a0b883d170519eada281fd2268294e4aaaf3e736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
293c620f001be680ae9df88b01bcb99e

SHA1
5f8b90eb84f052a7a7a035433178b1c72899544e

SHA256
11e9b1d7d257ed509b56bc0e931e84aeb11021761b669d06f9a9b41031b3e9f7

SHA512
2f9e491ede4280705d5f01a4fe530633ec5234719d2933a04cd8aee5a33e932eed161930adc62219b60760ecfccab2eab9a48329d0697dc22b1e0c8b4d1059bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
343d0b69e83cbd8e9fd2936861b9366a

SHA1
005ada25d36393f54ba47e5d691ecbfcfb034a23

SHA256
8bbecf23697068894e00b4d27a36279d7e5f71f5413ac43bcb8b620f327f6e55

SHA512
7af2fc8fb2cea5f2f3c833b2e6bab106cf2984f64645dabcc797f4174cf1576eb95b2d461be9de63fc48d98fe1b91141566429a2c9e44089fd5d4f76c314e160

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO4C4D795A\SteamtoolsSetup.exe

Filesize
2.7MB

MD5
5321690369d17547a978cd28f45f5ea6

SHA1
173b7be12e9ef3af91e2a7cbfe63a313134c9e32

SHA256
14224256268d10452893cae5d330262b6dd8f854e7f2e8bfbc2d050eb0d0f80f

SHA512
4f2aa0801d685195570c62ce19335465e85d19f04335fe56945207482893d1181c04bbfe18230bf0a490f8f5cf2998bee7f2c1c17146126555dd780d2dd085b4

Download Submit
C:\Users\Admin\Downloads\SteamtoolsSetup.rar

Filesize
1.0MB

MD5
9903dd82739ce37f55d7d29ac6def540

SHA1
5031c0dc612657b1cfb55b1647ece41f5bb41f77

SHA256
a40721b7f92cad1911ce4673cedfc15361809e00dbc0fa7a6f96d56204029cef

SHA512
11cafeec44fd426ff7dc0f9f6ccd115fffebb7fede2e008c2de5381c85b44f4e653756d6dc19d66f52b7afbf4ec7cbcaba2c2c7b379ac146ce9690bdad3784c6

Download Submit