sectoprat | hxxp://tinyurl[.]com/yjc949xj

Analysis

max time kernel
62s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tinyurl.com/yjc949xj

Score

10^/10

sectoprat discovery evasion rat themida trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/5208-292-0x0000000000400000-0x0000000000D28000-memory.dmp	family_sectoprat
behavioral1/memory/5208-293-0x0000000000400000-0x0000000000D28000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GrabberBuilder.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GrabberBuilder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GrabberBuilder.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/5208-292-0x0000000000400000-0x0000000000D28000-memory.dmp	themida
behavioral1/memory/5208-293-0x0000000000400000-0x0000000000D28000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5208	GrabberBuilder.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GrabberBuilder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
2492	msedge.exe
2492	msedge.exe
896	identity_helper.exe
896	identity_helper.exe
5312	msedge.exe
5312	msedge.exe
5208	GrabberBuilder.exe
5208	GrabberBuilder.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5208	GrabberBuilder.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1568	2492	msedge.exe	84
PID 2492 wrote to memory of 1568	2492	msedge.exe	84
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4936	2492	msedge.exe	85
PID 2492 wrote to memory of 4488	2492	msedge.exe	86
PID 2492 wrote to memory of 4488	2492	msedge.exe	86
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87
PID 2492 wrote to memory of 4408	2492	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://tinyurl.com/yjc949xj
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac08946f8,0x7ffac0894708,0x7ffac0894718
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6592598800812686567,13935226725928315192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:6000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5792

C:\Users\Admin\Downloads\TokenGrabber\Grabber Builder\GrabberBuilder.exe
"C:\Users\Admin\Downloads\TokenGrabber\Grabber Builder\GrabberBuilder.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
eeee6b02773b29d425e67cd4fb884c15

SHA1
661fcec2201f8fa0373c225bf228cdaf7cbc497f

SHA256
c6613437260f96eb372e3d7da66bb9e3eafe706f1062d52470dd224123d93aec

SHA512
c4ff830f35ca342541bff3952f850e651156f8cca4a7ae25dd9e196727c4d86d05f6bf1b44bcb2f61bbebbd31488790fab3e0664856b95fd30b74d631814c123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cd6a2816f4d2025e629a7affeba1b438

SHA1
0c2ee7daaad140c15fdee20ec165f001e926ec72

SHA256
d870a64b5d2e68d94488c11d3707b4d50079819cc600806a978d5a9291104cfc

SHA512
7f75ee50ddd38037e0b48ef0933b9617203a6820a8d9e87a7ade4a8ff2ca809ce4348f9f87464bc77f2053c659379fd30765d5713a5bc05cf29fb7595564561d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3bb40ab45e03c3ff920339c11c5f6f9b

SHA1
fc81874ca859aa9014b62507a2e9834c61a3c811

SHA256
80fd2e3cd5521e7a26efec4254ea7f48321f110318b3301e9dada98c410f55ef

SHA512
ff4b2b685f8b490c8d5870a5c398243fb20f9f3883f7b47578e5ea5467052aeeeff83f5f177893a2b799802d173db3a2a38c56136622f342f469e7201219bbb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
7189056d8fe006f0e445f938624ae8e8

SHA1
668a8fe7a98fad0e2073281437cdb9261c052ef6

SHA256
a3129aca1a62a7a6c0cab208325aa4d38b68992896bbdcafae7dbf293fae6110

SHA512
91958a673c9c13ab455b56eaf35a9f4bc5c72e7271aeb1439fc866763eb4787b8dd57f7e9a566f860c512b59898a0b585b377eb8205e1c1a83c6a277dcbdca65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
23c40fc3a989137411a31aab388906bc

SHA1
dc6d6389ffb6fca357a44515fb598a7c32254103

SHA256
ea4003fca100f8deef536fff3e299b36a421b39f9b3bc05d00a9b31d16622f94

SHA512
4e155ab6a476659cfe0adbd50fb1d85a1f70516f82b13807a5356356af2ada6defa1f49a41a583f3a986da4c64e393258a16b94770c20aed8e43024a11832126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e5fb.TMP

Filesize
1KB

MD5
748f2527b4d4d921a7815b3d7cb208a0

SHA1
cbff56de9e9a27a8c85c8c0d532812e139b160f0

SHA256
4e1f25a5340082bb3dc9b8889f65017df267f4ad218bf75c04b2a1e1329931eb

SHA512
2ebdadfc3ca23170058d067124e7580c5f4d0c6aa88fa16eccd882e477720df2f90701ad05bdbbe32b007ddd29c206d8dca25747c21b5aff8ce68c158b4e51fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2ccc0f2ef0d609f530d12c0c8387b2ad

SHA1
01af4fe9796da426d5bd94ba0bdbb001eb97b4f6

SHA256
4067cd6d9a16ccede991b697050a671d5b609f8e28285e4cc2b23190255342c8

SHA512
97545eec10e93ed8b95cba87f76f2b8aacb8e70f69805baf1e08d4f1b1af7a1222f5cecc0ca903f25d990a64f122c5976fc0964af30975f868980d765579c394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
74dc6c97e8ff3bc830fa6743fd34f138

SHA1
48da1523b3fb13ab254e01fcd49315f4eb72dbad

SHA256
d57a0a44811e00be0a706480ceb0a2582585e36664ed9ebc282d5f93327ae332

SHA512
7d108cffcc5b41652d12a5b10c6d2a1fd94e9c6dbb33e0b2b160865340d3073615d2b00eb5df8ec40fdbabbcc97f32a02b1a4838c1bdc6444562222b7d924da9

Download Submit
C:\Users\Admin\Downloads\TokenGrabber.zip

Filesize
4.2MB

MD5
e88d1825e4986a478090a8ad32f37bbd

SHA1
0d46c03a44febdfb6105ae6aab9a03728522912f

SHA256
f4d4a93ecb36d9fab1a2682546bac78f2f9a407ae4a26449e90e5a3dc1051628

SHA512
1624c8ca0e8ac1b51e4bc0d3dfc60a8e9d2193e71b5b3bab28823659582c093840524e98ee016e5e36b38cac1d2e8a081964e1467d90d875ec9f65fd8000113f

Download Submit
memory/5208-290-0x0000000000400000-0x0000000000D28000-memory.dmp

Filesize
9.2MB

Download
memory/5208-292-0x0000000000400000-0x0000000000D28000-memory.dmp

Filesize
9.2MB

Download
memory/5208-293-0x0000000000400000-0x0000000000D28000-memory.dmp

Filesize
9.2MB

Download
memory/5208-294-0x0000000005380000-0x0000000005998000-memory.dmp

Filesize
6.1MB

Download
memory/5208-295-0x0000000005290000-0x00000000052A2000-memory.dmp

Filesize
72KB

Download
memory/5208-296-0x00000000052B0000-0x00000000052EC000-memory.dmp

Filesize
240KB

Download
memory/5208-297-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

Filesize
304KB

Download
memory/5208-298-0x0000000005C10000-0x0000000005D1A000-memory.dmp

Filesize
1.0MB

Download