hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/tree/master/RAT

Resubmissions

01-12-2024 06:01

241201-gq558axrhs 10

01-12-2024 05:58

241201-gn6zqsspak 8

01-12-2024 05:54

241201-gl2l8sxrc1 8

01-12-2024 05:47

241201-gg8vraxqg1 10

Analysis

max time kernel
165s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/RAT

Score

8^/10

discovery upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 25 IoCs

pid	Process
3428	BlueScreen.exe
3568	ArcticBomb.exe
5020	ArcticBomb.exe
692	ArcticBomb.exe
1756	ArcticBomb.exe
1920	ArcticBomb.exe
4924	CookieClickerHack.exe
536	CookieClickerHack.exe
5084	CookieClickerHack.exe
4896	CookieClickerHack.exe
3780	CookieClickerHack.exe
1864	CookieClickerHack.exe
1292	CookieClickerHack.exe
1632	CookieClickerHack.exe
2980	CookieClickerHack.exe
3952	CookieClickerHack.exe
4024	CookieClickerHack.exe
632	CookieClickerHack.exe
4432	CookieClickerHack.exe
1324	CookieClickerHack.exe
2308	CookieClickerHack.exe
3540	CookieClickerHack.exe
4348	CookieClickerHack.exe
5108	CookieClickerHack.exe
1512	CookieClickerHack.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
52	raw.githubusercontent.com

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023caa-213.dat	upx
behavioral1/memory/3428-226-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/3428-228-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/files/0x0008000000023caf-262.dat	upx
behavioral1/memory/3568-304-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/3568-307-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/5020-311-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ArcticBomb.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 565083.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 763445.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 764437.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
2384	msedge.exe
2384	msedge.exe
3264	identity_helper.exe
3264	identity_helper.exe
5024	msedge.exe
5024	msedge.exe
1460	msedge.exe
1460	msedge.exe
3516	msedge.exe
3516	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 5044	2384	msedge.exe	82
PID 2384 wrote to memory of 5044	2384	msedge.exe	82
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3236	2384	msedge.exe	83
PID 2384 wrote to memory of 3424	2384	msedge.exe	84
PID 2384 wrote to memory of 3424	2384	msedge.exe	84
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85
PID 2384 wrote to memory of 1860	2384	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/RAT
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa5c046f8,0x7fffa5c04708,0x7fffa5c04718
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Users\Admin\Downloads\ArcticBomb.exe
  "C:\Users\Admin\Downloads\ArcticBomb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3568
- C:\Users\Admin\Downloads\ArcticBomb.exe
  "C:\Users\Admin\Downloads\ArcticBomb.exe"
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12368117599130296145,14364814347259347137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4740
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2004

C:\Users\Admin\Downloads\ArcticBomb.exe
"C:\Users\Admin\Downloads\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:692

C:\Users\Admin\Downloads\ArcticBomb.exe
"C:\Users\Admin\Downloads\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:1756

C:\Users\Admin\Downloads\ArcticBomb.exe
"C:\Users\Admin\Downloads\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e343e7c-7145-4a81-8b6a-52ad1b212ee5.tmp

Filesize
11KB

MD5
4393756c7ba40c14a7fa5cfd9822c5c0

SHA1
51045d096ab7bf0d61c8ba33a1deeb9641dd5d09

SHA256
f00e5cabee1e42b4b333545304d65901899f9d941ee465e56a40ff68263a4f65

SHA512
37c640ccb4a2bf11bd257aac8c24021e1e33fbf130107b3ce2acc42281a13668f084b13a394de79480673f2d34b3b6440ed08f50b9a5e38b7f529b182bbff574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\526bab1b-0e10-4fce-9e57-9b25324f3ca5.tmp

Filesize
10KB

MD5
54426898423ff1c4b53a2808502d5436

SHA1
9f442a8b4bc8029a198eaaae353160df0faea836

SHA256
00b8d9cfd1b32c2f6c61cce95b3699a8f218250f00a2ee67b5ca83cfc327c3ec

SHA512
9775ff90592eb17b0e037ee39141b77c2e6e5e3b7baaeb4480694c83feaaf60351942e982e9b3853b394c76962fa1e2dc271d78784f62a80718025893f467fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
95bfa7fa38c4f6e8be1c9958a272ac08

SHA1
024aafc2e3a83d2095f9c7fd079dc87b6e3d9fdd

SHA256
4a8265c97d2dfab8ef292252c77c691c906013c661f22759498bf122d51a31f1

SHA512
415d106b8851e2448677e86531ef3cd78e9a15b705884c2105e0a99d9bfe3a7779c370c8c67bfe5a196839fa4f22aebb964806754e9e41ea04c4aaad153d6980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a7d1701142cca705f833d70023ef4e1e

SHA1
1b76853132abfcddb4fefac42bf9df5d013c9815

SHA256
6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

SHA512
806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f522c1778db5666c5dc590933e51529

SHA1
9bbeebf2c588f4280d8b9c6f24b04652da9dc80c

SHA256
b0897bee6ea6e0a40e3cd0230c831c82b340206ec7132ecb4316ccdbc8218c70

SHA512
5050cd4743541ab76cdbd26c479de34efff70ba4cc8af92a35780daf2c7f8696ae928c7587258496c4fabaf36085da6f2f4d50fdbdc3cfe42bdd9701c3e31039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ba6144ea8754306dd7efe824e194449

SHA1
8f37727fc133d17fe5626c4d0ba0d88de33c26ec

SHA256
7b731471ac69f85460479e20f9d79dff279f148b834651ee4688ee8ef8007744

SHA512
6d5db89d7d67eb217d4986889f80b62c5226da0031c14a947f258ed7fc3682511735d3b9a0f8112ef88088f9b1b2ab3e517a61a5078df601aae4d4ab701fb79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13d87aa170d2eae183d179bdffbb169d

SHA1
97ce416ed6614708d1275d5c03f74ca448c8464f

SHA256
8132ed202a610973a9875cea7989a9244ecd02c00bbd585ca998ef1ffcedf181

SHA512
65983362630f0eb5dd3904cbbed058cbf0751497ea7c83651cb03af6c342755e5be9aba26fd9c3ebd310751586b39dda33679fac158bc1abf5fbacceaa34b30b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
687c53c6fc501bcb09a2a9b36daab17c

SHA1
263f9b399936b69517c2e74403c67802de0241fe

SHA256
35bfb2ea07442c835f10f67e0f657b93c19e41f1405c61d5b19ee52543b2d2f1

SHA512
12dd829ad1ea621ae04dd6999dce18ea7d98f745987e4b7cd1e73a6961bd8f15d6115cc0030e6a80b5331e6b85b803d74e71f65837f36d3a4ad9dad641752dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9ee3e8163aa4184252770e9fe469e7ff

SHA1
e414a3608d3aae1fb82e639d28ef2d0c88b46cc5

SHA256
1b9dc33f0b84925f9dd9c79df350710d44ea36f4750652e25609a410073d9ffd

SHA512
39877e3a52d7f96160ed393b929f7f8fa1a4b8ea4a0a9f9b8f67a9a90daa3af9fddc1b3a9ed5537236b5ad5844b70fa07ecdc54c2ec4a676f023857b90ecb0fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be7324a62a9863a12d7a1aa2aa5d78bd

SHA1
31a4c176c684e99d246764e3d6be1782e8c4adca

SHA256
f7b44dabd2cab4c5b02c136e995039eee45a11c1d5060c437cf16bfb547e3b51

SHA512
53f9f849625ca3d7a1829d05696af0a80ae2cfe73ba59f0caba48ead8baf9ed5793d8cdc2696fdac677bbfb16dcfd0aecbd117c7b968afb99052c74e8cff96c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c263741214142516aedc63f6e284ba50

SHA1
e561b5c16fbfcd7867e6135b5f92e339b48b272d

SHA256
63c4045d78d12f76eb281f212f8e44c25831e089217180470c36ce1074dfd91a

SHA512
486f02b94792235911d0c14c4530b3182e82608a59e0a608abd90027c9f026dedd695cd986ff35bd86547e942282a5bdd4e1eede4742f1dce8135dede6ae5e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6ef2b9b48afa8538003dae61d5b83309

SHA1
53f0d47e52730a1a346231c60c94f6ff81bb5ad3

SHA256
21e073b1101211d6eea2fdf7e7cce86ccf35cbac52db8922317267bdb0af2c90

SHA512
e64bae17af945bf79078150c37c0c7510da30ec320ee3ea5ea6c43f6ff554876f448493cd7715328ce473639fb931537cb2c4fd15d45b5e91225bfa9bff3c9f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
34d816f5cab08ad45ce2b78977b210f6

SHA1
6622210449572e8815a5e1e344b3125c2b97bc4e

SHA256
92089a0a64af2dcbc93219a4c650dd3f084f9d64b46336c1d5ddec06790a562f

SHA512
99b08718a2118af830a435242f5cbaae2e0f68bc1787b0f2d2160e9a6bce80aee2118410f589589c4c9bb06ed88ac0651633323488e3ef72b6c9a2e7f3d209bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5fd858.TMP

Filesize
874B

MD5
781c420bafa15c074148aa515ad555b4

SHA1
f91286f1ae0871abb2cf364ff25336c501f1ef00

SHA256
2b03cde05571ce227cf062e55bc3e38f5a90f7e67f0e836f847b2b221150cc10

SHA512
49df916665c223d95b352135db025586bcd2830b49539fa794be05b10e30297ba8e48bc8e1a8e10a9ae706e705d5944b2c67b25d6ce700d5b2db938101d6b179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46bf622913c779e2859efee06f928ff5

SHA1
b52bdd63fad428ba17454d9dc3e27536e0ef1e61

SHA256
0ce2f17e074c7bbdf1e274162f9d9b0df12fa4ea2bb80b0f1c989559c4888c51

SHA512
f189485c7bb8dfa8508140109715a5766b1009fa4824385a02b37d2304d3c9a30cafc37f965e0153c075bcdf091523a4a8007ecffbf38117dfb33dc17c983902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f45ee6a507f21f2c1f6030d05147c20

SHA1
9613ce7c35068eee2b596ddcad65c4f798b23533

SHA256
8f274e2a47287bbef7e54bfe1d2098728a5b5e2076583629c8927d0eaad64f2b

SHA512
60aa39e30e0c0057e96b08d4be020f860ec08c5c4dd1de4521f3782094eac8504cb5ec21482b9bf3c96d5bb2700e4030ea625b30ff0ad193096c79b543b34bc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
07923e54d1d8dc47d3707f8c3cce1ab3

SHA1
0c18dea7f1d226c943c31e27f24f82a8bbed9434

SHA256
58b821b4c081630468f15c7ea7f9ec5b90a97a335c7dfcb30213e4ceb7c7151f

SHA512
060018057d787ee95488ed3dea1b86b026698efa16f9f1649c3b8d743ab01eef630955570f9aa58cc4337812027df3a860eb311354e68a6087ac4e2cbc7c61ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c0b913d7f2a3e0bab3de8341a7b18145

SHA1
003673257f3c29fe4b181fc4de9feb120cd06072

SHA256
bd8576ba298feb478a97ef874bc8acba63f5e521725d808395b2ef24571ce5a8

SHA512
6778b9a7f9b8ac330d0ec6fbbc02242a1545155dde5e2f8660b92137d50a509d770f51f7dcd2025cef84c84f7af365b1246836cf964729b0ff9d3a0e88a93b4b

Download Submit
C:\Users\Admin\Downloads\BlueScreen.exe

Filesize
9KB

MD5
b01ee228c4a61a5c06b01160790f9f7c

SHA1
e7cc238b6767401f6e3018d3f0acfe6d207450f8

SHA256
14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

SHA512
c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 763445.crdownload

Filesize
125KB

MD5
ea534626d73f9eb0e134de9885054892

SHA1
ab03e674b407aecf29c907b39717dec004843b13

SHA256
322eb96fc33119d8ed21b45f1cd57670f74fb42fd8888275ca4879dce1c1511c

SHA512
c8cda90323fd94387a566641ec48cb086540a400726032f3261151afe8a981730688a4dcd0983d9585355e22833a035ef627dbd1f643c4399f9ddce118a3a851

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 764437.crdownload

Filesize
68KB

MD5
bc1e7d033a999c4fd006109c24599f4d

SHA1
b927f0fc4a4232a023312198b33272e1a6d79cec

SHA256
13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

SHA512
f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

Download Submit
memory/3428-228-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3428-226-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3568-307-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3568-304-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4924-409-0x000000001BE60000-0x000000001BF06000-memory.dmp

Filesize
664KB

Download
memory/4924-410-0x000000001C4C0000-0x000000001C98E000-memory.dmp

Filesize
4.8MB

Download
memory/4924-411-0x000000001CA30000-0x000000001CACC000-memory.dmp

Filesize
624KB

Download
memory/4924-412-0x0000000001880000-0x0000000001888000-memory.dmp

Filesize
32KB

Download
memory/4924-413-0x000000001CC30000-0x000000001CC7C000-memory.dmp

Filesize
304KB

Download
memory/5020-311-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download