discordrat | hxxps://gofile[.]to/Wox4/atrgnp[.]scr

Resubmissions

01-12-2024 23:06

241201-23wgrs1phm 10

01-12-2024 12:53

241201-p4tcks1rcv 10

Analysis

max time kernel
105s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.to/Wox4/atrgnp.scr

Score

10^/10

discordrat discovery persistence phishing rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMDIyNTc5MzIzNzkwOTUyNA.GO7zwM.BLjqjzDn0kcO7VsPUa5W6XeYU7X3NlqlEDHvk8
server_id
1160151795734163526

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: sweetalert2@11
phishing

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

atrgnp.scratrgnp.scratrgnp.scratrgnp.scr

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	atrgnp.scr
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	atrgnp.scr
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	atrgnp.scr
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	atrgnp.scr

Executes dropped EXE 11 IoCs

Processes:

atrgnp.scrClient-built.exeatrgnp.scratrgnp.scratrgnp.scrClient-built.exeatrgnp.scratrgnp.scrClient-built.exeatrgnp.scrClient-built.exe

pid	Process
988	atrgnp.scr
1868	Client-built.exe
4932	atrgnp.scr
2012	atrgnp.scr
5252	atrgnp.scr
5464	Client-built.exe
5728	atrgnp.scr
7152	atrgnp.scr
5700	Client-built.exe
5908	atrgnp.scr
3268	Client-built.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

atrgnp.scratrgnp.scratrgnp.scratrgnp.scratrgnp.scratrgnp.scratrgnp.scr

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atrgnp.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atrgnp.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atrgnp.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atrgnp.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atrgnp.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atrgnp.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atrgnp.scr

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 7 IoCs

evasion

Processes:

rundll32.exerundll32.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\ScreenSaveActive = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Users\\Admin\\DOWNLO~1\\atrgnp.scr"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\ScreenSaveActive = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "900"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Users\\Admin\\DOWNLO~1\\atrgnp.scr"	rundll32.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 326083.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
540	msedge.exe
540	msedge.exe
1724	msedge.exe
1724	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe
216	msedge.exe
216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Client-built.exeClient-built.exeClient-built.exeClient-built.exe

description	pid	Process
Token: SeDebugPrivilege	1868	Client-built.exe
Token: SeDebugPrivilege	5464	Client-built.exe
Token: SeDebugPrivilege	5700	Client-built.exe
Token: SeDebugPrivilege	3268	Client-built.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 1724 wrote to memory of 700	1724	msedge.exe	83
PID 1724 wrote to memory of 700	1724	msedge.exe	83
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 4108	1724	msedge.exe	84
PID 1724 wrote to memory of 540	1724	msedge.exe	85
PID 1724 wrote to memory of 540	1724	msedge.exe	85
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86
PID 1724 wrote to memory of 4856	1724	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.to/Wox4/atrgnp.scr
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffec32646f8,0x7ffec3264708,0x7ffec3264718
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1756 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,14714372738543137540,3465446110533880348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Users\Admin\Downloads\atrgnp.scr
  "C:\Users\Admin\Downloads\atrgnp.scr" /S
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:988
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- C:\Users\Admin\Downloads\atrgnp.scr
  "C:\Users\Admin\Downloads\atrgnp.scr" /S
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4932
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Client-built.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5700
- C:\Users\Admin\Downloads\atrgnp.scr
  "C:\Users\Admin\Downloads\atrgnp.scr" /S
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5204

C:\Users\Admin\Downloads\atrgnp.scr
"C:\Users\Admin\Downloads\atrgnp.scr" /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5252
- C:\Users\Admin\AppData\Local\Temp\RarSFX3\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5464

C:\Users\Admin\Downloads\atrgnp.scr
"C:\Users\Admin\Downloads\atrgnp.scr" /S
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5728

C:\Windows\system32\rundll32.exe
"rundll32.exe" desk.cpl,InstallScreenSaver C:\Users\Admin\Downloads\atrgnp.scr
1⤵
- Modifies Control Panel
PID:5860
- C:\Users\Admin\Downloads\atrgnp.scr
  C:\Users\Admin\Downloads\atrgnp.scr /p 66644
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7152

C:\Windows\system32\rundll32.exe
"rundll32.exe" desk.cpl,InstallScreenSaver C:\Users\Admin\Downloads\atrgnp.scr
1⤵
- Modifies Control Panel
PID:5136

C:\Users\Admin\Downloads\atrgnp.scr
"C:\Users\Admin\Downloads\atrgnp.scr" /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5908
- C:\Users\Admin\AppData\Local\Temp\RarSFX6\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX6\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
46a615e07a914820b47c837f42909f88

SHA1
1883b88b69783086b139dbc153dedc73a519e4de

SHA256
22afb4b45fb11a44e27a91d504f572321489026160d97289bbe2f89b3d1d38c1

SHA512
a8193cb6dbd70321bc23cb53b8d829185e5f2be2a4ad2ddf8db614f33189cda56313a48250a701876dcbce29c28536b82f76df35a97bf7800c3f31e83ec16dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
430d98b8b07217d6674c71be2e0ccc66

SHA1
496762e1c7489b83a62c56f8dbfe3673a0e93e46

SHA256
ff584e59791a45630c642e57567e3c67e02f71eb5db7d8dd339be331eeee7e0e

SHA512
b7d55914515477331ac5e0218ce4b4dccb0fbbcceb89fb7d7088d298993852b0fd3a27049f9c53c96384c38371a9cb7c9033b4503d8f64e77aaad803ae4703fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ea05dfd00c91dfd8402593f3570d4cb8

SHA1
7d7bf31145245bf36614cf10c391624b7cbb8f0d

SHA256
89d970d911259e768c58061b2a0123186230af88004eb5fc8c73ae846b8f4d4e

SHA512
8530e1ce2c93613aa2ff3cb99317cc165c05bed5cdb85370590edece53c00731e81d02aa2a948e7ec65eaae5c770a2ce8493ef65df69bee3326770d36a9349be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ecd821e93639c5f0a3b34b8b68ce6111

SHA1
d67ea8229995922656091174aed52deaff3d4a1d

SHA256
f884dfc990d61c7a7d15db593c9848020928303d08d45dc0a91fdacd9c035d8f

SHA512
75a6748d12a3946c39cd6b75359885e04c461293074a6e902455ff13d39f3c6bfdea53c40993142b959fa0056bf50d1ae6562f5aa4374152c1aaa65969b7ecca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1ed88a8ff6e5c0c8b3b3f07f497bc82

SHA1
5274bfa524f7224c9809e813ac580d91cbae72b0

SHA256
7f38ed582bff4259d8495fcf6e43aeedc79c96d6fb9f1c5226d1ce4763961b60

SHA512
70023b5cf1643b49701add1a296ac946c88ffb25827d05fb96ef4f7f206208c711f28fca5ffc08c51bdae181e5d976ff99f186b2e7433322c572ec339e0cb297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a8f274915142e91aa958554099ace68d

SHA1
24be2ea24cefa5cff8222ab6d1a454dd421a9262

SHA256
b6d332db824c9c4819e3b757d25dfd09372d1de44603a0c510c015473500cee0

SHA512
ba4c5bd2ceb7607c742770a07f9315ef5420d923701a8844602fb50ee6328aecce283dc0c87750f2d91c59509d870734d22e4244e034af47dca6f2c9c2e68ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
216B

MD5
d826b13585a415d93a7de72b9dedc766

SHA1
53610eaa910186a4e8ff96327ccf408526a92aaf

SHA256
05839fddc000cb0b356481f256cfe55317462499d70c82646a0d23b0fe47f6bb

SHA512
ec6ff9a59a1d817982fcca09cd0fca85dd880193b6e72621fbba46e0b9bbbb6356272b3f75f6aab321718d6cbc1aa937118435adb87bd619a8dae28ec595ce1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5881be.TMP

Filesize
48B

MD5
6c81b6b2507c19b2a3a7fef2bbc5b73f

SHA1
f2bde3ca2f952d43a5411e013c53f7ec26a3a047

SHA256
ed0abf78dd775c51b74815a35a55c7b0c68814d3d0df9ed6a1ef04d5e63dbdbe

SHA512
d99920dc10ff93a60a35d67dd9a8efb8d99d0c9de0e4970101cda7a098e989d6d0f1dfd7a073ab3de34a353e59af8584524e554878e0236f9e0c4a847630d2f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584215.TMP

Filesize
1KB

MD5
96e195a2e87889b4a8b52a680932e33f

SHA1
ee11b1b59cace0176cf56d28e3e67efcb11f6361

SHA256
b42095cb5b5eb17554f23a70a7b60ea84c8fcbeaf95d2fee2f5f869e66cdb80e

SHA512
4f516796814d5f9746b14ba802487696ef787596c78cb88e6e6b12394056f007a79ba48bc36a9d8cef0a35cfe2f16bf4d694825f6be53d38415c672530742bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c85aa869-3b83-4de4-acd5-eb612b7dda13.tmp

Filesize
1KB

MD5
782d31ca94f9b028c76a67d3f30d9b78

SHA1
00b0507077cd089590dcd8de2de77cc829c37bc0

SHA256
d1ad15aa66f088b568c91bc06e7d5b8b66eb95a4b99d57b2d1e2269c12428ac4

SHA512
60547f45c6955ddbdb04d36b3c1f61cf19ff7d9f87cb3635d2f90a0ddd837bb6c4a31884e191298fb4da28af05b126f42f3a556aedce4d94434915c7b67216bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
42fcff68bd7398d0a60ffbb9ac7dac5d

SHA1
39f20f7e888e3c7ff8761f3bfaf3dbe7afa60707

SHA256
f9dbd5cc9d668c4ac53192d9ebfd3f8c003133630331c9537dd54861e681044f

SHA512
ecd33e275290c8ec467e54bc5b41b4230ff8be08320005d252264e7f504392793112db62ba3013c4d95bc7f4fd58e16149d38a0ffb2394b172d96ca9171a6a05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ad3edf2de6e8fc2fdc6549335506d2bf

SHA1
0f2f4c260af73fa0488b14f5ea53586e2690b552

SHA256
74e17b778ed4e0f42ece673d49f6e239241e464a07837b80ed8873bc9f47dd29

SHA512
16e3736402197f16a8c5d665886892206e81a34971ca2edfc7aded9b4f070cc0a31143f1e20e120828fcb0784e0b0101ef83a61445c6e5eabda3a1712fca4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
1348e4e8fc451e8021f935f4b1376c95

SHA1
c6fecb47e09a1a255cbe9a9f03d91d2100cd1737

SHA256
cdf0440a375c4d4a180a358ea3c87448482622fbc71833bc797ec1410e54bb01

SHA512
ef23469825048d1fdc7f693a9efce5a1bdb8472743917288fa06244c7172d933347d8403440598a9f4062b3514ee313462655e21bc1c1a8dde78cfb607796703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
89a55326030e40e610f14fc9fa6ff992

SHA1
24629a0bc92d575a2d0be0631e47486f88c66c31

SHA256
20e6d1b76b3f22c21f0d9bd3075715d275b2173e3f46f60b46af95b9488fcca3

SHA512
2c383f9918f8d215616fc88fe830941b92e8a1be89c5ba2451861ea4693c45e8c7d323722f19e4b3e8457ba29f7e452ecc041dab2e7b3569763c71fea75366c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
3527756b7de42caac0bfb8f3efac39bd

SHA1
08bb7b9970fac86e2232a892d4c82e7e404e81b5

SHA256
742da6a33eb1d419f761e8f16148190d3abe4e9a399645c214431412f89e5c2c

SHA512
64e996aafb710fe92fdb2c22365e5b8d6fb0748c5d4df45a01c446bd826114a82fe87defdad9d37c91d60c9cd7dfa621494080741679b81551722a10ebe3e7ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
43ade1e473c20aa879f1dc9bfd39d314

SHA1
55020b0adfa3dd637b42ca6a67de6598b00c6897

SHA256
e80ce00218097469fa2cadd1cbb2b1b6c980f764d7dabcbcd7ec63c424388adb

SHA512
c7f8ae2779f44c50d612bd32b44bf4eedc25cadd8bdabdb04ff99a663560779555f52e236233a3b773baefae09d45d9a566a2b7da7e059c5eced072441cb74cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe

Filesize
78KB

MD5
cd92dc0ece8c10cd8ba6a5590ecb8408

SHA1
dbbea74031adf85e0356772e2c58d3152e9bd357

SHA256
7cce0dc8fe5f2449e4d4357f3bfb759e3ea454735e2e413d03c84526c8002c40

SHA512
a94f2a1030f8eb282a504312e9623c23f00d4d649a3e1568bfedc276da307a542888945f2ad3494150cbe29e0be95361b0f90ec461a71eccace26a233ba5778d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\atr.ico

Filesize
264KB

MD5
e300a9ce7758babfe9ada3be17f37dd3

SHA1
89640c086b1079f8e4b3057e2774657ccb9ae40c

SHA256
f7e53bf589ec33ceb92da6c27e5c16f18ef078da348dae378a1f42d9bff25e4f

SHA512
661e68a74bffd83e49b8affdc76a980ec2c8d6aa83a9d7059eddf6b3865773603dd741e760829bf846baac514e7a4a4f57bc9b5f1ce36831b7c7b97e322c48b2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 326083.crdownload

Filesize
686KB

MD5
f63299c4377c4d75b31d58e97d7ae4e7

SHA1
a6802ca3880cefccbc5081a78831a3d978c844b3

SHA256
37ed0e9e2b26df1b341316d0b45c32d14b7b19f7667c496e01d4b117636eb870

SHA512
dc8ef84530888dfb82b49bc7b2195c2905c4d94ccf92322f2c2ab5a1a3c447b70cffb6355c59a34ef3c06a1b5ee3b66c2be8212eb42083c9477ce7d93fcc4875

Download Submit
\??\pipe\LOCAL\crashpad_1724_YDMMPCRHMZKHTBRQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1868-289-0x0000027262C20000-0x0000027263148000-memory.dmp

Filesize
5.2MB

Download
memory/1868-287-0x0000027262340000-0x0000027262502000-memory.dmp

Filesize
1.8MB

Download
memory/1868-286-0x0000027247D00000-0x0000027247D18000-memory.dmp

Filesize
96KB

Download