rhadamanthys | 90c7d3b939db02faf27a670beedb61ffaf33a940119484a1b62dbfe21656afdd

Resubmissions

15-01-2025 22:53

250115-2t2meszmfl 10

10-01-2025 21:04

250110-zwketazlgq 10

Analysis

max time kernel
249s
max time network
242s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
15-01-2025 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKRIPTGG-FIVEM-main.zip
Size

884KB
MD5

e5eb6a37e9cd8d4cd3d3a1879cc71bc0
SHA1

44936b7f945d8d8813e64f9b5708059d9714fcdf
SHA256

90c7d3b939db02faf27a670beedb61ffaf33a940119484a1b62dbfe21656afdd
SHA512

02eb80e5dff1551268abd6d366e36f88f8a940ceb2a4242b677a8823b51217e8fa8548d4abbd3c80ef9a112a2741cf75b09000ceb0da2cfe24df5303865c7cfd
SSDEEP

24576:nZQ6J4P2JcjGWJQmrfjNiVrGroGxgkIKgC:nJCuJQ9Jf/NqrGMGxUdC

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://185.125.50.38:3034/739bd3e91cd40ca83/pancake.api

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 1524 created 2016	1524	RubixLauncher.exe	49
PID 392 created 2016	392	RubixLauncher.exe	49
PID 1056 created 2016	1056	RubixLauncher.exe	49

Executes dropped EXE 3 IoCs

pid	Process
1524	RubixLauncher.exe
392	RubixLauncher.exe
1056	RubixLauncher.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
41	camo.githubusercontent.com
42	camo.githubusercontent.com
2	camo.githubusercontent.com
3	raw.githubusercontent.com
38	camo.githubusercontent.com
39	camo.githubusercontent.com
40	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RubixLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RubixLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RubixLauncher.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "3"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Applications	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 8c003100000000004759a668110050524f4752417e310000740009000400efbec55259612f5aacb62e0000003f0000000000010000000000000000004a00000000001c26a100500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000475930631000372d5a6970003c0009000400efbe475930632f5aacb62e000000e79e020000000400000000000000000000000000000070aa0a0137002d005a0069007000000014000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\die_win64_portable_3.10_x64.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3172	die.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
1116	msedge.exe
1116	msedge.exe
1412	msedge.exe
1412	msedge.exe
4220	identity_helper.exe
4220	identity_helper.exe
2240	msedge.exe
2240	msedge.exe
2980	msedge.exe
2980	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
1524	RubixLauncher.exe
1524	RubixLauncher.exe
1400	dialer.exe
1400	dialer.exe
1400	dialer.exe
1400	dialer.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
392	RubixLauncher.exe
392	RubixLauncher.exe
3724	Taskmgr.exe
1876	dialer.exe
1876	dialer.exe
1876	dialer.exe
1876	dialer.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
3376	7zFM.exe
4676	OpenWith.exe
2080	7zFM.exe
3172	die.exe
3724	Taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	3376	7zFM.exe
Token: 35	3376	7zFM.exe
Token: SeSecurityPrivilege	3376	7zFM.exe
Token: SeRestorePrivilege	2080	7zFM.exe
Token: 35	2080	7zFM.exe
Token: SeSecurityPrivilege	2080	7zFM.exe
Token: SeDebugPrivilege	3724	Taskmgr.exe
Token: SeSystemProfilePrivilege	3724	Taskmgr.exe
Token: SeCreateGlobalPrivilege	3724	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3376	7zFM.exe
3376	7zFM.exe
2080	7zFM.exe
2080	7zFM.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
3172	die.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe
3724	Taskmgr.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
4676	OpenWith.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe
3172	die.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 2080	4676	OpenWith.exe	80
PID 4676 wrote to memory of 2080	4676	OpenWith.exe	80
PID 2300 wrote to memory of 328	2300	msedge.exe	85
PID 2300 wrote to memory of 328	2300	msedge.exe	85
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 3352	2300	msedge.exe	86
PID 2300 wrote to memory of 1116	2300	msedge.exe	87
PID 2300 wrote to memory of 1116	2300	msedge.exe	87
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88
PID 2300 wrote to memory of 3804	2300	msedge.exe	88

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2016
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4880

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SKRIPTGG-FIVEM-main.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\SKRIPTGG-FIVEM-main\Skript.gg.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9228c3cb8,0x7ff9228c3cc8,0x7ff9228c3cd8
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1632 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,13312533963819127371,16136489538753622982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3368 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Users\Admin\Desktop\New folder\die.exe
"C:\Users\Admin\Desktop\New folder\die.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3172

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:792

C:\Users\Admin\Desktop\RubixLauncher.exe
"C:\Users\Admin\Desktop\RubixLauncher.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1524

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3724

C:\Users\Admin\Desktop\RubixLauncher.exe
"C:\Users\Admin\Desktop\RubixLauncher.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:392

C:\Users\Admin\Desktop\RubixLauncher.exe
"C:\Users\Admin\Desktop\RubixLauncher.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1c66975f6870a918946718add3a2477c

SHA1
447a0f879f76f66242829bf8a111946a97498eb1

SHA256
f717cd72ced7a6dd56a1be8bb3cbe8b70dec1153762f97e478b7a5889cad0898

SHA512
427c7dbf3cd71aeb8f1f8070ba92b7fda728752b029698681aa0abb9a6b1361a5d4def724c7248e32b019039524b93945c28975ff1cc3593ccc84753afebc9c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
872B

MD5
fe643097b3074e0fece1a9f48a12adab

SHA1
13733411df90ff8b2e9df2175411e19692303495

SHA256
84ca6b3f82c693158a2b45296f46663bb1334fc4f6a67b99591cd4177a5d9272

SHA512
3abcb9d047ed18ea594eaf26cd055578b21052cee12652eb351541c7a530ee8cf304991d6e08b1a0737e7375a8c55dcaa27b493f5719b72f0c55337e821825d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a4c8922f3c0de88c93b00733ca3144d7

SHA1
ec183362af846846f69314843063c9d3daf8fb7e

SHA256
3a8df6cd3784d530ea5a89bed2ab7d4fc0da5b6213c43d157e9d6e06628929c1

SHA512
1e36664794441364873ef204dc451c31b62d7c5f6095d6a7346d3d544822b48f6e16c5b60ac326029523d51ba355a83a18faac8ec919765eb62f00c68d58e884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ac35875e73ca95eb6281105c236f8ee

SHA1
65737fdc9038d23b86e6e5e23d77191f62f0288b

SHA256
12b7de5a862f680aab2ec8ca704883b6a6f733e45d0bccb3525176f8690ba25b

SHA512
43bc2919f889964f8c608ef607c336a361cbe0abfccce0e963d73f575b86581455ae202aecaf55773b17df2d88be07627e119fd5b28942e19fad8c3afe3e3659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
904ad46dc0cafcf1a21fa69ba06487aa

SHA1
b8d0432babaa1d04cdda51c49f19d68b3d42542f

SHA256
07cb8521f30201431a0455bbbb84c3217b063049649d4faab8d7bdddc41bd506

SHA512
fdc9757c8d1e792234e1dbc660567c9bc746b37019c5ba660f2aa01294bf864e2d65367214d7ac6a2081eefc5018966f120411ae2aac128f06e6ab0c1b0358bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b1a8ff7a238c8c5f657ff163dcb9bd6

SHA1
428d8cda226417a1bf3277b3f36ac661bce82519

SHA256
50b8ce9beba1c0330ff94479a2b3732c6dc67f61bfb5a7210e8edcc5311ffd24

SHA512
cc36a5f87af12667d1a263f2e94b888a8c4cdba92427a36ce96573ebc60352072eb5a444b50c5ceeadcbb35bdabe70ed933e0907f200fa6f440b0721d43c6ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ea206100bd187c646528cf5ff20a207

SHA1
da179b4ea924536f54118cc79c0f5f839dc82364

SHA256
e6c5c65ddf2ea489ca85a533cd08f2eb5ebb4097f50d5bfd15031353c770b050

SHA512
f5cd8943873aa97f732d4f9225df580fe191c6c456191c53958332cb381d30c790cea537762e52bc5809190e9676993e4342d72ac03a7718944624711c724727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583217.TMP

Filesize
1KB

MD5
86ebaa1ce49e48091518ff58fb6190f9

SHA1
985004e2f0344aadc1a581392e7fdcb473083de6

SHA256
b3d55ed8c7e6402db8c484bcc8e8cc93abbf1212a729c95ead9809a43751a4d3

SHA512
a3831be5e022030f0ba3f74b1778669a224ad9cede5424cf64ee58c635f43456b4b0e5955069b4bd7ad1865ac2d17671170f08e483656c27a43f406902e5c60f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2553a26aa8862fa2cad9b1b2ba0af7bd

SHA1
c5f5c09d3b573b2ca4e1141570391127fe4c8481

SHA256
f307aa1bb8c8f8afc3b431fa2ad9905cc7034b13ef0ef1a26b4f9504766599c2

SHA512
4e6b9060e8fbfabbeab738be144e3254ab1af30f82f0f882dfc727b98f0e305e20b390e88efbd4c76a886d4db29346833a524b12894b5fd509cde32b2ce880f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
604fb83b77740ce2c182c8103b3d9bdf

SHA1
b459f3d60b27d6a1b2f2679a4d86e4c44769f215

SHA256
e518c09e5895437b93806cd82a13f9bbb4268958be7b47924d537150fcb1d9ca

SHA512
24b1e5158dc69eebedc24619bd11ad2af87b9fdaad758873e64c534fd49802bb7c38a2289616ae8c9d89c941fa06bee85328d60f9faf0565d221706b6704c0da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ff2ea46aa472d6a066fd0e39d193d307

SHA1
acf8008215437d21244e21016cc4edbf8c41a033

SHA256
f460f46c1258d259114c2446b87b2eb1f2849ca68ae5705ff52123c77b8e88e3

SHA512
2a65a6c2b5e8decf0d0cf1af7759dbddce57ad4d9084a1de51439d126f79370ea07909826f7381a32f71401b2dc6455c24b313687b88a2e0486f756082564504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a02f4d26b7b69893888490e30685979

SHA1
4310e395914c312cd2ed623cd35293a53b1bbde6

SHA256
8c2e19cc90593ac75886eb5bbf5db75eef72046ce2f3bfe06d5c1f987994fc9c

SHA512
f2908ebb353ca024599d99f77f6caf71257c894630569149bce4b781d38eee2bc6756b6d99af51f82464f095a26de08f08ad261e5d42737c5daf9bb0c528db47

Download Submit
C:\Users\Admin\Desktop\SKRIPTGG-FIVEM-main\RubixLauncher.exe

Filesize
355KB

MD5
8a6f1580a5b9b94d7cd47cc6b1af1b9a

SHA1
e68768afd59e18091d345cb300e859572e8d4c5c

SHA256
bb1464e75c750d90c0c49d148c9e64eefe0c29b2f670d708c8085ddd3104dbfe

SHA512
1663a9e0868b3f5d7e1edd30259024e419c2d190ec8c31e76e66aef0c8a0e02da0c829584214b9e2f76cbd349a53bf77d01d03e9b0e9c8a99eb18021b1d53309

Download Submit
C:\Users\Admin\Desktop\SKRIPTGG-FIVEM-main\Skript.gg.rar

Filesize
237KB

MD5
a48d76e6d43a698cfdab6ef51b8ae57d

SHA1
ae04f60ef5ca250ae39a86b74f436a67d1f29eab

SHA256
837f6441b7784d5f83e3b1d883cfe0d1ee2b97b0a6ed23300206120b9ec42030

SHA512
16aad32e95abf3ef745439d9ba79045a0c0c7e6f6a826cf81380a19c7cbe36c3ad97a8e6d277a481cc40f3fc33a5b160b5ff810bc294fb8cbda24c76b143d418

Download Submit
C:\Users\Admin\Desktop\SKRIPTGG-FIVEM-main\license.dll

Filesize
1.2MB

MD5
36dea25d49b9dff21acebface8ea2044

SHA1
5bd97162bc98e36c124811c360dbf29c6233405e

SHA256
d960a2eac5e7f1aa04e9f8d0da4eb9bb0b097ca58d0ce83ea1bb8351baf26301

SHA512
64f06db24297e30d7ec91d3cf9ccc33f28eb9041e463933866b09de0d138d964505aa38f32158be5e5491e4aa68d8ae77bccce9c068e5980d2281a24294bccf8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 491892.crdownload

Filesize
20.4MB

MD5
a4f15588e330c5d1bbe137de3a5f1c34

SHA1
d08d678fedca9f642f95d3bafacefe13b6aef2a1

SHA256
6e84ac8d3abdfba60078a36fa7f6b492b20c2af2c502e0a4579f41367ac37c80

SHA512
fd1ee623697c1c3a9bf424cbc2107a00c9c578666bed1f0c2b5bc18d7f6c780a1226686cc84bb487fc5969bb368bde9d195e19127679b202406ad26615716c30

Download Submit
C:\Users\Admin\Downloads\die_win64_portable_3.10_x64.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/392-491-0x00000000764A0000-0x00000000766F2000-memory.dmp

Filesize
2.3MB

Download
memory/392-489-0x00007FF935BC0000-0x00007FF935DC9000-memory.dmp

Filesize
2.0MB

Download
memory/392-488-0x0000000003FA0000-0x00000000043A0000-memory.dmp

Filesize
4.0MB

Download
memory/1056-501-0x00007FF935BC0000-0x00007FF935DC9000-memory.dmp

Filesize
2.0MB

Download
memory/1056-500-0x0000000003960000-0x0000000003D60000-memory.dmp

Filesize
4.0MB

Download
memory/1056-503-0x00000000764A0000-0x00000000766F2000-memory.dmp

Filesize
2.3MB

Download
memory/1400-470-0x00007FF935BC0000-0x00007FF935DC9000-memory.dmp

Filesize
2.0MB

Download
memory/1400-466-0x0000000000B40000-0x0000000000B49000-memory.dmp

Filesize
36KB

Download
memory/1400-472-0x00000000764A0000-0x00000000766F2000-memory.dmp

Filesize
2.3MB

Download
memory/1400-469-0x0000000002AC0000-0x0000000002EC0000-memory.dmp

Filesize
4.0MB

Download
memory/1524-463-0x00007FF935BC0000-0x00007FF935DC9000-memory.dmp

Filesize
2.0MB

Download
memory/1524-465-0x00000000764A0000-0x00000000766F2000-memory.dmp

Filesize
2.3MB

Download
memory/1524-460-0x0000000000240000-0x00000000002AD000-memory.dmp

Filesize
436KB

Download
memory/1524-467-0x0000000000240000-0x00000000002AD000-memory.dmp

Filesize
436KB

Download
memory/1524-461-0x0000000003DC0000-0x00000000041C0000-memory.dmp

Filesize
4.0MB

Download
memory/1524-462-0x0000000003DC0000-0x00000000041C0000-memory.dmp

Filesize
4.0MB

Download
memory/1876-497-0x00000000764A0000-0x00000000766F2000-memory.dmp

Filesize
2.3MB

Download
memory/1876-495-0x00007FF935BC0000-0x00007FF935DC9000-memory.dmp

Filesize
2.0MB

Download
memory/1876-494-0x00000000023D0000-0x00000000027D0000-memory.dmp

Filesize
4.0MB

Download
memory/3172-404-0x00007FF910F50000-0x00007FF911491000-memory.dmp

Filesize
5.3MB

Download
memory/3172-403-0x00007FF6C2FB0000-0x00007FF6C3C2A000-memory.dmp

Filesize
12.5MB

Download
memory/3724-481-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/3724-479-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/3724-482-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/3724-483-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/3724-484-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/3724-485-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/3724-480-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/3724-474-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/3724-475-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/3724-473-0x000001C0C3FF0000-0x000001C0C3FF1000-memory.dmp

Filesize
4KB

Download
memory/4880-506-0x00000000027C0000-0x0000000002BC0000-memory.dmp

Filesize
4.0MB

Download
memory/4880-507-0x00007FF935BC0000-0x00007FF935DC9000-memory.dmp

Filesize
2.0MB

Download
memory/4880-509-0x00000000764A0000-0x00000000766F2000-memory.dmp

Filesize
2.3MB

Download