latentbot | hxxps://bazaar[.]abuse[.]ch/download/573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d

Analysis

max time kernel
62s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2025, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bazaar.abuse.ch/download/573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d

Score

10^/10

latentbot xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Attributes

install_file
MasonUSB.exe

Extracted

Family

latentbot

cryptoghost.zapto.org

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2508-788-0x0000000001380000-0x0000000001392000-memory.dmp	family_xworm

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 1 IoCs

pid	Process
2508	573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
45	raw.githubusercontent.com
124	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133892897240746507"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-83325578-304917428-1200496059-1000\{53442F32-5BAA-49B6-AD3E-5393F68D49AD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4024	7zG.exe
Token: 35	4024	7zG.exe
Token: SeSecurityPrivilege	4024	7zG.exe
Token: SeSecurityPrivilege	4024	7zG.exe
Token: SeDebugPrivilege	2508	573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
4024	7zG.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 396	2496	msedge.exe	85
PID 2496 wrote to memory of 396	2496	msedge.exe	85
PID 2496 wrote to memory of 4092	2496	msedge.exe	86
PID 2496 wrote to memory of 4092	2496	msedge.exe	86
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 3044	2496	msedge.exe	87
PID 2496 wrote to memory of 548	2496	msedge.exe	88
PID 2496 wrote to memory of 548	2496	msedge.exe	88
PID 2496 wrote to memory of 548	2496	msedge.exe	88
PID 2496 wrote to memory of 548	2496	msedge.exe	88
PID 2496 wrote to memory of 548	2496	msedge.exe	88
PID 2496 wrote to memory of 548	2496	msedge.exe	88
PID 2496 wrote to memory of 548	2496	msedge.exe	88
PID 2496 wrote to memory of 548	2496	msedge.exe	88
PID 2496 wrote to memory of 548	2496	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bazaar.abuse.ch/download/573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7ffec290f208,0x7ffec290f214,0x7ffec290f220
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1988,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2240,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2564,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3528,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4168,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4276,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3708,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3524,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5484,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5720,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6028,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6024,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6192,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6192,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6688,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6396,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6464,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6872,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7032,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7200,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7024,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=4568,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5180,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6908,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5548,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7040,i,12936401892452636163,10494907250376399845,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:5556

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2360

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d\" -ad -an -ai#7zMap8111:190:7zEvent32250
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4024

C:\Users\Admin\Downloads\573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d\573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d.exe
"C:\Users\Admin\Downloads\573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d\573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist

Filesize
105KB

MD5
d3c7a91ce6bb120bc472d385e1c3b9a2

SHA1
f5fcb8211302e2506cf2c238b1e8e2d8b29bdccd

SHA256
bdd406bfbc081a963756e854eb7a9ee4b487b0e2bf8c11344a2a35bc135b9d2c

SHA512
ec12df5e66bdd436d4c71b94d3df73d64ca756c05f979c1ef3ab49cca0f351781c1bd8cb01d3924fc2ea099bb2da812e5d30d0084e567f9dd13dffb913c6b207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
2b5dd617bc51c4c1ccb00b32b7a551cb

SHA1
7d736ba05663d721e586cb765fdbd30b8c95f5ae

SHA256
cace12b31caef21a04e9b72cdaded7f3dab5d6e633385a91bb370c92f8eb1b69

SHA512
6892aa73a27cd9b85f3361a933c7e47572df7d13e21ab914b37f715deee1e8d7341f1bcc4a9a17daa1d1fbef44ddfd3bfc0ae2d8d8e3b8802f0dd9ab56bff98b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
5a7e1750438748bd333b79a94ca69b2a

SHA1
94fd1be56969e269ce195ba29c3d464d356d6556

SHA256
6d7a64a318c25c643323d5cf1c0c80ccf2f2433e7d74b722fca90468f8f9b914

SHA512
842509c0f495ee24d152ab3f7867183d7cd64b01b5a9305405682abbbff3aa18a8ad7d97ee039393fdd1766fc17ad2df1caf711dc4db8dc7b9df608ffc0fdc7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
eec55fe349980566b1dbf1d409d28c3e

SHA1
654ce4b550defea0851f12e8ff81ae9298bb3f60

SHA256
2e81ea3d7ddfc0274f3955d5131143c481e63f2529514c5295873b393d508efe

SHA512
58e02658d08732b5f36e868331a483b5fde15475a6c5f704a19c97d920399c3f7d41a8fa163c66683bf403598f8f48f0cf9fa468f9783fcabd9136a55cec0059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2b658cc2461bfbf810d760ef60055bf2

SHA1
abfa35396a7ff8468fa30e0f00d53b274caa22ef

SHA256
22b0b1065aa055486124968f361d6eb3bce8a334a12d6f78107495bc5a2dd027

SHA512
066d6c9938b37bb35894f928ff1219492f5fa12a3307f6751d97685fce7e3830de869d0cef745d97d73f8ac514e228366d34aa79e51658a093af35414d369434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e918.TMP

Filesize
3KB

MD5
025aaeaf1320e94bb27e5e3ecd7016c6

SHA1
dd1ae8e03fc09138de96114a7f74268f913259f0

SHA256
6ad50ffd0a33b4e09920f016b4627f34f7e22413802f3cea8e26494a0f8df960

SHA512
899de49253dcd8bb7f820caccb480f93d69bcd14e224da3d006ac492e723723d583a270bd53b00dc672566caf8f32ad85949d4f7b86a712f881d2334076a7413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
8c73e2e458309bf9e7a031b5600a1020

SHA1
f9533dab98d530d90bd533067156529f0a305e39

SHA256
5616034a992caa32031c104916595aee0dfb4480e744ae49998808153f5b3b70

SHA512
6308ba5db976f7b166af85737dd4912eaf489c20803b422560318d3f9245e7fb9529583df9fd16eb9190baef169316d56c9432e65fd2da766c72771e6162ecb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
52df34c57d8e0c839c3628ae26d0a1fa

SHA1
68c34e939da714cac715f7985da851a97dd74566

SHA256
2e69156f5c9eaef3642fd7ae8ff4bb801ae217869e49e2862be72d12549cd033

SHA512
e01fee321e88d04898bb31abfed239ce553c340dc087cb1b30d589bcb16b21df572959b0c2668d1bf13d772ef94182e81c85ef882167b7f71095b4fd9916b7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
4e832b430b3933163dd97fb6e878bf82

SHA1
7a8f46af6489e1887ab71a1bbcc94c48204c21cb

SHA256
79660c49de0aeedae8ffb1ff8ac60a4592a1db052f12fa87de31d116ee235ad6

SHA512
aaf7904c5e458524502b800812b8a5c4925be4c154ef9423c143342ce3774d003ddd3875ecb04cdc0d9d6ca1fd51f170a42e77a7fe1eca964d14a3620630cd0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
86199eec1bce06408ec7337e206257ac

SHA1
8a854ffe1cb6831e07969e9603cc06b727653c29

SHA256
9ab5993b5c17bf22f8c91e094d3885c844490651fd021242883b5b52be49e111

SHA512
4ea37faf48c6faaa498786bb4ef89389741112c61dcb59e43b80c86a530d13ccf07bc585d239b77c680bf66b641ca51b8c70cbfc606f1af6d38ce5fa35089695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
ae75c6c7fdafe680d06c14cec53c84bd

SHA1
641b156f0c7482d75ee3b44cfd129fde2a3cb7ed

SHA256
190be5efa64d87dd58f60f06d2571d159907855c7110e583d91080dfaa86e11e

SHA512
935d22bdfd666d5e9094a2262c0b6f1a8fefdf91d2745c6872e53dd88ed711e90d4daea01c435398e50cc8a516188c835fbd23da524c4a755f9cf250e73012d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
f97cce6aba9ce0b4b1e8b29cccad864a

SHA1
e43490b6f880b46907fa8cad0c73f2a805ef6679

SHA256
b35ecb801cccdf8d2260239b9ce4e603f2de3049e54192d0d943a5cb3da29b41

SHA512
691e664c011dc477638effbebe0b2407835bea3eb826328a2c4aa382c6854b64c9b3162f21795e3f1cf3637144777a3904237276c3fc83f4608c97d5ce1ec3df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
b36eb7189683e09a95b43c60d3a68c09

SHA1
3ece62a3dc5b5d516e23593462e466a0687c40f6

SHA256
19361c219579125d4105d63670f8eab9353fc786f966aa5a025b86de3ebf24ee

SHA512
7751d544dd09fdaeea549a043ea8837bf6de6fb59e5e435403b070e3cc8717d22848234ec03da891d2c582d46811fc540aabb8d1573895d001772d31768b583f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
1899efcb50055b1fdd538bf201eb14ce

SHA1
09e948bc45d5f1874879582197eee83db4175064

SHA256
e5794503ded4272f92db8d55315a4283447c639cf6148388ea1491f64d7a8ea9

SHA512
cad1c4373f42330a4c0bfa4b9e8148433e762d6d99f82f5bae32106b5daf9204dbd88bbd603db8da8fb89a35a3319fd6cdd9dd9cbc17e8ade4e056c4bbf5daaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
1757627b9acbadbfa91ffd1aad9ec34c

SHA1
b840f739e89f8d1747bb538629a49588d1f4b1e3

SHA256
6ad2c79b25864675f42862ba8e7405dec652877180a505690852aeac154fe7bb

SHA512
0f3eb59bc9b9fdb83af8be12e60cbe870e5c1dc274658bbf871b74fce4355f8000cb07b22b7be2eb3db785c523f318e2e25b9851249163360a6afc3488c5b8a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
79c54f27a9fac2ec44081c82b8a4e049

SHA1
a7d27ed4567a2f958d8ad13b33cea9de6fee825a

SHA256
d5556f55000427be920f5283312e69ff9bdae1bbf2f3a44186dc4cdf563b9fde

SHA512
ec0c5e5733d98f7dccc5150ad8ea60f0a43c43e24f3c3d630fb0fcb87c37eb618d5b76c801c9d63dc49065bac87b345938531529dcfff939a98d90555a465a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
e4bd5325d5e248fda77f1e823dac3ab2

SHA1
c99fec15e843ecf91faf1b859058a32678aa12e5

SHA256
3448a6f99c1c8acd8cc2694cd66adf5ac07a916fb19f3cfb628b71db129a5b46

SHA512
b355558f21b0712b8ddf8a8217a7db2bc55a24718d30a8d4f3b9d81e4ee7326bd8dcf49836b2148e0e8d135314beff4696017d36907dd3079abf024966d788ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
a34f9dc29e5be61145e51b72e854f01d

SHA1
365be899e7dbff2f08aa8f96e22c35e1e6665d61

SHA256
605a67d2f513fa144360e4c92f14fff82f5590303ef85d4786721c3d62b07510

SHA512
401658108248b5c076bc6142bf80c4f5125c92fb26ad5de4494b9e0998dc9b5577c86e9e7367a5c1c74af74e7f514a61c33db6b740011257ffa4d57cd057fd52

Download Submit
C:\Users\Admin\AppData\Local\Temp\6cbc7c18-1ef2-4f8c-8bff-a149a701814e.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f19c2048-a593-4a26-8feb-60230f59a63c.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2496_329800770\6289a6da-4954-4844-9ee1-110cafe5dcaa.tmp

Filesize
153KB

MD5
b0917d8e6c5b6be358bff67f84eb8336

SHA1
a6e221edcb19a1cc81575b4ddd927fd9a6fbdd6d

SHA256
dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60

SHA512
cd5822bbf91e8f7f5ab2b471a4bf8b464bde95465e2fccc6a57e5a287ca55d5062bdd6d4b3cd76f8529ee7a9081b6a7aad7dc2a7581c344ce4fd2d3256bdf451

Download Submit
C:\Users\Admin\Downloads\573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d.zip

Filesize
693KB

MD5
c7a21a148c01f706efb4c1029ac55f1a

SHA1
f21947f40022ea13dda6d2907e504157139d14ad

SHA256
b7c36f10383ade5b84d4910afffa3b6a21adb2dc9748b4f1807cc4c3b28dccd5

SHA512
ad957453957b2e55fece993743ec372fab797aa098a23121bd14a9acff68788b18bf58427aaed2ee5547eceb14c6675e3695355d4e223043528a4c24d5d5759a

Download Submit
C:\Users\Admin\Downloads\573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d\573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d.exe

Filesize
1.5MB

MD5
331c0633d4eaecd87c39180f7f350769

SHA1
7339299f301e2bf82989029391366da000f53bc6

SHA256
573b6b682ba79aa17aea93a00e8c9f4b3b8d90f177f219682e879bf15c32c55d

SHA512
7edb099b0566bdb365545bf3f5f28e937141eb3eacf33877ee1f2d1aee65fe429a741aba03bbd92d37a1e93ff5f8fe18ea4d53b957abb06e40c598495fcfaec7

Download Submit
memory/2508-786-0x00000000009E0000-0x0000000000B5E000-memory.dmp

Filesize
1.5MB

Download
memory/2508-787-0x0000000001350000-0x0000000001356000-memory.dmp

Filesize
24KB

Download
memory/2508-788-0x0000000001380000-0x0000000001392000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads