Analysis
- max time kernel
119s - max time network
142s - platform
windows10_x64 - resource
win10v200430 - submitted
13/07/2020, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
44c903608379d2f6a02eaf669f92c7c1.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
44c903608379d2f6a02eaf669f92c7c1.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target 44c903608379d2f6a02eaf669f92c7c1.exe
- Size 626KB
- Sample200713-41l8hxbfd2
- SHA256 fb3df5f8cf59f50c2f08f0cb401b0a78a4c3a28007b1b8ef29673c4753d45488
- MD5 44c903608379d2f6a02eaf669f92c7c1
- SHA1 4cd8d2feaaa71a9566ae79d86f43db94178396b4
- SHA512 7400d9288f3770c125c3ddcc81e6e1a552af392fa7d848f193fcd50c74fc50a6592b89e04fa8eeabe1c21d8159b31b19b31f3dc9391fd7aee63e85ea7713b6ab
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
-
raccoon
Ransom Note
- [Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Mon Jul 6 14:33:03 2020 Launched at: 2020.07.13 - 16:22:39 GMT Bot_ID: 3E009A64-65D7-465C-9098-F2673DD3F416_Admin Running on a desktop =R=A=C=C=O=O=N= - Cookies: 0 - Passwords: 5 - Files: 0 System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.13 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: OWZMOTQA - Username: Admin - Windows version: NT 10.0 - Product name: Windows 10 Pro - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 4095 MB (774 MB used) - Screen resolution: 1280x720 - Display devices: 0) Microsoft Basic Display Adapter ============
Signatures
- Runs .reg file with regedit 1 IoCs
pid Process 684 regedit.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2912 ipconfig.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Tasks\mvhost.job cmd.exe File opened for modification C:\Windows\wotsuper.reg 44c903608379d2f6a02eaf669f92c7c1.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe - Modifies control panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Colors MicrosoftEdge.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe - Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
yara_rule raccoon_log_file - Delays execution with timeout.exe 1 IoCs
pid Process 2332 timeout.exe - Checks whether UAC is enabled 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MicrosoftEdge.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2868 MicrosoftEdge.exe - Program crash 1 IoCs
pid pid_target Process procid_target 432 2868 WerFault.exe 70 - Executes dropped EXE 2 IoCs
pid Process 736 wotsuper.exe 3960 lSdtRzYnBS.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 432 WerFault.exe 3960 lSdtRzYnBS.exe 2912 ipconfig.exe - Checks for installed software on the system 1 TTPs 33 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName wotsuper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\wotsuper 2.1\DisplayName = "wotsuper 2.1" 44c903608379d2f6a02eaf669f92c7c1.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName wotsuper.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName wotsuper.exe Key opened \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall wotsuper.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\wotsuper 2.1\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName wotsuper.exe Key enumerated \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName wotsuper.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName wotsuper.exe Key value queried \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName wotsuper.exe - Suspicious use of WriteProcessMemory 172 IoCs
description pid Process procid_target PID 1508 wrote to memory of 736 1508 44c903608379d2f6a02eaf669f92c7c1.exe 73 PID 1508 wrote to memory of 736 1508 44c903608379d2f6a02eaf669f92c7c1.exe 73 PID 1508 wrote to memory of 736 1508 44c903608379d2f6a02eaf669f92c7c1.exe 73 PID 1508 wrote to memory of 684 1508 44c903608379d2f6a02eaf669f92c7c1.exe 75 PID 1508 wrote to memory of 684 1508 44c903608379d2f6a02eaf669f92c7c1.exe 75 PID 1508 wrote to memory of 684 1508 44c903608379d2f6a02eaf669f92c7c1.exe 75 PID 736 wrote to memory of 3960 736 wotsuper.exe 81 PID 736 wrote to memory of 3960 736 wotsuper.exe 81 PID 736 wrote to memory of 3960 736 wotsuper.exe 81 PID 736 wrote to memory of 1532 736 wotsuper.exe 82 PID 736 wrote to memory of 1532 736 wotsuper.exe 82 PID 736 wrote to memory of 1532 736 wotsuper.exe 82 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 1532 wrote to memory of 2332 1532 cmd.exe 86 PID 1532 wrote to memory of 2332 1532 cmd.exe 86 PID 1532 wrote to memory of 2332 1532 cmd.exe 86 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 3960 wrote to memory of 2912 3960 lSdtRzYnBS.exe 84 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 PID 2912 wrote to memory of 3264 2912 ipconfig.exe 88 - Loads dropped DLL 6 IoCs
pid Process 736 wotsuper.exe 736 wotsuper.exe 736 wotsuper.exe 736 wotsuper.exe 736 wotsuper.exe 736 wotsuper.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe 44c903608379d2f6a02eaf669f92c7c1.exe File opened for modification C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe 44c903608379d2f6a02eaf669f92c7c1.exe File created C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini 44c903608379d2f6a02eaf669f92c7c1.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2868 MicrosoftEdge.exe Token: SeDebugPrivilege 2868 MicrosoftEdge.exe Token: SeDebugPrivilege 2868 MicrosoftEdge.exe Token: SeDebugPrivilege 2868 MicrosoftEdge.exe Token: SeDebugPrivilege 432 WerFault.exe - Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 432 created 2868 432 WerFault.exe 70 - Modifies registry class 113 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 02666555f01ed601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000c9e1e4a2695dcc88b326c9c62217a98d5961b686ad2ef701bec2aa2e82121e1830ff49ec32a5a4e02b6fa9094bdd2e322a2f086b8064368c943fdad56f3bb887eda5a1d1fa51096ccb88b82b5a69da4a5726f4db5ef84b8864fbe28e MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 02666555f01ed601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 02666555f01ed601 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 02666555f01ed601 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{69F69602-71B4-4ACC-88DA-D09F0433ECDD} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{36D19334-8E58-4B11-B2DA-D7438FED8ECB}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000075bed96af69a1583d985e1398f50ab4ff1d0aaed0f0efff4c94c48e92552448540d2cd000f3ec2a121d86d5250bc4a990fc795b9ef41c7702a80c2609baf71a60008bdbd8b93a92c8e95fc46e463c29666c97d0d34560b72cd5690e2ed3c1c83dd4977b03dd1017b09e2ed9f0c53487f30ce248ea03bf6705bbb74db4c1ca48a72968abce7df72559ddc948b8aa98339b7edd7af24e504984f9d3ee9ba41698ce9fa92a18bb096eba44fe7db614711f7061176dbf46f7bde631a966009d627fc0d68117f3b5c9121e75244d2e23506faa54d658440c85229002518bbdcaefb72e6f329a248dc2acd30eca2e55f7fc82d2f9fb9a0abe91f7a50cfa19d44c76534708a69cee61b919f9b05db0acaf06454bef78b6287d10d7a2efa1ce6b449d794142b1981f53f11a06fcfbfcc36dbed58ed59f686969e840144bc50907d00275a8bd1d70c3817acaba90c68e09507e79e84dfdcb76a2c52e2fc0d605df115e0f99193558c90db3d67c0e906b4b7805df56f65a864f481c8137eee19f86278b3b94f6e4d37b16bf97fa14a0f485041bb9d96f0f113c7b3f367407e1c77360e2647cbfd999a5df MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000005300d6abcba9b3d57d49833594964a1b032b0242aff9a24eb8e9994b9c0599bcfaed9f80d0806ec343e48892bb316d1f659fca1f53c980271209 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44c903608379d2f6a02eaf669f92c7c1.exe"C:\Users\Admin\AppData\Local\Temp\44c903608379d2f6a02eaf669f92c7c1.exe"1⤵
- Drops file in Windows directory
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
PID:1508 -
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"2⤵
- Executes dropped EXE
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:736 -
C:\Users\Admin\AppData\Local\Temp\lSdtRzYnBS.exe"C:\Users\Admin\AppData\Local\Temp\lSdtRzYnBS.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
PID:2912 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
- Drops file in Windows directory
PID:3264
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:2332
-
-
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg2⤵
- Runs .reg file with regedit
PID:684
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Modifies Internet Explorer settings
- Drops file in Windows directory
- Modifies control panel
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Modifies registry class
PID:2868 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2868 -s 34482⤵
- Checks processor information in registry
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:432
-
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:3468