Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10_x64 -
resource
win10 -
submitted
25-10-2020 19:01
Static task
static1
Behavioral task
behavioral1
Sample
75f5c417a7ef4076d5730ce3e847d5bf.exe
Resource
win7
Behavioral task
behavioral2
Sample
75f5c417a7ef4076d5730ce3e847d5bf.exe
Resource
win10
General
-
Target
75f5c417a7ef4076d5730ce3e847d5bf.exe
-
Size
261KB
-
MD5
75f5c417a7ef4076d5730ce3e847d5bf
-
SHA1
a4931cd472f217de0056877ddd446c9a6627d1cd
-
SHA256
b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
-
SHA512
1fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.onion.to/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.onion.cab/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.onion.nu/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.onion.link/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.tor2web.org/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.onion/DCF5-6A71-9A35-0000-0669
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.onion.cab/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.onion.nu/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.onion.link/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.tor2web.org/DCF5-6A71-9A35-0000-0669
http://cerberhhyed5frqa.onion.to/DCF5-6A71-9A35-0000-0669);
http://cerberhhyed5frqa.onion/DCF5-6A71-9A35-0000-0669
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exehelp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\\help.exe\"" 75f5c417a7ef4076d5730ce3e847d5bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\\help.exe\"" help.exe -
Executes dropped EXE 2 IoCs
Processes:
help.exehelp.exepid process 360 help.exe 1840 help.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
help.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SwitchProtect.tiff help.exe File opened for modification C:\Users\Admin\Pictures\MeasurePing.tiff help.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
help.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Control Panel\International\Geo\Nation help.exe -
Drops startup file 2 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exehelp.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\help.lnk 75f5c417a7ef4076d5730ce3e847d5bf.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\help.lnk help.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
help.exe75f5c417a7ef4076d5730ce3e847d5bf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\\help.exe\"" help.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce help.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\help = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\\help.exe\"" help.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run 75f5c417a7ef4076d5730ce3e847d5bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\\help.exe\"" 75f5c417a7ef4076d5730ce3e847d5bf.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 75f5c417a7ef4076d5730ce3e847d5bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\help = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\\help.exe\"" 75f5c417a7ef4076d5730ce3e847d5bf.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run help.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
help.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp1CB0.bmp" help.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1544 taskkill.exe 4624 taskkill.exe -
Modifies Control Panel 5 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exehelp.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Control Panel\Desktop 75f5c417a7ef4076d5730ce3e847d5bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\\help.exe\"" 75f5c417a7ef4076d5730ce3e847d5bf.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Control Panel\Desktop help.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\\help.exe\"" help.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Control Panel\Colors MicrosoftEdge.exe -
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies registry class 275 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "310445808" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 4739dc3b31a9d601 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{1C27B382-E59A-45BC-AB38-C2126334E265} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 11fc6dc612abd601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 4739dc3b31a9d601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658 = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\Md5FileCheck = 9fa75725855604a758366c6a1d9f0311 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c235d2b812abd601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\5FF1348C80820F2A9 = 0300000001000000140000005ff1348c80820f2a988d0c0c7abea0ea394b5e6c040000000100000010000000fd42404f68fae3f0d490e8d19d08ab1d0f00000001000000200000005546bb2210de2560292e6f4610af4ffbdb453f9bf9983e62942c35959e16038d140000000100000014000000b3b30880146b0eb235e8e136e7d15c9c4847f5f3190000000100000010000000e142e209d34bfb2eac257eb76a2b61e15c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000e5050000308205e1308203c9a0030201020213330000016fd585f24b93e88a0700000000016f300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3139313231323030303333315a170d3231303331323030303333315a3081a3310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3121301f06092a864886f70d010901161271666265406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfb24782c35c66c63688c01ed857df9a4330b81628c86831de4d577f8cb2155b880ee41953a18ac28de644bacfa97558ec6f522490f103b7fa0092430f8e0ba55c36dd91f6f1f91baec6eb3581d89133141e1580e02ec2445e5380b178f92f81e97193be8be1223d36e5f2be070a3db6ac17987ea3b42d15994c73a10e64794da4660a5d875e179c567bb06ecfd7cbf4c1ee4fe453284e72877d746a3e178788a1bd540ba9250a931a11105bb98f1b2b757fa6c5ade16e7cc1d1628fedb716018526f5b56630b54cd5f75f938e9b4a956609cc441aac84a10a101f6429b6fceb9434a41b24f0ca9781bf72b010f14bd13dc5d996b6ed6c4d53156969dd04f7390203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414b3b30880146b0eb235e8e136e7d15c9c4847f5f3301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038202010064d81278e224099c122690412271d5f2d92ae1c00f7135d64f63663ccc0588826bf24cc6cffa0d6666b7e3f989825dd1021fd1bdc6a9d4a492c0f46198534382204d8668b0f3c8d85f9f614f7fff47e391a4fdc89dba1b423f1d2a8d4986ff42bac032a21224b246b03ffef26e7da49d3ef381ff9d669cda0234445bff395be1b70627f013ccde692280d75d690b4f4c5e3a123b379bd30bdc6cf1af0c69d97eb0aa4f580eb4e876465b2c62514a612a3971f6bc6ace33f569e0cbcbd5498caf2af949952c310221a382d0a7fbc4594b0bfe96a1c81d26639b249beea28179ead8377bf70e9a09596997af2b405c5425a1e5e6e46b065016901b7cd120e2389d47924b1f834955135461f7592c9487e3910bf0de382ad5906dd8c46b321b176698caaec19d1ee10aa6679981d8f2f5c40d69240a7075ce4341305d2bbd082e03c81c41baeb557b41904482ae88d0566f339ab517ae2f84223d567f9ec734c1c5a2be39aa24c49930b6428bbe2fa300f2369e1c8cc554c14010f1ee518afa32e4bf0a15cb251d37791338f5ade8ced4b67ca5fc56320c2c2973f9b13e250dabe4a373580becf787afd552c6b293dfc7bfb1f67739c64df74ae3d373e2db9c27090fe15e58591824e4f150602af628917a6d1353919cd0a8489596f97070833a98b34c2d3a0ebafda2f81096533b773c5914d7f05e66cb17af2bcd11ad517440b5 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = af399cb312abd601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{15D316BA-8263-4089-AD7C-72448CE7DF34}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ff6b55c612abd601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "310480800" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = c08251c612abd601 MicrosoftEdge.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 360 IoCs
Processes:
help.exepid process 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe 360 help.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
MicrosoftEdgeCP.exepid process 1160 MicrosoftEdgeCP.exe 1160 MicrosoftEdgeCP.exe 1160 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.exehelp.exetaskkill.exehelp.exeMicrosoftEdge.exeAUDIODG.EXEMicrosoftEdgeCP.exeMicrosoftEdgeCP.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3984 75f5c417a7ef4076d5730ce3e847d5bf.exe Token: SeDebugPrivilege 360 help.exe Token: SeDebugPrivilege 1544 taskkill.exe Token: SeDebugPrivilege 1840 help.exe Token: SeDebugPrivilege 3940 MicrosoftEdge.exe Token: SeDebugPrivilege 3940 MicrosoftEdge.exe Token: SeDebugPrivilege 3940 MicrosoftEdge.exe Token: SeDebugPrivilege 3940 MicrosoftEdge.exe Token: 33 4404 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4404 AUDIODG.EXE Token: SeDebugPrivilege 4268 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4268 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4268 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4268 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4120 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4120 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4120 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4120 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4624 taskkill.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 3940 MicrosoftEdge.exe 1160 MicrosoftEdgeCP.exe 1160 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
75f5c417a7ef4076d5730ce3e847d5bf.execmd.exehelp.exeMicrosoftEdgeCP.execmd.exedescription pid process target process PID 3984 wrote to memory of 360 3984 75f5c417a7ef4076d5730ce3e847d5bf.exe help.exe PID 3984 wrote to memory of 360 3984 75f5c417a7ef4076d5730ce3e847d5bf.exe help.exe PID 3984 wrote to memory of 360 3984 75f5c417a7ef4076d5730ce3e847d5bf.exe help.exe PID 3984 wrote to memory of 1164 3984 75f5c417a7ef4076d5730ce3e847d5bf.exe cmd.exe PID 3984 wrote to memory of 1164 3984 75f5c417a7ef4076d5730ce3e847d5bf.exe cmd.exe PID 3984 wrote to memory of 1164 3984 75f5c417a7ef4076d5730ce3e847d5bf.exe cmd.exe PID 1164 wrote to memory of 1544 1164 cmd.exe taskkill.exe PID 1164 wrote to memory of 1544 1164 cmd.exe taskkill.exe PID 1164 wrote to memory of 1544 1164 cmd.exe taskkill.exe PID 1164 wrote to memory of 1804 1164 cmd.exe PING.EXE PID 1164 wrote to memory of 1804 1164 cmd.exe PING.EXE PID 1164 wrote to memory of 1804 1164 cmd.exe PING.EXE PID 360 wrote to memory of 996 360 help.exe NOTEPAD.EXE PID 360 wrote to memory of 996 360 help.exe NOTEPAD.EXE PID 360 wrote to memory of 4216 360 help.exe WScript.exe PID 360 wrote to memory of 4216 360 help.exe WScript.exe PID 1160 wrote to memory of 4120 1160 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1160 wrote to memory of 4120 1160 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 360 wrote to memory of 4580 360 help.exe cmd.exe PID 360 wrote to memory of 4580 360 help.exe cmd.exe PID 4580 wrote to memory of 4624 4580 cmd.exe taskkill.exe PID 4580 wrote to memory of 4624 4580 cmd.exe taskkill.exe PID 4580 wrote to memory of 4688 4580 cmd.exe PING.EXE PID 4580 wrote to memory of 4688 4580 cmd.exe PING.EXE PID 1160 wrote to memory of 4268 1160 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1160 wrote to memory of 4268 1160 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1160 wrote to memory of 4268 1160 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1160 wrote to memory of 4268 1160 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1160 wrote to memory of 4268 1160 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1160 wrote to memory of 4268 1160 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75f5c417a7ef4076d5730ce3e847d5bf.exe"C:\Users\Admin\AppData\Local\Temp\75f5c417a7ef4076d5730ce3e847d5bf.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Roaming\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\help.exe"C:\Users\Admin\AppData\Roaming\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\help.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵PID:996
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵PID:4216
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "help.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\help.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\system32\taskkill.exetaskkill /t /f /im "help.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4624 -
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:4688 -
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "75f5c417a7ef4076d5730ce3e847d5bf.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\75f5c417a7ef4076d5730ce3e847d5bf.exe" > NUL2⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "75f5c417a7ef4076d5730ce3e847d5bf.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1544 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1804
-
C:\Users\Admin\AppData\Roaming\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\help.exeC:\Users\Admin\AppData\Roaming\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\help.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3940
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2348
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3d81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\help.lnkMD5
8a9aaed3cdd987ba978dad14285023b2
SHA177bac4e8243394ab8fc1a120fb34c748da49ed72
SHA256fe73883b5ce527d5ded6a94b4abf1961aaef2f3aae7b64c35d24041f5f6da8af
SHA51201d2598a09b1eb9de426f6383f39a55dfaa4b6f8010727996caae10dbf0a9a13bf037c52ea774c44fe4383675ea238d74428276454a1fbd46250780c1a406696
-
C:\Users\Admin\AppData\Roaming\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\help.exeMD5
75f5c417a7ef4076d5730ce3e847d5bf
SHA1a4931cd472f217de0056877ddd446c9a6627d1cd
SHA256b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
SHA5121fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
-
C:\Users\Admin\AppData\Roaming\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\help.exeMD5
75f5c417a7ef4076d5730ce3e847d5bf
SHA1a4931cd472f217de0056877ddd446c9a6627d1cd
SHA256b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
SHA5121fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
-
C:\Users\Admin\AppData\Roaming\{2B81F331-700D-E56A-49AD-2A5A959DF3A3}\help.exeMD5
75f5c417a7ef4076d5730ce3e847d5bf
SHA1a4931cd472f217de0056877ddd446c9a6627d1cd
SHA256b2f644f5e3d2040ef24f9ca3a36de0c8606a00f30a0da4fbad471db7d2b2a377
SHA5121fcf09a65466684ade22a1bcd56ff2c7943c5535dc3fcfcfa8a0188b219011cc0f46abafad26bbe7ea9d72253d0c7b8804072cffa1413235699b9e38240e9e25
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
77a717a77a115cb823675cf3c70ec5f7
SHA167b4b6aad5318a7c6323b553c8d15d96d61110dd
SHA25642d39b7728f272f3665710d59cbdcb4290b79981f112f9aedb03d5b436087f0b
SHA512aae3640b9e45bac31f307fddf9ba85a979f0bb63823b5b8d055209ae5e1b4978fd62ecf5a1644e9048210330a92e5ec9a81f6249535f65fe0f32ceae75c3bb8d
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
06861493fd73849aa2da29b95aa5cf80
SHA1797e9126faeea85a099cdf37f519e7105c123a0e
SHA256828a63daab0410769ded53edb7a64ac335d4c4d085f6c4e77763ad285b06c275
SHA512e57f56e1a70596dbb64ae3b88502efcf646f1f020a2a346b8b0aa1f59c3ea684a5b6b3d566fa1e0841f20cc55e205c36feddc02bd06b711deb83f6ca14da6b4f
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
6f84dbf74ef41dc3d861f5fb3e0f45ff
SHA13e5f17e9b9589f33ce6add7f2518a666ff2253a4
SHA256df5f432d7e0d2bd1c4dddb1fabbf1e77bd1065b9020f71abaf1a45fbb950bbb8
SHA5129f9ec25b815be7b20df26244d31848c9a4896b130241b63636d63511a290eaad78d289a9bb04592c0ba31492064671351b4c7359310f03469e27764132a20a5a
-
memory/360-12-0x0000000008C37000-0x0000000009018000-memory.dmpFilesize
3.9MB
-
memory/360-10-0x0000000008C37000-0x0000000009018000-memory.dmpFilesize
3.9MB
-
memory/360-0-0x0000000000000000-mapping.dmp
-
memory/996-9-0x0000000000000000-mapping.dmp
-
memory/1164-3-0x0000000000000000-mapping.dmp
-
memory/1544-4-0x0000000000000000-mapping.dmp
-
memory/1804-5-0x0000000000000000-mapping.dmp
-
memory/4216-13-0x0000000000000000-mapping.dmp
-
memory/4580-19-0x0000000000000000-mapping.dmp
-
memory/4624-20-0x0000000000000000-mapping.dmp
-
memory/4688-21-0x0000000000000000-mapping.dmp