Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-11-2020 17:45
Static task
static1
Behavioral task
behavioral1
Sample
60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe
Resource
win10v20201028
General
-
Target
60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe
-
Size
270KB
-
MD5
4b75efc2a9c47bbbf2cc1f9761922cb2
-
SHA1
f2218540985d22624021b4acb9966d20d480edff
-
SHA256
60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44
-
SHA512
46e396830520c4acbc8d156428cc4ab7141d5815f1215c914ac86b35e6c0ad90433becca6b818d8d7fbeea6e85d8a52dd47e0e92e83f7dc6a35b2bb31e67354e
Malware Config
Extracted
C:\Users\Admin\Documents\# DECRYPT MY FILES #.txt
cerber
http://bqyjebfh25oellur.onion.to/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.onion.cab/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.onion.nu/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.onion.link/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.tor2web.org/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.onion/25F2-A0F3-798E-0072-8C47
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://bqyjebfh25oellur.onion.to/25F2-A0F3-798E-0072-8C47(Get
http://bqyjebfh25oellur.onion.cab/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.onion.nu/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.onion.link/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.tor2web.org/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.onion.to/25F2-A0F3-798E-0072-8C47);
http://bqyjebfh25oellur.onion.to/25F2-A0F3-798E-0072-8C47
http://bqyjebfh25oellur.onion/25F2-A0F3-798E-0072-8C47
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
EhStorAuthn.exe60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\EhStorAuthn.exe\"" EhStorAuthn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\EhStorAuthn.exe\"" 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe -
Executes dropped EXE 2 IoCs
Processes:
EhStorAuthn.exeEhStorAuthn.exepid process 3160 EhStorAuthn.exe 644 EhStorAuthn.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
EhStorAuthn.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\FindAssert.tiff EhStorAuthn.exe File opened for modification C:\Users\Admin\Pictures\MergeRequest.tiff EhStorAuthn.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
EhStorAuthn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation EhStorAuthn.exe -
Drops startup file 2 IoCs
Processes:
60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exeEhStorAuthn.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\EhStorAuthn.lnk 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\EhStorAuthn.lnk EhStorAuthn.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
EhStorAuthn.exe60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce EhStorAuthn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\EhStorAuthn = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\EhStorAuthn.exe\"" EhStorAuthn.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\EhStorAuthn = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\EhStorAuthn.exe\"" 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\EhStorAuthn = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\EhStorAuthn.exe\"" 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run EhStorAuthn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\EhStorAuthn = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\EhStorAuthn.exe\"" EhStorAuthn.exe -
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html js -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 ip-api.com -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
EhStorAuthn.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp16B0.bmp" EhStorAuthn.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2836 taskkill.exe 4544 taskkill.exe -
Modifies Control Panel 5 IoCs
Processes:
60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exeEhStorAuthn.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\EhStorAuthn.exe\"" 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop EhStorAuthn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\EhStorAuthn.exe\"" EhStorAuthn.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors MicrosoftEdge.exe -
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies registry class 204 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ac5f5b4112b6d601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1d63874512b6d601 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 81d6514112b6d601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 998267c856add601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 360 IoCs
Processes:
EhStorAuthn.exepid process 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe 3160 EhStorAuthn.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
MicrosoftEdgeCP.exepid process 3748 MicrosoftEdgeCP.exe 3748 MicrosoftEdgeCP.exe 3748 MicrosoftEdgeCP.exe 3748 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exeEhStorAuthn.exetaskkill.exeEhStorAuthn.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 640 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe Token: SeDebugPrivilege 3160 EhStorAuthn.exe Token: SeDebugPrivilege 2836 taskkill.exe Token: SeDebugPrivilege 644 EhStorAuthn.exe Token: SeDebugPrivilege 1848 MicrosoftEdge.exe Token: SeDebugPrivilege 1848 MicrosoftEdge.exe Token: SeDebugPrivilege 1848 MicrosoftEdge.exe Token: SeDebugPrivilege 1848 MicrosoftEdge.exe Token: SeDebugPrivilege 2092 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2092 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2092 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2092 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4204 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4204 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4204 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4204 MicrosoftEdgeCP.exe Token: 33 4416 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4416 AUDIODG.EXE Token: SeDebugPrivilege 4544 taskkill.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 1848 MicrosoftEdge.exe 3748 MicrosoftEdgeCP.exe 3748 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.execmd.exeEhStorAuthn.exeMicrosoftEdgeCP.execmd.exedescription pid process target process PID 640 wrote to memory of 3160 640 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe EhStorAuthn.exe PID 640 wrote to memory of 3160 640 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe EhStorAuthn.exe PID 640 wrote to memory of 3160 640 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe EhStorAuthn.exe PID 640 wrote to memory of 3084 640 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe cmd.exe PID 640 wrote to memory of 3084 640 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe cmd.exe PID 640 wrote to memory of 3084 640 60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe cmd.exe PID 3084 wrote to memory of 2836 3084 cmd.exe taskkill.exe PID 3084 wrote to memory of 2836 3084 cmd.exe taskkill.exe PID 3084 wrote to memory of 2836 3084 cmd.exe taskkill.exe PID 3084 wrote to memory of 940 3084 cmd.exe PING.EXE PID 3084 wrote to memory of 940 3084 cmd.exe PING.EXE PID 3084 wrote to memory of 940 3084 cmd.exe PING.EXE PID 3160 wrote to memory of 2696 3160 EhStorAuthn.exe NOTEPAD.EXE PID 3160 wrote to memory of 2696 3160 EhStorAuthn.exe NOTEPAD.EXE PID 3160 wrote to memory of 4164 3160 EhStorAuthn.exe WScript.exe PID 3160 wrote to memory of 4164 3160 EhStorAuthn.exe WScript.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 2092 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3160 wrote to memory of 4484 3160 EhStorAuthn.exe cmd.exe PID 3160 wrote to memory of 4484 3160 EhStorAuthn.exe cmd.exe PID 4484 wrote to memory of 4544 4484 cmd.exe taskkill.exe PID 4484 wrote to memory of 4544 4484 cmd.exe taskkill.exe PID 4484 wrote to memory of 4628 4484 cmd.exe PING.EXE PID 4484 wrote to memory of 4628 4484 cmd.exe PING.EXE PID 3748 wrote to memory of 4204 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3748 wrote to memory of 4204 3748 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe"C:\Users\Admin\AppData\Local\Temp\60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\EhStorAuthn.exe"C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\EhStorAuthn.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "EhStorAuthn.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\EhStorAuthn.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "EhStorAuthn.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe" > NUL2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "60f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\EhStorAuthn.exeC:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\EhStorAuthn.lnkMD5
edd1c0f799912e5a598957fde3152ab6
SHA15407c97a0ddb8a85be3524784d050bd4548ac2a5
SHA256895f5b363e02f870ae0e3d19305ad5eaea07ff82678962e07c3fe0bf36feab9a
SHA5121c3856116df37f4e80c4a391f26f58065a0413a2d943fa2f5a5186be9d5c84e5607a38e4e3d5328c658632d11dbc34999293519ade0135ace70e78537b5f6c1f
-
C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\EhStorAuthn.exeMD5
4b75efc2a9c47bbbf2cc1f9761922cb2
SHA1f2218540985d22624021b4acb9966d20d480edff
SHA25660f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44
SHA51246e396830520c4acbc8d156428cc4ab7141d5815f1215c914ac86b35e6c0ad90433becca6b818d8d7fbeea6e85d8a52dd47e0e92e83f7dc6a35b2bb31e67354e
-
C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\EhStorAuthn.exeMD5
4b75efc2a9c47bbbf2cc1f9761922cb2
SHA1f2218540985d22624021b4acb9966d20d480edff
SHA25660f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44
SHA51246e396830520c4acbc8d156428cc4ab7141d5815f1215c914ac86b35e6c0ad90433becca6b818d8d7fbeea6e85d8a52dd47e0e92e83f7dc6a35b2bb31e67354e
-
C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\EhStorAuthn.exeMD5
4b75efc2a9c47bbbf2cc1f9761922cb2
SHA1f2218540985d22624021b4acb9966d20d480edff
SHA25660f8b6d462659f2e33e2d80ee76961e809b631b29958472be6d16304631f7b44
SHA51246e396830520c4acbc8d156428cc4ab7141d5815f1215c914ac86b35e6c0ad90433becca6b818d8d7fbeea6e85d8a52dd47e0e92e83f7dc6a35b2bb31e67354e
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
1c8980870ed6bfc198814a2901d1f9f1
SHA10e49ac1777d581950a117d2e0f12c63633d2d69a
SHA25653370f5b794ca4289c7d3e7d136aab83708c530417794218c07d1ced638b7058
SHA51238e873ba8ad6b324e6b49bf85d727850fbdf0716c3738a3e4cf7e56855261f6f2a330e01147b4351e5743251034f54abab0f5bf6f53059fbfa536a12696c44a0
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
d00eedac867ea91e0782ba42b7ed8d86
SHA1bdb5912d31a535b150fdb94a3279530b2e5a4b72
SHA25626a2b030d1eca93ca70dca6ca405c706c2f9438e77cb8f0823c36326d7c47d05
SHA51255ea8ef14a64ab7de8482ad7983f28cc24a3f84ffed2e0d991c516476464c72561ff457394b75406ffd5b059d582b57a32b6c972c8c6d43e847e600d2993e7ef
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
1c2a24505278e661eca32666d4311ce5
SHA1d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee
SHA2563f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628
SHA512ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c
-
memory/940-5-0x0000000000000000-mapping.dmp
-
memory/2696-9-0x0000000000000000-mapping.dmp
-
memory/2836-4-0x0000000000000000-mapping.dmp
-
memory/3084-3-0x0000000000000000-mapping.dmp
-
memory/3160-10-0x00000000081E3000-0x000000000868B000-memory.dmpFilesize
4.7MB
-
memory/3160-0-0x0000000000000000-mapping.dmp
-
memory/4164-13-0x0000000000000000-mapping.dmp
-
memory/4484-15-0x0000000000000000-mapping.dmp
-
memory/4544-20-0x0000000000000000-mapping.dmp
-
memory/4628-21-0x0000000000000000-mapping.dmp