Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-11-2020 14:34
Static task
static1
Behavioral task
behavioral1
Sample
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe
Resource
win10v20201028
General
-
Target
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe
-
Size
173KB
-
MD5
8cf406f0f89d84050ddc3f5acc013e4e
-
SHA1
060e505e4283811d629b406cf137432237239bc3
-
SHA256
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2
-
SHA512
7318ab05ec213695e08b9edeb7948f5430ea3509146781edbf41c857d098194185be655dcb2e93a4fc8c9979b41192236200286f8e016a6828bfe5839a8489f0
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\# DECRYPT MY FILES #.txt
http://cerberhhyed5frqa.onion.to/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.cab/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.nu/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.link/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.tor2web.org/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.to/7801-3D47-6A9D-0000-0919);
http://cerberhhyed5frqa.onion/7801-3D47-6A9D-0000-0919
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.cab/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.nu/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.link/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.tor2web.org/7801-3D47-6A9D-0000-0919
http://cerberhhyed5frqa.onion.to/7801-3D47-6A9D-0000-0919);
http://cerberhhyed5frqa.onion/7801-3D47-6A9D-0000-0919
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
lodctr.exe3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\lodctr.exe\"" lodctr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\lodctr.exe\"" 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe -
Executes dropped EXE 1 IoCs
Processes:
lodctr.exepid process 3680 lodctr.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
lodctr.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ApproveRedo.tiff lodctr.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lodctr.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation lodctr.exe -
Drops startup file 2 IoCs
Processes:
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exelodctr.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\lodctr.lnk 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\lodctr.lnk lodctr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exelodctr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\lodctr = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\lodctr.exe\"" 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lodctr = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\lodctr.exe\"" 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run lodctr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\lodctr = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\lodctr.exe\"" lodctr.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce lodctr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lodctr = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\lodctr.exe\"" lodctr.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 ipinfo.io -
Modifies service 2 TTPs 4 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2824 vssadmin.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1996 taskkill.exe 4676 taskkill.exe -
Modifies Control Panel 5 IoCs
Processes:
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exelodctr.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\lodctr.exe\"" 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop lodctr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\\lodctr.exe\"" lodctr.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors MicrosoftEdge.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 188 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000ed9bd501fdbed78bd7514ee856a5630ac586e848814e7b7d42b30e34fe506165d513739c46f790f7f9c8ed80ecb5c74e189b12463ae90389d882 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{093C1BA0-380E-4DAA-849B-544509EB2B7E}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{3C0CA8AB-A480-4F69-B7E8-769FDBF8B074}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c900ea3217b9d601 MicrosoftEdge.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
lodctr.exepid process 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe 3680 lodctr.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
MicrosoftEdgeCP.exepid process 3796 MicrosoftEdgeCP.exe 3796 MicrosoftEdgeCP.exe 3796 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exelodctr.exetaskkill.exevssvc.exewmic.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 492 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe Token: SeDebugPrivilege 3680 lodctr.exe Token: SeDebugPrivilege 1996 taskkill.exe Token: SeBackupPrivilege 1936 vssvc.exe Token: SeRestorePrivilege 1936 vssvc.exe Token: SeAuditPrivilege 1936 vssvc.exe Token: SeIncreaseQuotaPrivilege 3700 wmic.exe Token: SeSecurityPrivilege 3700 wmic.exe Token: SeTakeOwnershipPrivilege 3700 wmic.exe Token: SeLoadDriverPrivilege 3700 wmic.exe Token: SeSystemProfilePrivilege 3700 wmic.exe Token: SeSystemtimePrivilege 3700 wmic.exe Token: SeProfSingleProcessPrivilege 3700 wmic.exe Token: SeIncBasePriorityPrivilege 3700 wmic.exe Token: SeCreatePagefilePrivilege 3700 wmic.exe Token: SeBackupPrivilege 3700 wmic.exe Token: SeRestorePrivilege 3700 wmic.exe Token: SeShutdownPrivilege 3700 wmic.exe Token: SeDebugPrivilege 3700 wmic.exe Token: SeSystemEnvironmentPrivilege 3700 wmic.exe Token: SeRemoteShutdownPrivilege 3700 wmic.exe Token: SeUndockPrivilege 3700 wmic.exe Token: SeManageVolumePrivilege 3700 wmic.exe Token: 33 3700 wmic.exe Token: 34 3700 wmic.exe Token: 35 3700 wmic.exe Token: 36 3700 wmic.exe Token: SeIncreaseQuotaPrivilege 3700 wmic.exe Token: SeSecurityPrivilege 3700 wmic.exe Token: SeTakeOwnershipPrivilege 3700 wmic.exe Token: SeLoadDriverPrivilege 3700 wmic.exe Token: SeSystemProfilePrivilege 3700 wmic.exe Token: SeSystemtimePrivilege 3700 wmic.exe Token: SeProfSingleProcessPrivilege 3700 wmic.exe Token: SeIncBasePriorityPrivilege 3700 wmic.exe Token: SeCreatePagefilePrivilege 3700 wmic.exe Token: SeBackupPrivilege 3700 wmic.exe Token: SeRestorePrivilege 3700 wmic.exe Token: SeShutdownPrivilege 3700 wmic.exe Token: SeDebugPrivilege 3700 wmic.exe Token: SeSystemEnvironmentPrivilege 3700 wmic.exe Token: SeRemoteShutdownPrivilege 3700 wmic.exe Token: SeUndockPrivilege 3700 wmic.exe Token: SeManageVolumePrivilege 3700 wmic.exe Token: 33 3700 wmic.exe Token: 34 3700 wmic.exe Token: 35 3700 wmic.exe Token: 36 3700 wmic.exe Token: SeDebugPrivilege 3792 MicrosoftEdge.exe Token: SeDebugPrivilege 3792 MicrosoftEdge.exe Token: SeDebugPrivilege 3792 MicrosoftEdge.exe Token: SeDebugPrivilege 3792 MicrosoftEdge.exe Token: SeDebugPrivilege 3096 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3096 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3096 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3096 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4112 MicrosoftEdgeCP.exe Token: 33 4328 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4328 AUDIODG.EXE Token: SeDebugPrivilege 4676 taskkill.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 3792 MicrosoftEdge.exe 3796 MicrosoftEdgeCP.exe 3796 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.execmd.exelodctr.exeMicrosoftEdgeCP.execmd.exedescription pid process target process PID 492 wrote to memory of 3680 492 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe lodctr.exe PID 492 wrote to memory of 3680 492 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe lodctr.exe PID 492 wrote to memory of 3680 492 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe lodctr.exe PID 492 wrote to memory of 3112 492 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe cmd.exe PID 492 wrote to memory of 3112 492 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe cmd.exe PID 492 wrote to memory of 3112 492 3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe cmd.exe PID 3112 wrote to memory of 1996 3112 cmd.exe taskkill.exe PID 3112 wrote to memory of 1996 3112 cmd.exe taskkill.exe PID 3112 wrote to memory of 1996 3112 cmd.exe taskkill.exe PID 3680 wrote to memory of 2824 3680 lodctr.exe vssadmin.exe PID 3680 wrote to memory of 2824 3680 lodctr.exe vssadmin.exe PID 3680 wrote to memory of 2824 3680 lodctr.exe vssadmin.exe PID 3112 wrote to memory of 2012 3112 cmd.exe PING.EXE PID 3112 wrote to memory of 2012 3112 cmd.exe PING.EXE PID 3112 wrote to memory of 2012 3112 cmd.exe PING.EXE PID 3680 wrote to memory of 3700 3680 lodctr.exe wmic.exe PID 3680 wrote to memory of 3700 3680 lodctr.exe wmic.exe PID 3680 wrote to memory of 3700 3680 lodctr.exe wmic.exe PID 3680 wrote to memory of 1524 3680 lodctr.exe NOTEPAD.EXE PID 3680 wrote to memory of 1524 3680 lodctr.exe NOTEPAD.EXE PID 3680 wrote to memory of 1524 3680 lodctr.exe NOTEPAD.EXE PID 3680 wrote to memory of 3140 3680 lodctr.exe WScript.exe PID 3680 wrote to memory of 3140 3680 lodctr.exe WScript.exe PID 3680 wrote to memory of 3140 3680 lodctr.exe WScript.exe PID 3796 wrote to memory of 3096 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 3096 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 3096 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 3096 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 3096 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 3096 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 4112 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 4112 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 4112 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 4112 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 4112 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3796 wrote to memory of 4112 3796 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3680 wrote to memory of 4632 3680 lodctr.exe cmd.exe PID 3680 wrote to memory of 4632 3680 lodctr.exe cmd.exe PID 3680 wrote to memory of 4632 3680 lodctr.exe cmd.exe PID 4632 wrote to memory of 4676 4632 cmd.exe taskkill.exe PID 4632 wrote to memory of 4676 4632 cmd.exe taskkill.exe PID 4632 wrote to memory of 4676 4632 cmd.exe taskkill.exe PID 4632 wrote to memory of 4756 4632 cmd.exe PING.EXE PID 4632 wrote to memory of 4756 4632 cmd.exe PING.EXE PID 4632 wrote to memory of 4756 4632 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe"C:\Users\Admin\AppData\Local\Temp\3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\lodctr.exe"C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\lodctr.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2824 -
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3700 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵PID:1524
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵PID:3140
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "lodctr.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{B41C886F-C036-B863-F7F7-D2EFEF05198C}\lodctr.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "lodctr.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4676 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
PID:4756 -
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe" > NUL2⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "3a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1996 -
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:2012
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3792
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:1568
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3bc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4328
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
6a8aa988b7870845c55a8ef317620d85
SHA11000d1322e2eb7f00c4cd2bce1a0cfa0d36ca935
SHA256fbd54871b94f5d241450c1691e64615ede5ef8e912a3c68676c7aa6054525cbd
SHA5125644594098342985a9af1d1985f15188da54bf3a57a885a435ff0470faafab3411744d649c6fd4ec06020cfe3384577bacd559027bc8f2fbc171e6b32046d4a5
-
MD5
8cf406f0f89d84050ddc3f5acc013e4e
SHA1060e505e4283811d629b406cf137432237239bc3
SHA2563a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2
SHA5127318ab05ec213695e08b9edeb7948f5430ea3509146781edbf41c857d098194185be655dcb2e93a4fc8c9979b41192236200286f8e016a6828bfe5839a8489f0
-
MD5
8cf406f0f89d84050ddc3f5acc013e4e
SHA1060e505e4283811d629b406cf137432237239bc3
SHA2563a7e74f0ecf5c9b44add16fceb394def8a7789334906a710e476e7f361cd38c2
SHA5127318ab05ec213695e08b9edeb7948f5430ea3509146781edbf41c857d098194185be655dcb2e93a4fc8c9979b41192236200286f8e016a6828bfe5839a8489f0
-
MD5
ef7509c51be6905ce53095efabd09b4e
SHA1232d05f651fd3a35f5c4129b0f3f08042834f8bd
SHA2563c23edd27c02be81081d5aa4cc3031001c0277372467e372ef89db7b2a0e2de7
SHA5120e5e4c60c22304e9b8f9e673c1709fad6e7237054f8ec7ecd54ebcbdb1d5514708f25cc5b4ebbcf230ddd99910df8af91902427ceab30421400b8deb261b8f66
-
MD5
cb6dfe6d46433946d19ccc1477bb11bf
SHA1d84b896ed6e95f6b7be30d6cf09ae0401d4671a5
SHA256b9f5bcd63c9574538699584d480f3b690556bb50efbd29174498acc2c1e7cb57
SHA51225bdb4ebbfd9a12aaf3ed2d262ca7d449c0832ae531214503bb893e1e2957feba80b241acce291e8a0a31ea53d1237717aa7ed10d923d7db1933f7ad22426bda
-
MD5
e885e348f83d97db3deb82ed43a64eeb
SHA1931f6266326fb778117d52d9e74eb9b8545bb2f2
SHA256bf4b1b2372317eb80d719b452100e9538ea7d44f5e168a7e59d0aecfebf5b660
SHA5124fee5c7cf95a5930062eea507911d172644c73c592291a520230eca5bb27009923cf03f0b6bdc1912eee841dcc561f82b4071265e75787801a07547650d1be44