Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 11:26
Static task
static1
Behavioral task
behavioral1
Sample
735e27f460be6edce9f0cd5c0d0972b0.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
735e27f460be6edce9f0cd5c0d0972b0.exe
Resource
win10v20201028
General
-
Target
735e27f460be6edce9f0cd5c0d0972b0.exe
-
Size
173KB
-
MD5
2df254dce86ca636e77f4ad422d21da4
-
SHA1
4efa723962bc64e753742f5fdeec4dc1c2985a51
-
SHA256
a1a1e34dbc30a46811f5b717f808908412aa6f3d6840aa526d5c0154e008558e
-
SHA512
9cc70f4525162dfeedba5c3ec421fbf219596077824489cd74d3bc9038c00d96210396312a7426416db1df62d3cad7b71167145aaa1ff8c3623645ffcfa53acd
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\# DECRYPT MY FILES #.txt
http://cerberhhyed5frqa.onion.to/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.cab/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.nu/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.link/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.tor2web.org/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.to/EE07-24B3-7A9E-0000-0182);
http://cerberhhyed5frqa.onion/EE07-24B3-7A9E-0000-0182
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.cab/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.nu/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.link/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.tor2web.org/EE07-24B3-7A9E-0000-0182
http://cerberhhyed5frqa.onion.to/EE07-24B3-7A9E-0000-0182);
http://cerberhhyed5frqa.onion/EE07-24B3-7A9E-0000-0182
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
735e27f460be6edce9f0cd5c0d0972b0.exedfrgui.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dfrgui.exe\"" 735e27f460be6edce9f0cd5c0d0972b0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dfrgui.exe\"" dfrgui.exe -
Executes dropped EXE 1 IoCs
Processes:
dfrgui.exepid process 3580 dfrgui.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dfrgui.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SearchPush.tiff dfrgui.exe File opened for modification C:\Users\Admin\Pictures\RepairCopy.tiff dfrgui.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dfrgui.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation dfrgui.exe -
Drops startup file 2 IoCs
Processes:
735e27f460be6edce9f0cd5c0d0972b0.exedfrgui.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\dfrgui.lnk 735e27f460be6edce9f0cd5c0d0972b0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\dfrgui.lnk dfrgui.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
735e27f460be6edce9f0cd5c0d0972b0.exedfrgui.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dfrgui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dfrgui.exe\"" 735e27f460be6edce9f0cd5c0d0972b0.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run dfrgui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\dfrgui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dfrgui.exe\"" dfrgui.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce dfrgui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dfrgui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dfrgui.exe\"" dfrgui.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run 735e27f460be6edce9f0cd5c0d0972b0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\dfrgui = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dfrgui.exe\"" 735e27f460be6edce9f0cd5c0d0972b0.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 735e27f460be6edce9f0cd5c0d0972b0.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ipinfo.io -
Modifies service 2 TTPs 4 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4056 vssadmin.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2284 taskkill.exe 4676 taskkill.exe -
Modifies Control Panel 5 IoCs
Processes:
dfrgui.exeMicrosoftEdge.exe735e27f460be6edce9f0cd5c0d0972b0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dfrgui.exe\"" dfrgui.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Colors MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop 735e27f460be6edce9f0cd5c0d0972b0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\\dfrgui.exe\"" 735e27f460be6edce9f0cd5c0d0972b0.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop dfrgui.exe -
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies registry class 274 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedfrgui.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 14176c5bd9bcd601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesVersion = "6" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{4052D90E-1500-4652-868E-5B38120EFF7A} = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\Md5FileCheck = 9fa75725855604a758366c6a1d9f0311 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = e0d6c1d4b4e3d601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 808a4f6ed9bcd601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileCountryCode = "US" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings dfrgui.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = beff6d6ed9bcd601 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 05519a75d9bcd601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "62ardfr" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root MicrosoftEdge.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
dfrgui.exepid process 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe 3580 dfrgui.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
MicrosoftEdgeCP.exepid process 1940 MicrosoftEdgeCP.exe 1940 MicrosoftEdgeCP.exe 1940 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
735e27f460be6edce9f0cd5c0d0972b0.exedfrgui.exetaskkill.exevssvc.exewmic.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 672 735e27f460be6edce9f0cd5c0d0972b0.exe Token: SeDebugPrivilege 3580 dfrgui.exe Token: SeDebugPrivilege 2284 taskkill.exe Token: SeBackupPrivilege 2436 vssvc.exe Token: SeRestorePrivilege 2436 vssvc.exe Token: SeAuditPrivilege 2436 vssvc.exe Token: SeIncreaseQuotaPrivilege 636 wmic.exe Token: SeSecurityPrivilege 636 wmic.exe Token: SeTakeOwnershipPrivilege 636 wmic.exe Token: SeLoadDriverPrivilege 636 wmic.exe Token: SeSystemProfilePrivilege 636 wmic.exe Token: SeSystemtimePrivilege 636 wmic.exe Token: SeProfSingleProcessPrivilege 636 wmic.exe Token: SeIncBasePriorityPrivilege 636 wmic.exe Token: SeCreatePagefilePrivilege 636 wmic.exe Token: SeBackupPrivilege 636 wmic.exe Token: SeRestorePrivilege 636 wmic.exe Token: SeShutdownPrivilege 636 wmic.exe Token: SeDebugPrivilege 636 wmic.exe Token: SeSystemEnvironmentPrivilege 636 wmic.exe Token: SeRemoteShutdownPrivilege 636 wmic.exe Token: SeUndockPrivilege 636 wmic.exe Token: SeManageVolumePrivilege 636 wmic.exe Token: 33 636 wmic.exe Token: 34 636 wmic.exe Token: 35 636 wmic.exe Token: 36 636 wmic.exe Token: SeIncreaseQuotaPrivilege 636 wmic.exe Token: SeSecurityPrivilege 636 wmic.exe Token: SeTakeOwnershipPrivilege 636 wmic.exe Token: SeLoadDriverPrivilege 636 wmic.exe Token: SeSystemProfilePrivilege 636 wmic.exe Token: SeSystemtimePrivilege 636 wmic.exe Token: SeProfSingleProcessPrivilege 636 wmic.exe Token: SeIncBasePriorityPrivilege 636 wmic.exe Token: SeCreatePagefilePrivilege 636 wmic.exe Token: SeBackupPrivilege 636 wmic.exe Token: SeRestorePrivilege 636 wmic.exe Token: SeShutdownPrivilege 636 wmic.exe Token: SeDebugPrivilege 636 wmic.exe Token: SeSystemEnvironmentPrivilege 636 wmic.exe Token: SeRemoteShutdownPrivilege 636 wmic.exe Token: SeUndockPrivilege 636 wmic.exe Token: SeManageVolumePrivilege 636 wmic.exe Token: 33 636 wmic.exe Token: 34 636 wmic.exe Token: 35 636 wmic.exe Token: 36 636 wmic.exe Token: SeDebugPrivilege 2592 MicrosoftEdge.exe Token: SeDebugPrivilege 2592 MicrosoftEdge.exe Token: SeDebugPrivilege 2592 MicrosoftEdge.exe Token: SeDebugPrivilege 2592 MicrosoftEdge.exe Token: SeDebugPrivilege 4196 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4196 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4196 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4196 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 508 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 508 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 508 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 508 MicrosoftEdgeCP.exe Token: 33 4396 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4396 AUDIODG.EXE Token: SeDebugPrivilege 4676 taskkill.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2592 MicrosoftEdge.exe 1940 MicrosoftEdgeCP.exe 1940 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
735e27f460be6edce9f0cd5c0d0972b0.exedfrgui.execmd.exeMicrosoftEdgeCP.execmd.exedescription pid process target process PID 672 wrote to memory of 3580 672 735e27f460be6edce9f0cd5c0d0972b0.exe dfrgui.exe PID 672 wrote to memory of 3580 672 735e27f460be6edce9f0cd5c0d0972b0.exe dfrgui.exe PID 672 wrote to memory of 3580 672 735e27f460be6edce9f0cd5c0d0972b0.exe dfrgui.exe PID 672 wrote to memory of 2076 672 735e27f460be6edce9f0cd5c0d0972b0.exe cmd.exe PID 672 wrote to memory of 2076 672 735e27f460be6edce9f0cd5c0d0972b0.exe cmd.exe PID 672 wrote to memory of 2076 672 735e27f460be6edce9f0cd5c0d0972b0.exe cmd.exe PID 3580 wrote to memory of 4056 3580 dfrgui.exe vssadmin.exe PID 3580 wrote to memory of 4056 3580 dfrgui.exe vssadmin.exe PID 3580 wrote to memory of 4056 3580 dfrgui.exe vssadmin.exe PID 2076 wrote to memory of 2284 2076 cmd.exe taskkill.exe PID 2076 wrote to memory of 2284 2076 cmd.exe taskkill.exe PID 2076 wrote to memory of 2284 2076 cmd.exe taskkill.exe PID 2076 wrote to memory of 1504 2076 cmd.exe PING.EXE PID 2076 wrote to memory of 1504 2076 cmd.exe PING.EXE PID 2076 wrote to memory of 1504 2076 cmd.exe PING.EXE PID 3580 wrote to memory of 636 3580 dfrgui.exe wmic.exe PID 3580 wrote to memory of 636 3580 dfrgui.exe wmic.exe PID 3580 wrote to memory of 636 3580 dfrgui.exe wmic.exe PID 3580 wrote to memory of 1776 3580 dfrgui.exe NOTEPAD.EXE PID 3580 wrote to memory of 1776 3580 dfrgui.exe NOTEPAD.EXE PID 3580 wrote to memory of 1776 3580 dfrgui.exe NOTEPAD.EXE PID 3580 wrote to memory of 4160 3580 dfrgui.exe WScript.exe PID 3580 wrote to memory of 4160 3580 dfrgui.exe WScript.exe PID 3580 wrote to memory of 4160 3580 dfrgui.exe WScript.exe PID 1940 wrote to memory of 508 1940 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1940 wrote to memory of 508 1940 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1940 wrote to memory of 508 1940 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1940 wrote to memory of 508 1940 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1940 wrote to memory of 508 1940 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1940 wrote to memory of 508 1940 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1940 wrote to memory of 4196 1940 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1940 wrote to memory of 4196 1940 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3580 wrote to memory of 4632 3580 dfrgui.exe cmd.exe PID 3580 wrote to memory of 4632 3580 dfrgui.exe cmd.exe PID 3580 wrote to memory of 4632 3580 dfrgui.exe cmd.exe PID 4632 wrote to memory of 4676 4632 cmd.exe taskkill.exe PID 4632 wrote to memory of 4676 4632 cmd.exe taskkill.exe PID 4632 wrote to memory of 4676 4632 cmd.exe taskkill.exe PID 4632 wrote to memory of 4756 4632 cmd.exe PING.EXE PID 4632 wrote to memory of 4756 4632 cmd.exe PING.EXE PID 4632 wrote to memory of 4756 4632 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\735e27f460be6edce9f0cd5c0d0972b0.exe"C:\Users\Admin\AppData\Local\Temp\735e27f460be6edce9f0cd5c0d0972b0.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dfrgui.exe"C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dfrgui.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "dfrgui.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dfrgui.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "dfrgui.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "735e27f460be6edce9f0cd5c0d0972b0.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\735e27f460be6edce9f0cd5c0d0972b0.exe" > NUL2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "735e27f460be6edce9f0cd5c0d0972b0.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3a41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\dfrgui.lnkMD5
bc0014f02c19fdf2e538005592229bc2
SHA15311b43b44800712fa4836250a82d1b3f4086f04
SHA2565ddd3ad5420e20d5e0861fd3cb9dba1d821bb66d4f61220d61e7d3743dfd2851
SHA512a7f143eac0a53f38c6f6ea91745beeb7a1288c097ff8ce4979260d2abea77df7edf3043a4f75aab1de8b53413d3960920b08e375ccc9ef184dafc136111772d2
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dfrgui.exeMD5
2df254dce86ca636e77f4ad422d21da4
SHA14efa723962bc64e753742f5fdeec4dc1c2985a51
SHA256a1a1e34dbc30a46811f5b717f808908412aa6f3d6840aa526d5c0154e008558e
SHA5129cc70f4525162dfeedba5c3ec421fbf219596077824489cd74d3bc9038c00d96210396312a7426416db1df62d3cad7b71167145aaa1ff8c3623645ffcfa53acd
-
C:\Users\Admin\AppData\Roaming\{979CC176-2CBB-9CDF-ED19-828F81E1B52B}\dfrgui.exeMD5
2df254dce86ca636e77f4ad422d21da4
SHA14efa723962bc64e753742f5fdeec4dc1c2985a51
SHA256a1a1e34dbc30a46811f5b717f808908412aa6f3d6840aa526d5c0154e008558e
SHA5129cc70f4525162dfeedba5c3ec421fbf219596077824489cd74d3bc9038c00d96210396312a7426416db1df62d3cad7b71167145aaa1ff8c3623645ffcfa53acd
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.htmlMD5
b4044b6ecd767f876ae97c8585d0a62f
SHA1c55a11973d64c139a7c84d886f6477d4a8a66ad8
SHA256f637a59d807aa7ce0fd484e037ef88451f01819d5d6e37c7b4489aefbd153764
SHA512198f35583db87108c38d1f998a97252653d7d57488617ed70dffdea5ee7842eff5b6bea9865eec6d6b9c87507a428eccfffab479e136acdd59ec107c58329320
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txtMD5
52029b0a9c75113f2c6c6a69fb59004c
SHA1b645fac71cb6462a84c71d45fb87dfd7a6a03d7e
SHA25678cf5e1764c1ba5615a51ec9c5fd1616383c3fae6ccdaf7fad049c5724ea8d4d
SHA5121208a6f8fd9b1d6d39f70ea249fa31da527cee31871b1371cfc09d9633bed0e0c773e1ba67d441040bdfc57df026d2512603387a65c3d4c343c9e49e45aef334
-
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbsMD5
e885e348f83d97db3deb82ed43a64eeb
SHA1931f6266326fb778117d52d9e74eb9b8545bb2f2
SHA256bf4b1b2372317eb80d719b452100e9538ea7d44f5e168a7e59d0aecfebf5b660
SHA5124fee5c7cf95a5930062eea507911d172644c73c592291a520230eca5bb27009923cf03f0b6bdc1912eee841dcc561f82b4071265e75787801a07547650d1be44
-
memory/636-7-0x0000000000000000-mapping.dmp
-
memory/1504-6-0x0000000000000000-mapping.dmp
-
memory/1776-9-0x0000000000000000-mapping.dmp
-
memory/2076-3-0x0000000000000000-mapping.dmp
-
memory/2284-5-0x0000000000000000-mapping.dmp
-
memory/3580-12-0x0000000004360000-0x000000000462D000-memory.dmpFilesize
2.8MB
-
memory/3580-0-0x0000000000000000-mapping.dmp
-
memory/4056-4-0x0000000000000000-mapping.dmp
-
memory/4160-13-0x0000000000000000-mapping.dmp
-
memory/4632-15-0x0000000000000000-mapping.dmp
-
memory/4676-16-0x0000000000000000-mapping.dmp
-
memory/4756-17-0x0000000000000000-mapping.dmp