cobaltstrike | e04483ab37a7a4fcd87bf84c4115b64bd1ff3ca162d40437a44d0659545bc2af

Analysis

max time kernel
139s
max time network
150s
platform
windows10_x64
resource
win10v20210408
submitted
20-04-2021 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DocuSign.html
Size

151KB
MD5

9b9ad81357a59408205adf90a0ecfd77
SHA1

dc29234044025144428d9fa5a7b2a7881e7fcd81
SHA256

2d33b98c1750589a3361aaab5533d224f76b2972f6fca27978f09805ae9b8512
SHA512

961ebffffdb0e694cc51ba1831bdb9b3e63ff14b01745f342964974b6b495806f98083586be769d8e795b0f692a22013503129c8feb75ec85fef5e47ebee9250

Score

10^/10

cobaltstrike backdoor persistence trojan

Malware Config

Extracted

Family

cobaltstrike

Version

windows/download_exec

http://0x142f6ca3:443/images/IT_Showcase_Webinar_Security_3000x300.jpg

Extracted

Family

cobaltstrike

http://0x142f6ca3:443/munchkin.js

Attributes

access_type
256
beacon_type
2048
create_remote_thread
0
day
0
dns_idle
0
dns_sleep
0
host
0x142f6ca3,/munchkin.js
http_header1
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACwAAAAMAAAACAAAABU1VSUQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAA8AAAADAAAAAgAAAAlta3RvbmFtZT0AAAAEAAAABwAAAAAAAAADAAAAAgAAAANpZD0AAAAGAAAABkNvb2tpZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
injection_process
jitter
9984
maxdns
0
month
0
pipe_name
polling_time
59069
port_number
443
proxy_password
proxy_server
proxy_username
sc_process32
%windir%\syswow64\mobsync.exe
sc_process64
%windir%\sysnative\mobsync.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6O3B28PchczaYlnPWJYrGrCrx6yFYBpvcCVn8LzaF/Ma6fdTr586chcbQgmWYXFUe1NuCgfalGftLZgQB5oDcpcMyWB7MRLMY0BKmF1gpuDHL3FuCOrDVYNFjYPsYTOEENhUv2HRxAo5Z6UXjHf4tTwJSprk7IHUHiRKJ7CXV3wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
1.852972032e+09
unknown2
AAAABAAAAAIAAACmAAAAAwAAAA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown3
0
unknown4
0
unknown5
1.841236305e+09
uri
/munchkin.marketo.net
user_agent
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
year
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

john.exe

pid process

5660 john.exe

pid	process
5660	john.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\john = "C:\\Users\\Admin\\AppData\\Roaming\\john.exe"	reg.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeiexplore.exeIEXPLORE.EXEMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2287130064"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905a378c1536d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa0000000002000000000010660000000100002000000059a084b06f5d64d530f0b99f829c93f6403ef58154991fc10e1afdabdfb6e171000000000e80000000020000200000001775fc36748ca67abd50cbd4f57b9537ba3caf351114c83e03a22d39cfabc29920000000ea6268963bf97a8ff14918ae3da531afbbf12b8a31ba03516c18b1b6448cfb4240000000643ccf23431090627cebbbf19f706aafbcbb4073981be0e468eb7f8233eaabc2c8367b719a447308e32d43ee637600ce5e6b7ca04e8e9b7236920f666dd658f0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c5588c1536d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30881301"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2320880187"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "325757945"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30881301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000008f31ad9e8b1993b8d6ca4319115c2117c9f3aa4fd6c0c56d70cd7197bb82f2d4000000000e8000000002000020000000dc0819cb22b19d87dc9334d9feb110230773ffdf3610f9d482e99673c37fb173200000003b598e9864f2b1af1aa4bc6b9034c9ea48913e6a2f55367ded43b6d73138cb5a400000001ee33e1151e985cef1c2dea0f102c1add67f7bca4c6627dc0c9df387e847fb06652b2de12db266cd0eef8c23ff45d7c1e9cd7066672540bf1a85ca2c515b73f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2287130064"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "325709360"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "325725954"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30881301"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B34413C9-A208-11EB-B2DB-6EE0A42A1E5F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{A27B8BAA-CAA8-41DC-A24A-6FFADF4F94D0}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomai = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000f01cad68f2079f186e133f0c058e2dd5b0486644a5945f38cf3c797817a04b81c361d673ad59a3fbc1bd5672a8ac0c22cf8b16e28beaa1ce61da1b6bece7a97bb72b2d36251cfa27bb15dc0093c460f569e43cbbc60113dbef342ad16bf84ea90a9a1586aeefb1c1433b6453bd758f6b8c71ffb11f7a0009666cecb791715bb710ce03e4937403c10a4d29e8a55f78bad453047147f3f97687a008629ef37bfed9e66bcd754abcf5696c6a01bb2231452fabb1292a0d298145f2f9e8251f46ad97047a62ce1069182db806a2135e9042259754a0d1681d9dd380e4a9f8934b6c59477259c968b1ed6051c2f018b37bf6ed387587bfa41b44866cc38931f134a130cf2b4433f1c2782a576abb31c1b07384ae8e2bdd61adeb21d52205eed7913bd6bbe324b24a193c55ea1ddb4e2839f7511a78757c40a811f7da9d0f62e74016ff2d7a50be151791492a47427488d7cbe79af22d63df88576c9d21c51abf2be1ae4473a564f100040f3783ce86802dc0a94f24a03adf87abd43cd2e9a30035a52320cb0fa67dcdca2931a8f698b2b430165a3c8689e09a8347a8cc5b5572e5bd3780d879483f	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.who.int\ = "25"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{AF272305-4301-4832-A833-2F6F17505AD2} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\who.int\Total = "25"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "26470"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\who.int\Total = "13"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.youtube.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\who.int\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\who.int\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 16934f911536d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomai = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "31"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{DDBDC77D-55B3-4035-BD93-F5A77DDFD3B1}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.who.int\ = "0"	MicrosoftEdgeCP.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\YourTestResult.zip:Zone.Identifier firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\YourTestResult.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

COVID19OnlineView_PDF_;.exejohn.exe

pid	process
2224	COVID19OnlineView_PDF_;.exe
2224	COVID19OnlineView_PDF_;.exe
2224	COVID19OnlineView_PDF_;.exe
5660	john.exe
5660	john.exe
5660	john.exe
5660	john.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4200 MicrosoftEdgeCP.exe
4200 MicrosoftEdgeCP.exe

pid	process
4200	MicrosoftEdgeCP.exe
4200	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

firefox.exeCOVID19OnlineView_PDF_;.exeMicrosoftEdge.exeMicrosoftEdgeCP.exejohn.exe

description	pid	process
Token: SeDebugPrivilege	2476	firefox.exe
Token: SeDebugPrivilege	2476	firefox.exe
Token: SeDebugPrivilege	2476	firefox.exe
Token: SeDebugPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeDebugPrivilege	4456	MicrosoftEdge.exe
Token: SeDebugPrivilege	4456	MicrosoftEdge.exe
Token: SeDebugPrivilege	4456	MicrosoftEdge.exe
Token: SeDebugPrivilege	4456	MicrosoftEdge.exe
Token: SeIncreaseQuotaPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeSecurityPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeTakeOwnershipPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeLoadDriverPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeSystemProfilePrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeSystemtimePrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeProfSingleProcessPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeIncBasePriorityPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeCreatePagefilePrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeBackupPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeRestorePrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeShutdownPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeDebugPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeSystemEnvironmentPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeRemoteShutdownPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeUndockPrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: SeManageVolumePrivilege	2224	COVID19OnlineView_PDF_;.exe
Token: 33	2224	COVID19OnlineView_PDF_;.exe
Token: 34	2224	COVID19OnlineView_PDF_;.exe
Token: 35	2224	COVID19OnlineView_PDF_;.exe
Token: 36	2224	COVID19OnlineView_PDF_;.exe
Token: SeDebugPrivilege	2876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5660	john.exe
Token: SeDebugPrivilege	2476	firefox.exe
Token: SeDebugPrivilege	2476	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exefirefox.exe

pid process

1000 iexplore.exe
2476 firefox.exe
2476 firefox.exe
2476 firefox.exe
2476 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

2476 firefox.exe
2476 firefox.exe
2476 firefox.exe

pid	process
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
1000	iexplore.exe
1000	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
2476	firefox.exe
4456	MicrosoftEdge.exe
4200	MicrosoftEdgeCP.exe
4200	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 1000 wrote to memory of 2216	1000	iexplore.exe	IEXPLORE.EXE
PID 1000 wrote to memory of 2216	1000	iexplore.exe	IEXPLORE.EXE
PID 1000 wrote to memory of 2216	1000	iexplore.exe	IEXPLORE.EXE
PID 3924 wrote to memory of 2476	3924	firefox.exe	firefox.exe
PID 3924 wrote to memory of 2476	3924	firefox.exe	firefox.exe
PID 3924 wrote to memory of 2476	3924	firefox.exe	firefox.exe
PID 3924 wrote to memory of 2476	3924	firefox.exe	firefox.exe
PID 3924 wrote to memory of 2476	3924	firefox.exe	firefox.exe
PID 3924 wrote to memory of 2476	3924	firefox.exe	firefox.exe
PID 3924 wrote to memory of 2476	3924	firefox.exe	firefox.exe
PID 3924 wrote to memory of 2476	3924	firefox.exe	firefox.exe
PID 3924 wrote to memory of 2476	3924	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4032	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4032	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4116	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4380	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4380	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4380	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4380	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4380	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4380	2476	firefox.exe	firefox.exe
PID 2476 wrote to memory of 4380	2476	firefox.exe	firefox.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\DocuSign.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1000 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2216

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2476.0.1744565455\2082088006" -parentBuildID 20200403170909 -prefsHandle 1524 -prefMapHandle 1516 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2476 "\\.\pipe\gecko-crash-server-pipe.2476" 1604 gpu
    3⤵
    PID:4032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2476.3.1070184198\223735954" -childID 1 -isForBrowser -prefsHandle 2192 -prefMapHandle 2188 -prefsLen 122 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2476 "\\.\pipe\gecko-crash-server-pipe.2476" 2204 tab
    3⤵
    PID:4116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2476.13.856203944\1219648014" -childID 2 -isForBrowser -prefsHandle 3436 -prefMapHandle 3432 -prefsLen 6979 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2476 "\\.\pipe\gecko-crash-server-pipe.2476" 3448 tab
    3⤵
    PID:4380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2476.20.1512421742\345180672" -childID 3 -isForBrowser -prefsHandle 4104 -prefMapHandle 4100 -prefsLen 7750 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2476 "\\.\pipe\gecko-crash-server-pipe.2476" 4064 tab
    3⤵
    PID:4756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2476.27.844141439\1961740334" -childID 4 -isForBrowser -prefsHandle 4528 -prefMapHandle 4316 -prefsLen 8061 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2476 "\\.\pipe\gecko-crash-server-pipe.2476" 4540 tab
    3⤵
    PID:4864

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\Temp1_YourTestResult.zip\COVID19OnlineView_PDF_;.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_YourTestResult.zip\COVID19OnlineView_PDF_;.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v john /t REG_SZ /d C:\Users\Admin\AppData\Roaming\john.exe
  2⤵
  - Adds Run key to start application
  PID:5608
- C:\Users\Admin\AppData\Roaming\john.exe
  "C:\Users\Admin\AppData\Roaming\john.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5660
- - C:\Windows\System32\DWWIN.EXE
    "C:\Windows\System32\DWWIN.EXE"
    3⤵
    PID:5740

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4456

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4404

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4200

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
b8c8b0ee955b46a4df1dd71c75753947

SHA1
0e023de5f301a023eb9b130dc8c0ee6812b1b77f

SHA256
05e68df5ac57af6fef221d1431996178da03315ea5c9fe26d9fc624aa8078ebf

SHA512
f844fa669fbf9417cb8c5689957e2981fe40f94e800159656211b170f595aadf563446e6fb0b37ff7d788bde28233591d8d837d16f0e3c80459c4223112c6720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
954d09b259ee073ab2c47138854add44

SHA1
33d733e0e5337eef1a34261d616842386d6afde2

SHA256
7360809a0395efd1773021f62dcedc252c239b09e49565c1c8a4510693e08aa8

SHA512
67ee5533ae2fb1b1c16db3b9d818a96d929977324f9ffd4d39f35ac17b762047baa9a5ba43579241f0d8bf3f88f646ead67bba0f319b1083ce65ea88e49d87c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\85VJO7BZ.cookie

MD5
c36b34f9fca365878189af38d589719c

SHA1
a1ada6ff1f094da621a0fcf4e9f73d7cd61b60ec

SHA256
9ddc9e1c6786b60f714f8b966f34a7660873e69a8c7f1b01e49da68662693dce

SHA512
0a80ad8c2932c4e0d7a1a5b96735291d9bbcf7f25b486ccc00c22dcd0fd80da74d62a4aaadee087072349d33abea0e298320090d673273bb07f3dc4ac1e1340b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\9U0IOVS2.cookie

MD5
2b4751c09807c17998f9f9ed1f91a2a5

SHA1
dc9ce8364499b7fa4543236384fd810ce75e8b8b

SHA256
b959aca0fb89bd93257d2037e82ef65f5840790082d7aeb9f0d6e20c60679fbd

SHA512
1ed209ca2a0565c8a8ed40b3bc7eed677c96d43b30e761f5ccd054a38dfb4ea6e5b9cbc9b11ea5634c6bbcacf25107d3a6c4304c9115746cdffd452ac7ce43bc

Download Submit
C:\Users\Admin\AppData\Roaming\john.exe

MD5
201fc10e35608cce51742477d5a3f2c0

SHA1
711e76a53bc518fab8bd4276aa533a3a01df0c50

SHA256
e0f0a43ffc60f847231853ebe137e9d93f415ce52cc99b8edd1038bd9c5001e2

SHA512
79fd6d508a6a3fb9af2b4fb8f1b2e98e6c434ca100f25df75dbd60e6f7237a39f4153608d3ec832039cf0e933f101c8b712dec80998a655154a70201f811713a

Download Submit
C:\Users\Admin\AppData\Roaming\john.exe

MD5
201fc10e35608cce51742477d5a3f2c0

SHA1
711e76a53bc518fab8bd4276aa533a3a01df0c50

SHA256
e0f0a43ffc60f847231853ebe137e9d93f415ce52cc99b8edd1038bd9c5001e2

SHA512
79fd6d508a6a3fb9af2b4fb8f1b2e98e6c434ca100f25df75dbd60e6f7237a39f4153608d3ec832039cf0e933f101c8b712dec80998a655154a70201f811713a

Download Submit
memory/1000-114-0x00007FF895BE0000-0x00007FF895C4B000-memory.dmp

Filesize
428KB

Download
memory/2216-115-0x0000000000000000-mapping.dmp

Download
memory/2224-140-0x000000001B673000-0x000000001B675000-memory.dmp

Filesize
8KB

Download
memory/2224-143-0x000000001B675000-0x000000001B677000-memory.dmp

Filesize
8KB

Download
memory/2224-133-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/2224-135-0x00000000011A0000-0x00000000011C9000-memory.dmp

Filesize
164KB

Download
memory/2224-136-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/2224-137-0x000000001B670000-0x000000001B672000-memory.dmp

Filesize
8KB

Download
memory/2224-138-0x000000001B5B0000-0x000000001B5B1000-memory.dmp

Filesize
4KB

Download
memory/2224-139-0x000000001C7D0000-0x000000001C7D1000-memory.dmp

Filesize
4KB

Download
memory/2476-116-0x0000000000000000-mapping.dmp

Download
memory/4032-118-0x0000000000000000-mapping.dmp

Download
memory/4116-123-0x0000000000000000-mapping.dmp

Download
memory/4380-126-0x0000000000000000-mapping.dmp

Download
memory/4756-128-0x0000000000000000-mapping.dmp

Download
memory/4864-130-0x0000000000000000-mapping.dmp

Download
memory/5608-142-0x0000000000000000-mapping.dmp

Download
memory/5660-147-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/5660-149-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/5660-150-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/5660-144-0x0000000000000000-mapping.dmp

Download
memory/5660-153-0x000000001AE60000-0x000000001AE62000-memory.dmp

Filesize
8KB

Download
memory/5740-151-0x000001BCB4880000-0x000001BCB4881000-memory.dmp

Filesize
4KB

Download
memory/5740-155-0x000001BCB4B30000-0x000001BCB4BBD000-memory.dmp

Filesize
564KB

Download
memory/5740-156-0x000001BCB66D0000-0x000001BCB6AD0000-memory.dmp

Filesize
4.0MB

Download
memory/5740-154-0x000001BCB4B30000-0x000001BCB4BBD000-memory.dmp

Filesize
564KB

Download
memory/5740-152-0x0000000000000000-mapping.dmp

Download