Analysis
-
max time kernel
153s -
max time network
161s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 09:46
Static task
static1
Behavioral task
behavioral1
Sample
c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
Resource
win10v20210408
General
-
Target
c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe
-
Size
2.7MB
-
MD5
d4bb3c12496bfe033a3163eda9fa9b1b
-
SHA1
1b93dd31ec5b7fb54e0b3264010d758854df45f3
-
SHA256
c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596
-
SHA512
0738d6525fb3f7cde7521b14b894cd270a1239a248e386db5b296683c6781ef2dff77e5ef3f3ff22195cda59295ae1e4756e0be25a093ddb414dbdc1c805e443
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exeSynaptics.exepid process 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 4040 Synaptics.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\fSsuaPNw.xlsm office_macros -
Processes:
resource yara_rule behavioral2/memory/3756-120-0x0000000000900000-0x0000000000926000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SS CRACK RETRIX = "C:\\ProgramData\\Synaptics\\Synaptics.exe" c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 2f9a9c316946d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "327504767" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz! MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658 = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{30D692A8-E7E4-4057-8B96-D4A3F701B8B5}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2304 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exepid process 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
MicrosoftEdgeCP.exepid process 3788 MicrosoftEdgeCP.exe 3788 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 1600 MicrosoftEdge.exe Token: SeDebugPrivilege 1600 MicrosoftEdge.exe Token: SeDebugPrivilege 1600 MicrosoftEdge.exe Token: SeDebugPrivilege 1600 MicrosoftEdge.exe Token: SeDebugPrivilege 624 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 624 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 624 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 624 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5116 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5116 MicrosoftEdgeCP.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeOpenWith.exeEXCEL.EXEpid process 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 3756 ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe 1600 MicrosoftEdge.exe 3788 MicrosoftEdgeCP.exe 3788 MicrosoftEdgeCP.exe 4660 OpenWith.exe 2304 EXCEL.EXE 2304 EXCEL.EXE 2304 EXCEL.EXE 2304 EXCEL.EXE 2304 EXCEL.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exeMicrosoftEdgeCP.exedescription pid process target process PID 632 wrote to memory of 3756 632 c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe PID 632 wrote to memory of 3756 632 c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe PID 632 wrote to memory of 3756 632 c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe ._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe PID 632 wrote to memory of 4040 632 c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe Synaptics.exe PID 632 wrote to memory of 4040 632 c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe Synaptics.exe PID 632 wrote to memory of 4040 632 c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe Synaptics.exe PID 3788 wrote to memory of 624 3788 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3788 wrote to memory of 624 3788 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3788 wrote to memory of 624 3788 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3788 wrote to memory of 624 3788 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3788 wrote to memory of 624 3788 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3788 wrote to memory of 624 3788 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3788 wrote to memory of 624 3788 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe"C:\Users\Admin\AppData\Local\Temp\c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe"C:\Users\Admin\AppData\Local\Temp\._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
f65d4cf706c2add18897c640b67c8b84
SHA1dd63c38d5fd4a2d466a36dc35e8c082237de24f8
SHA256f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655
SHA512b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
f65d4cf706c2add18897c640b67c8b84
SHA1dd63c38d5fd4a2d466a36dc35e8c082237de24f8
SHA256f1a5a873cc3987b2a2a756aec8bacfb6d2c922892ce07a0ffb820a332fe82655
SHA512b0e5c1a9d5dd2aff80485b2b237e6350fbd14d67323fd6a85fbc221e45a2bc0b48a2d46bb371d5498f9246943c8015bacce15d20c4c453bb772690534babf2e6
-
C:\Users\Admin\AppData\Local\Temp\._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exeMD5
f1796244b47d29ed90750f55a4443eee
SHA1a9769435121e0c8ae9281799a3217c38024f21f1
SHA25643d52c745f116feb2507f3434b269a9b8ca93c7bdaabb6a31f6c1f9b12234bf8
SHA512488e2d4bc577bd6c23ebe723f904220381c3990850eb9440677eba3b9f3f044157509d1216baacb0ca3bbc36f2f3dfa61c295ac0af995668f48af3733ba87f29
-
C:\Users\Admin\AppData\Local\Temp\._cache_c47510356a4e45be7d496a41ec6f2b44b9ad402712ad2b0ea1779bf2ebacf596.exeMD5
f1796244b47d29ed90750f55a4443eee
SHA1a9769435121e0c8ae9281799a3217c38024f21f1
SHA25643d52c745f116feb2507f3434b269a9b8ca93c7bdaabb6a31f6c1f9b12234bf8
SHA512488e2d4bc577bd6c23ebe723f904220381c3990850eb9440677eba3b9f3f044157509d1216baacb0ca3bbc36f2f3dfa61c295ac0af995668f48af3733ba87f29
-
C:\Users\Admin\AppData\Local\Temp\fSsuaPNw.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
memory/632-114-0x0000000000740000-0x00000000007EE000-memory.dmpFilesize
696KB
-
memory/2304-127-0x00007FFB2BCA0000-0x00007FFB2BCB0000-memory.dmpFilesize
64KB
-
memory/2304-123-0x00007FF620360000-0x00007FF623916000-memory.dmpFilesize
53.7MB
-
memory/2304-126-0x00007FFB2BCA0000-0x00007FFB2BCB0000-memory.dmpFilesize
64KB
-
memory/2304-128-0x00007FFB2BCA0000-0x00007FFB2BCB0000-memory.dmpFilesize
64KB
-
memory/2304-129-0x00007FFB2BCA0000-0x00007FFB2BCB0000-memory.dmpFilesize
64KB
-
memory/2304-130-0x00007FFB2BCA0000-0x00007FFB2BCB0000-memory.dmpFilesize
64KB
-
memory/2304-134-0x00007FFB4ACD0000-0x00007FFB4BDBE000-memory.dmpFilesize
16.9MB
-
memory/2304-135-0x00000232CE440000-0x00000232D0335000-memory.dmpFilesize
31.0MB
-
memory/3756-118-0x00000000024B0000-0x00000000025DE000-memory.dmpFilesize
1.2MB
-
memory/3756-120-0x0000000000900000-0x0000000000926000-memory.dmpFilesize
152KB
-
memory/3756-115-0x0000000000000000-mapping.dmp
-
memory/4040-124-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/4040-119-0x0000000000000000-mapping.dmp