ramnit | fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4

Analysis

max time kernel
151s
max time network
113s
platform
windows10_x64
resource
win10v20210408
submitted
13-05-2021 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe
Size

18.1MB
MD5

24b6950158373444b274e5acabd87510
SHA1

e91cf0d3eb318b3d2bdddc5452b631f44b682f9d
SHA256

fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4
SHA512

29d4a71d938faca70d4ccfab7b2aa7942831dc7a37c1200208cc1dbc0db29a68539ab369f9b816e89f5cc6000d9a49f08334de03ad2490662ab56052912e2bce

Score

10^/10

ramnit banker spyware stealer trojan upx vmprotect worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 7 IoCs

Processes:

temp1.temtemp2.temM762.exeM762Srv.exe2.exe2Srv.exeDesktopLayer.exe

pid process

4128 temp1.tem
3364 temp2.tem
3240 M762.exe
2928 M762Srv.exe
3956 2.exe
4180 2Srv.exe
4204 DesktopLayer.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\2.exe	upx
C:\Users\Admin\AppData\Roaming\M762Srv.exe	upx
C:\Users\Admin\AppData\Roaming\2.exe	upx
C:\Users\Admin\AppData\Roaming\M762Srv.exe	upx
C:\Users\Admin\AppData\Roaming\2Srv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Users\Admin\AppData\Roaming\2Srv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/2928-144-0x0000000000400000-0x000000000042E000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\temp1.tem	vmprotect
C:\Users\Admin\AppData\Local\Temp\temp1.tem	vmprotect
behavioral2/memory/4128-118-0x0000000000400000-0x00000000006F9000-memory.dmp	vmprotect

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

temp1.tem

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation temp1.tem
Loads dropped DLL 1 IoCs

Processes:

fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe

pid process

4660 fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	temp1.tem

Drops file in Program Files directory 5 IoCs

Processes:

2Srv.exeM762Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxB3D5.tmp	2Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	2Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxB2FA.tmp	M762Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	M762Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	M762Srv.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEbrowser_broker.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01AD5E9D-B42E-11EB-B2DB-52F460BD0637} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327101464"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327101576"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327101407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01AD378D-B42E-11EB-B2DB-52F460BD0637} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000623e79fc9ceb72fad48f3a5aff9e752fc27dfe8c70bde56b716a1afb771f6d526bcc92638761f8382cceb37346040fd221ee1b8aad8b2aa34b9fd11f7aa15a7d06e7c8366f309c6f720176bf0ef0d37783a9965c77e5c25b333d	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000005276388dcc03e1bad806ed9faff8672cb2300a03a3641a3ee13475766d80725d216a71d28347832897db0530929b9e3c0de734a34d61c8ad9fdf3fefe69f5d7155ab8e99fba4b152ad64d191b91f5358ebfa26f44046dda141cf45e431f00c8428598d54c0bad5e175c3f1d32725f4324e8b9338d9b44b393824d84a1b12d2c07294b2656d29d7fb7c161c624f4bb67dd6b8fd4c414c981069fef5aea4a4ca5d7b7cd3a81b912aa8bf7e700a41326e7f6da39edaecac2bb1fb7cebe82f486775b53185cc10928dc73b1cbbaaf97a0fc0a76a1e585776f48cbdc0db23229d1402bbd3807a67cce89a160e6f0a82c3eac32f2f92d77948388f58e9182fbb42d2dc9282944f0ddf42d79c7556619bad08d48610c2aadbc3593b0f171a2514d914cfb45e80a39c6a005183710da174d9c7dc132f34cf3a88895989691d5f6801dab79d870924e00fd12d5f2393d25ee56d5265ab0032e5350937c20155b9c0597cba8c1d493b8a6d8aab39a929c31c723530eba38ec07c6cfa730afeeb2629834383c140c046d8242c7bdf24b4fdf220a90214397e468fcb175f29f132f66f27f7ec95714181a6b0	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{14375A82-B198-4CDF-9191-32C760B22BA6} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{B0359A9C-1A53-4979-8BFD-92DEC5233CF2}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000ddfd44ec2d595d882743423e0691f9a8b583d102b117c029b21741d0aee3c720c41b4661769f03cf6990d267ff0e67184e55d610349165816865	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

temp1.tem2Srv.exeDesktopLayer.exe2.exeM762.exe

pid	process
4128	temp1.tem
4128	temp1.tem
4180	2Srv.exe
4180	2Srv.exe
4204	DesktopLayer.exe
4204	DesktopLayer.exe
4180	2Srv.exe
4180	2Srv.exe
4204	DesktopLayer.exe
4204	DesktopLayer.exe
3956	2.exe
3956	2.exe
3956	2.exe
3956	2.exe
4204	DesktopLayer.exe
4180	2Srv.exe
4204	DesktopLayer.exe
4180	2Srv.exe
4204	DesktopLayer.exe
4180	2Srv.exe
4204	DesktopLayer.exe
4180	2Srv.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe
3240	M762.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

412 iexplore.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

616

pid	process
412	iexplore.exe

pid	process
616

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

MicrosoftEdge.exe2.exe

description	pid	process
Token: SeDebugPrivilege	2620	MicrosoftEdge.exe
Token: SeDebugPrivilege	2620	MicrosoftEdge.exe
Token: SeDebugPrivilege	2620	MicrosoftEdge.exe
Token: SeDebugPrivilege	2620	MicrosoftEdge.exe
Token: SeDebugPrivilege	3956	2.exe
Token: SeDebugPrivilege	3956	2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

2668 iexplore.exe
412 iexplore.exe

pid	process
2668	iexplore.exe
412	iexplore.exe

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exetemp1.temtemp2.temM762.exe2.exeiexplore.exeiexplore.exeMicrosoftEdge.exeIEXPLORE.EXEIEXPLORE.EXEMicrosoftEdgeCP.exe

pid	process
4660	fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe
4660	fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe
4128	temp1.tem
4128	temp1.tem
3364	temp2.tem
3364	temp2.tem
3240	M762.exe
3240	M762.exe
3956	2.exe
2668	iexplore.exe
2668	iexplore.exe
412	iexplore.exe
412	iexplore.exe
2620	MicrosoftEdge.exe
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
1440	IEXPLORE.EXE
1440	IEXPLORE.EXE
2200	IEXPLORE.EXE
2200	IEXPLORE.EXE
3872	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exetemp2.temM762.exe2.exeM762Srv.exe2Srv.exeDesktopLayer.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 4660 wrote to memory of 4128	4660	fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe	temp1.tem
PID 4660 wrote to memory of 4128	4660	fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe	temp1.tem
PID 4660 wrote to memory of 4128	4660	fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe	temp1.tem
PID 4660 wrote to memory of 3364	4660	fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe	temp2.tem
PID 4660 wrote to memory of 3364	4660	fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe	temp2.tem
PID 4660 wrote to memory of 3364	4660	fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe	temp2.tem
PID 3364 wrote to memory of 3240	3364	temp2.tem	M762.exe
PID 3364 wrote to memory of 3240	3364	temp2.tem	M762.exe
PID 3364 wrote to memory of 3240	3364	temp2.tem	M762.exe
PID 3240 wrote to memory of 2928	3240	M762.exe	M762Srv.exe
PID 3240 wrote to memory of 2928	3240	M762.exe	M762Srv.exe
PID 3240 wrote to memory of 2928	3240	M762.exe	M762Srv.exe
PID 3364 wrote to memory of 3956	3364	temp2.tem	2.exe
PID 3364 wrote to memory of 3956	3364	temp2.tem	2.exe
PID 3364 wrote to memory of 3956	3364	temp2.tem	2.exe
PID 3956 wrote to memory of 4180	3956	2.exe	2Srv.exe
PID 3956 wrote to memory of 4180	3956	2.exe	2Srv.exe
PID 3956 wrote to memory of 4180	3956	2.exe	2Srv.exe
PID 2928 wrote to memory of 4204	2928	M762Srv.exe	DesktopLayer.exe
PID 2928 wrote to memory of 4204	2928	M762Srv.exe	DesktopLayer.exe
PID 2928 wrote to memory of 4204	2928	M762Srv.exe	DesktopLayer.exe
PID 4180 wrote to memory of 2668	4180	2Srv.exe	iexplore.exe
PID 4180 wrote to memory of 2668	4180	2Srv.exe	iexplore.exe
PID 4204 wrote to memory of 412	4204	DesktopLayer.exe	iexplore.exe
PID 4204 wrote to memory of 412	4204	DesktopLayer.exe	iexplore.exe
PID 2668 wrote to memory of 1440	2668	iexplore.exe	IEXPLORE.EXE
PID 2668 wrote to memory of 1440	2668	iexplore.exe	IEXPLORE.EXE
PID 2668 wrote to memory of 1440	2668	iexplore.exe	IEXPLORE.EXE
PID 412 wrote to memory of 2200	412	iexplore.exe	IEXPLORE.EXE
PID 412 wrote to memory of 2200	412	iexplore.exe	IEXPLORE.EXE
PID 412 wrote to memory of 2200	412	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe
"C:\Users\Admin\AppData\Local\Temp\fb0ba2f663482572e870512c591e87c605ef211f5e8a3f87e34671bfb2e465f4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660

C:\Users\Admin\AppData\Local\Temp\temp1.tem
C:\Users\Admin\AppData\Local\Temp\temp1.tem
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4128

C:\Users\Admin\AppData\Local\Temp\temp2.tem
C:\Users\Admin\AppData\Local\Temp\temp2.tem
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364

C:\Users\Admin\AppData\Roaming\M762.exe
"C:\Users\Admin\AppData\Roaming\M762.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240

C:\Users\Admin\AppData\Roaming\M762Srv.exe
C:\Users\Admin\AppData\Roaming\M762Srv.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2928

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4204

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:412

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:412 CREDAT:82945 /prefetch:2
7⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Users\Admin\AppData\Roaming\2.exe
"C:\Users\Admin\AppData\Roaming\2.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956

C:\Users\Admin\AppData\Roaming\2Srv.exe
C:\Users\Admin\AppData\Roaming\2Srv.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4180

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:82945 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2620

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{01AD378D-B42E-11EB-B2DB-52F460BD0637}.dat

MD5
8884027161f4c15324116e381bc3babc

SHA1
c6e7c11ba596b9fb20d9e07177394c06264a2786

SHA256
db883e7ee1c73774e73d77eea8675827360555f36c5d93f1e8b40cbc565cde7f

SHA512
7dd7dc17b7d08a96fc8d948147471a79ef8e23baf174575c3506d42c51af44f012a9932bb2b3b8138387922bd2d6bc2821ad862f339acdd9b697dcb07c20b35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{01AD5E9D-B42E-11EB-B2DB-52F460BD0637}.dat

MD5
5a35f0abad7ba6e97b9eb6225058f528

SHA1
fce850891e487cf7514b6678fe2eb06705cfd2b7

SHA256
e12c099436786f211166782faec1a15054d70dd5ed533d5f27a39e4e46fdafdd

SHA512
c6c41d3920e3896771f9544bf38d5accd475c29cd258260e0cbcb75f2c4ea62ec0416c63f5186ffc0c0aa321fcf29ec446065b9424b04e6881b8af9a74c8dda1

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1.tem

MD5
127195325dd7b2829451bb6ad6e06270

SHA1
784786b3b4de8c1fcbdc96a47e092070e251d828

SHA256
6f02534cbd5f85f54eafd5646356ce30639d45ebe0e60a89f0eef88a471b42be

SHA512
d0f8e3655cd161acc707f27a574ae179ef524267fdf1b3339c2311c270501cad20aad1acd1d76e7ee3930ee998dc36bda980765fa17ddcf74aa090684bf3ef6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp1.tem

MD5
127195325dd7b2829451bb6ad6e06270

SHA1
784786b3b4de8c1fcbdc96a47e092070e251d828

SHA256
6f02534cbd5f85f54eafd5646356ce30639d45ebe0e60a89f0eef88a471b42be

SHA512
d0f8e3655cd161acc707f27a574ae179ef524267fdf1b3339c2311c270501cad20aad1acd1d76e7ee3930ee998dc36bda980765fa17ddcf74aa090684bf3ef6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp2.tem

MD5
172a6db591c702bec0af1a288cb461fa

SHA1
64cebf0e3e1afdf0b8baa18758f755cea5db5d94

SHA256
0e5fed4587bcd7b9383eaf25121c75b4816ae94d2acad5d0addda921e80dca1a

SHA512
9398af07867f24154c9cc0d1a619c34960b25f2937b07ccaf5e38a6205307a7e717603b352a5da4c64ba1319825f22ed2d16230cadbb28ee7c88e32f4b926d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp2.tem

MD5
172a6db591c702bec0af1a288cb461fa

SHA1
64cebf0e3e1afdf0b8baa18758f755cea5db5d94

SHA256
0e5fed4587bcd7b9383eaf25121c75b4816ae94d2acad5d0addda921e80dca1a

SHA512
9398af07867f24154c9cc0d1a619c34960b25f2937b07ccaf5e38a6205307a7e717603b352a5da4c64ba1319825f22ed2d16230cadbb28ee7c88e32f4b926d86

Download Submit
C:\Users\Admin\AppData\Roaming\2.exe

MD5
5e1e34373e984dd98209be687ef57a17

SHA1
86ca48115e1639737ad6370434b7d5620be4a4ef

SHA256
8e4987b7440048c01734d7c128c4b226f49e37ca656db5a60821e81f28d8e874

SHA512
f5782d2c8a9cb683773384488ac25d47f5ea3ec7d859bc77d952ad5b3edcbf272ce487a12eb2e2813e442c5222ad38c8e907d5f72f621abd813c5e6e1199860c

Download Submit
C:\Users\Admin\AppData\Roaming\2.exe

MD5
5e1e34373e984dd98209be687ef57a17

SHA1
86ca48115e1639737ad6370434b7d5620be4a4ef

SHA256
8e4987b7440048c01734d7c128c4b226f49e37ca656db5a60821e81f28d8e874

SHA512
f5782d2c8a9cb683773384488ac25d47f5ea3ec7d859bc77d952ad5b3edcbf272ce487a12eb2e2813e442c5222ad38c8e907d5f72f621abd813c5e6e1199860c

Download Submit
C:\Users\Admin\AppData\Roaming\2Srv.exe

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Roaming\2Srv.exe

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Roaming\M762.exe

MD5
482e97154b85aa82239cfcf4ae7e5465

SHA1
f2fba8dbd01e62dcf171686e4f3707fa6d234fba

SHA256
a5b998c0584be4c74779d4f8c2c7a09e0b515bfaffd97152f1f017aa979062ac

SHA512
d420f60e65f1deeb646174ae790b569315edaded8a0cd9d4f1aa2738dc6ba5b58412e84046a7022e86308bbd671b9ad88c073d0550e14d41a512d89824b028df

Download Submit
C:\Users\Admin\AppData\Roaming\M762.exe

MD5
482e97154b85aa82239cfcf4ae7e5465

SHA1
f2fba8dbd01e62dcf171686e4f3707fa6d234fba

SHA256
a5b998c0584be4c74779d4f8c2c7a09e0b515bfaffd97152f1f017aa979062ac

SHA512
d420f60e65f1deeb646174ae790b569315edaded8a0cd9d4f1aa2738dc6ba5b58412e84046a7022e86308bbd671b9ad88c073d0550e14d41a512d89824b028df

Download Submit
C:\Users\Admin\AppData\Roaming\M762Srv.exe

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Roaming\M762Srv.exe

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

MD5
97c8fe752e354b2945e4c593a87e4a8b

SHA1
03ab4c91535ecf14b13e0258f3a7be459a7957f9

SHA256
820d8dd49baed0da44d42555ad361d78e068115661dce72ae6578dcdab6baead

SHA512
af4492c08d6659d21ebfefe752b0d71210d2542c1788f1d2d9f86a85f01c3dd05eebf61c925e18b5e870aec7e9794e4a7050a04f4c58d90dca93324485690bcc

Download Submit
memory/412-142-0x0000000000000000-mapping.dmp

Download
memory/412-150-0x00007FFA67860000-0x00007FFA678CB000-memory.dmp

Filesize
428KB

Download
memory/1440-151-0x0000000000000000-mapping.dmp

Download
memory/2200-152-0x0000000000000000-mapping.dmp

Download
memory/2668-141-0x0000000000000000-mapping.dmp

Download
memory/2668-149-0x00007FFA67860000-0x00007FFA678CB000-memory.dmp

Filesize
428KB

Download
memory/2928-127-0x0000000000000000-mapping.dmp

Download
memory/2928-143-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/2928-144-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3240-124-0x0000000000000000-mapping.dmp

Download
memory/3364-119-0x0000000000000000-mapping.dmp

Download
memory/3956-128-0x0000000000000000-mapping.dmp

Download
memory/4128-123-0x0000000077710000-0x0000000077711000-memory.dmp

Filesize
4KB

Download
memory/4128-122-0x0000000074560000-0x0000000074561000-memory.dmp

Filesize
4KB

Download
memory/4128-118-0x0000000000400000-0x00000000006F9000-memory.dmp

Filesize
3.0MB

Download
memory/4128-115-0x0000000000000000-mapping.dmp

Download
memory/4180-133-0x0000000000000000-mapping.dmp

Download
memory/4180-139-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4204-134-0x0000000000000000-mapping.dmp

Download
memory/4204-140-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download