resource	yara_rule
behavioral4/memory/2272-156-0x0000000000000000-mapping.dmp	family_redline
behavioral4/memory/2272-157-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5"	msedge.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe

pid	process
824	msedge.exe
824	msedge.exe
1952	msedge.exe
1952	msedge.exe
428	identity_helper.exe
428	identity_helper.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

description	pid	process
Token: SeShutdownPrivilege	1448	svchost.exe
Token: SeCreatePagefilePrivilege	1448	svchost.exe
Token: SeShutdownPrivilege	1448	svchost.exe
Token: SeCreatePagefilePrivilege	1448	svchost.exe
Token: SeShutdownPrivilege	1448	svchost.exe
Token: SeCreatePagefilePrivilege	1448	svchost.exe
Token: SeShutdownPrivilege	916	svchost.exe
Token: SeCreatePagefilePrivilege	916	svchost.exe
Token: SeDebugPrivilege	2272	Fri05f84fa77402bf.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe
Token: SeRestorePrivilege	4872	TiWorker.exe
Token: SeSecurityPrivilege	4872	TiWorker.exe
Token: SeBackupPrivilege	4872	TiWorker.exe

description	pid	process	target process
PID 4312 wrote to memory of 924	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 4312 wrote to memory of 924	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 4312 wrote to memory of 924	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 916 wrote to memory of 448	916	svchost.exe	MoUsoCoreWorker.exe
PID 916 wrote to memory of 448	916	svchost.exe	MoUsoCoreWorker.exe
PID 4312 wrote to memory of 2272	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 4312 wrote to memory of 2272	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 4312 wrote to memory of 2272	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 4312 wrote to memory of 2272	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 4312 wrote to memory of 2272	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 4312 wrote to memory of 2272	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 4312 wrote to memory of 2272	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 4312 wrote to memory of 2272	4312	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 2272 wrote to memory of 1952	2272	Fri05f84fa77402bf.exe	msedge.exe
PID 2272 wrote to memory of 1952	2272	Fri05f84fa77402bf.exe	msedge.exe
PID 1952 wrote to memory of 3404	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 3404	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 4464	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 824	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 824	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 880	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 880	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 880	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 880	1952	msedge.exe	msedge.exe
PID 1952 wrote to memory of 880	1952	msedge.exe	msedge.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads