xmrig | c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181

Analysis

max time kernel
151s
max time network
150s
platform
windows10_x64
resource
win10-en-20211014
submitted
05-12-2021 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4863b8da0f8b001d7c28b956139e23f.exe
Size

1.3MB
MD5

a4863b8da0f8b001d7c28b956139e23f
SHA1

7d1d9bca4bf89e00e465f98f759f6d5b958fe4e4
SHA256

c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181
SHA512

8b2fb4c0ec99bc92ad2c6081fc84fd6e83ca7b01f46fe87469bbf506ea8323d680f72edbd633396c0f2fd3d550ad0740a36c52c4af2457aefd27fe23b3781f1d

Score

10^/10

xmrig discovery miner persistence spyware stealer suricata

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\", \"C:\\Documents and Settings\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\fvecpl\\audiodg.exe\", \"C:\\Windows\\system\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\", \"C:\\PerfLogs\\ShellExperienceHost.exe\", \"C:\\Windows\\System32\\PasswordOnWakeSettingFlyout\\dllhost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\", \"C:\\Documents and Settings\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\fvecpl\\audiodg.exe\", \"C:\\Windows\\system\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\", \"C:\\PerfLogs\\ShellExperienceHost.exe\", \"C:\\Windows\\System32\\PasswordOnWakeSettingFlyout\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\a4863b8da0f8b001d7c28b956139e23f.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\", \"C:\\Documents and Settings\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\fvecpl\\audiodg.exe\", \"C:\\Windows\\system\\explorer.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\", \"C:\\Documents and Settings\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\fvecpl\\audiodg.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\", \"C:\\Documents and Settings\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\fvecpl\\audiodg.exe\", \"C:\\Windows\\system\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\", \"C:\\Documents and Settings\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\fvecpl\\audiodg.exe\", \"C:\\Windows\\system\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\", \"C:\\PerfLogs\\ShellExperienceHost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\", \"C:\\Documents and Settings\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\fvecpl\\audiodg.exe\", \"C:\\Windows\\system\\explorer.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\", \"C:\\PerfLogs\\ShellExperienceHost.exe\", \"C:\\Windows\\System32\\PasswordOnWakeSettingFlyout\\dllhost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\a4863b8da0f8b001d7c28b956139e23f.exe\", \"C:\\Program Files\\Common Files\\System\\Ole DB\\fr-FR\\fontdrvhost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\", \"C:\\Documents and Settings\\sppsvc.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\", \"C:\\Documents and Settings\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	3140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	3140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	3140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	3140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	3140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	3140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	3140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	3140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	3140	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	3140	schtasks.exe

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Executes dropped EXE 2 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exeexplorer.exe

pid process

3416 a4863b8da0f8b001d7c28b956139e23f.exe
2312 explorer.exe

pid	process
3416	a4863b8da0f8b001d7c28b956139e23f.exe
2312	explorer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	a4863b8da0f8b001d7c28b956139e23f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	a4863b8da0f8b001d7c28b956139e23f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	explorer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Documents and Settings\\sppsvc.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\system\\explorer.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\PasswordOnWakeSettingFlyout\\dllhost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a4863b8da0f8b001d7c28b956139e23f = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\a4863b8da0f8b001d7c28b956139e23f.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Windows\\System32\\fvecpl\\audiodg.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Common Files\\System\\Ole DB\\fr-FR\\fontdrvhost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Documents and Settings\\sppsvc.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\system\\explorer.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\PasswordOnWakeSettingFlyout\\dllhost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Common Files\\System\\Ole DB\\fr-FR\\fontdrvhost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\PerfLogs\\ShellExperienceHost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\PerfLogs\\ShellExperienceHost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\a4863b8da0f8b001d7c28b956139e23f = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\a4863b8da0f8b001d7c28b956139e23f.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc\\dllhost.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Documents and Settings\\wininit.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Documents and Settings\\wininit.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Windows\\System32\\fvecpl\\audiodg.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exe

description	ioc	process
File created	C:\Windows\System32\fvecpl\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\fvecpl\RCXDAD4.tmp	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\fvecpl\audiodg.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\PasswordOnWakeSettingFlyout\dllhost.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\PasswordOnWakeSettingFlyout\5940a34987c99120d96dace90a3f93f329dcad63	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\PasswordOnWakeSettingFlyout\dllhost.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\fvecpl\audiodg.exe	a4863b8da0f8b001d7c28b956139e23f.exe

Drops file in Program Files directory 13 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\8bdb607b0d6d8ac503d9b1f1205cfbba47d77f90	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\a4863b8da0f8b001d7c28b956139e23f.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\5940a34987c99120d96dace90a3f93f329dcad63	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\dllhost.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\RCXD34F.tmp	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\560854153607923c4c5f107085a7db67be01f252	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\a4863b8da0f8b001d7c28b956139e23f.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\fontdrvhost.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\5b884080fd4f94e2695da25c503f9e33b9605b83	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\fontdrvhost.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\dllhost.exe	a4863b8da0f8b001d7c28b956139e23f.exe

Drops file in Windows directory 6 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exea4863b8da0f8b001d7c28b956139e23f.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\system\explorer.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\system\explorer.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\system\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
696	schtasks.exe
1112	schtasks.exe
1196	schtasks.exe
3132	schtasks.exe
1144	schtasks.exe
1364	schtasks.exe
3960	schtasks.exe
2384	schtasks.exe
2380	schtasks.exe
3760	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exea4863b8da0f8b001d7c28b956139e23f.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	a4863b8da0f8b001d7c28b956139e23f.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "340590473"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 72b91de8e8c2d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4e2990e8e8c2d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = e09f92188ae9d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{8FA99D51-0B76-49EA-B8E0-B4B44C4E42B6} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8ca259ede8c2d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{ED3A3F3E-F6F9-43A9-AA51-3834FBFC0ECE}"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exeexplorer.exe

pid	process
2648	a4863b8da0f8b001d7c28b956139e23f.exe
3416	a4863b8da0f8b001d7c28b956139e23f.exe
3416	a4863b8da0f8b001d7c28b956139e23f.exe
3416	a4863b8da0f8b001d7c28b956139e23f.exe
3416	a4863b8da0f8b001d7c28b956139e23f.exe
3416	a4863b8da0f8b001d7c28b956139e23f.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2312 explorer.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4048 MicrosoftEdgeCP.exe
4048 MicrosoftEdgeCP.exe

pid	process
2312	explorer.exe

pid	process
4048	MicrosoftEdgeCP.exe
4048	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exeexplorer.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	2648	a4863b8da0f8b001d7c28b956139e23f.exe
Token: SeDebugPrivilege	3416	a4863b8da0f8b001d7c28b956139e23f.exe
Token: SeDebugPrivilege	2312	explorer.exe
Token: SeDebugPrivilege	4084	MicrosoftEdge.exe
Token: SeDebugPrivilege	4084	MicrosoftEdge.exe
Token: SeDebugPrivilege	4084	MicrosoftEdge.exe
Token: SeDebugPrivilege	4084	MicrosoftEdge.exe
Token: SeDebugPrivilege	3720	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3720	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3720	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3720	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3808	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3808	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

4084 MicrosoftEdge.exe
4048 MicrosoftEdgeCP.exe
4048 MicrosoftEdgeCP.exe

pid	process
4084	MicrosoftEdge.exe
4048	MicrosoftEdgeCP.exe
4048	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 2648 wrote to memory of 3416	2648	a4863b8da0f8b001d7c28b956139e23f.exe	a4863b8da0f8b001d7c28b956139e23f.exe
PID 2648 wrote to memory of 3416	2648	a4863b8da0f8b001d7c28b956139e23f.exe	a4863b8da0f8b001d7c28b956139e23f.exe
PID 3416 wrote to memory of 2312	3416	a4863b8da0f8b001d7c28b956139e23f.exe	explorer.exe
PID 3416 wrote to memory of 2312	3416	a4863b8da0f8b001d7c28b956139e23f.exe	explorer.exe
PID 4048 wrote to memory of 3720	4048	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4048 wrote to memory of 3720	4048	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4048 wrote to memory of 3720	4048	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4048 wrote to memory of 3720	4048	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4048 wrote to memory of 3720	4048	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4048 wrote to memory of 3720	4048	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe
"C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648

C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe
"C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416

C:\Windows\system\explorer.exe
"C:\Windows\system\explorer.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Documents and Settings\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Documents and Settings\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\System32\fvecpl\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\system\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\PerfLogs\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\PasswordOnWakeSettingFlyout\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4863b8da0f8b001d7c28b956139e23f" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\a4863b8da0f8b001d7c28b956139e23f.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\Ole DB\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2384

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2372

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4084

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3696

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a4863b8da0f8b001d7c28b956139e23f.exe.log
MD5
4a1ed3846791b69d7fa47b440e9e0c89

SHA1
426942cf26fbc0a96bdc525a6a625726471abaca

SHA256
cd4a447c7269df5cced4fa6a981c156f51b652d3026e4008027d6092b76ba7a5

SHA512
52341fafc8510e04546fcaf3dedc720d73bf88e217217ddc8b2c5dd9f74e8f6a233793bc63e4ee970da8872371560331dae56479af2d4afdb5f8597fdf3e5dfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe
MD5
a4863b8da0f8b001d7c28b956139e23f

SHA1
7d1d9bca4bf89e00e465f98f759f6d5b958fe4e4

SHA256
c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181

SHA512
8b2fb4c0ec99bc92ad2c6081fc84fd6e83ca7b01f46fe87469bbf506ea8323d680f72edbd633396c0f2fd3d550ad0740a36c52c4af2457aefd27fe23b3781f1d

Download Submit
C:\Windows\System\explorer.exe
MD5
a4863b8da0f8b001d7c28b956139e23f

SHA1
7d1d9bca4bf89e00e465f98f759f6d5b958fe4e4

SHA256
c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181

SHA512
8b2fb4c0ec99bc92ad2c6081fc84fd6e83ca7b01f46fe87469bbf506ea8323d680f72edbd633396c0f2fd3d550ad0740a36c52c4af2457aefd27fe23b3781f1d

Download Submit
C:\Windows\system\explorer.exe
MD5
a4863b8da0f8b001d7c28b956139e23f

SHA1
7d1d9bca4bf89e00e465f98f759f6d5b958fe4e4

SHA256
c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181

SHA512
8b2fb4c0ec99bc92ad2c6081fc84fd6e83ca7b01f46fe87469bbf506ea8323d680f72edbd633396c0f2fd3d550ad0740a36c52c4af2457aefd27fe23b3781f1d

Download Submit
memory/2312-163-0x000000001BBC3000-0x000000001BBC5000-memory.dmp

Filesize
8KB

Download
memory/2312-164-0x000000001BBC5000-0x000000001BBC7000-memory.dmp

Filesize
8KB

Download
memory/2312-162-0x000000001BBC0000-0x000000001BBC2000-memory.dmp

Filesize
8KB

Download
memory/2312-146-0x0000000000000000-mapping.dmp

Download
memory/2648-121-0x0000000001530000-0x0000000001537000-memory.dmp

Filesize
28KB

Download
memory/2648-123-0x0000000001880000-0x0000000001882000-memory.dmp

Filesize
8KB

Download
memory/2648-126-0x0000000001520000-0x0000000001522000-memory.dmp

Filesize
8KB

Download
memory/2648-127-0x0000000001840000-0x0000000001846000-memory.dmp

Filesize
24KB

Download
memory/2648-128-0x0000000001820000-0x0000000001824000-memory.dmp

Filesize
16KB

Download
memory/2648-117-0x0000000003360000-0x0000000003362000-memory.dmp

Filesize
8KB

Download
memory/2648-124-0x0000000001830000-0x0000000001835000-memory.dmp

Filesize
20KB

Download
memory/2648-125-0x0000000001860000-0x0000000001865000-memory.dmp

Filesize
20KB

Download
memory/2648-118-0x00000000011F0000-0x00000000011FA000-memory.dmp

Filesize
40KB

Download
memory/2648-122-0x0000000001810000-0x0000000001815000-memory.dmp

Filesize
20KB

Download
memory/2648-115-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/2648-120-0x0000000001510000-0x0000000001517000-memory.dmp

Filesize
28KB

Download
memory/2648-119-0x0000000001500000-0x0000000001501000-memory.dmp

Filesize
4KB

Download
memory/3416-145-0x000000001BAD0000-0x000000001BAD2000-memory.dmp

Filesize
8KB

Download
memory/3416-129-0x0000000000000000-mapping.dmp

Download