mountlocker | 31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585

Analysis

max time kernel
45s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2023 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c09b509699aeef71f3e205d53c5f4ff71cb48570.dll
Size

77KB
MD5

0aacf2c41ba9b872a52055ffcaeaef15
SHA1

c09b509699aeef71f3e205d53c5f4ff71cb48570
SHA256

31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585
SHA512

d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec
SSDEEP

1536:rADwfmySY6FIsr4XSZ32tcOGwpin2NI2F4cd:UDwTF6+srGi32tcOGwpin2NMcd

Score

10^/10

mountlocker ransomware

Malware Config

Extracted

Path

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70 </pre> <hr/> /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ All your important documents have been encrypted and transferred to our premises! <hr/> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. However there is a solution for your problem! We can support you with your data decryption for a monetary reward. Also we will destroy your private data from our premises. And we can prove our decryption capabilities by decrypting couple of your files free of charge. Here are the next steps to get your valuable data back and get it wiped out from our premises: <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70</a> * Note that you need installed Tor Browser to open this kind of links. Follow the instructions to install/run Tor Browser: 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge) 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases) 3. Download and Install Tor Browser 4. After installation finished, click on "Tor Browser" link from your Desktop 5. By using Tor Browser visit <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70</a> 6. Copy your client id from the top of this document and paste it into Authorization window if requested 7. This will start a chat with our security experts. Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible. Also, we kindly request you to contact with us as soon as possible. We will start publishing your private data to the Internet if you don't get in touch with us within next few days. </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\RecoveryManual.html

Family

mountlocker

Ransom Note

Your ClientId: /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ All your important documents have been encrypted and transferred to our premises! ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. However there is a solution for your problem! We can support you with your data decryption for a monetary reward. Also we will destroy your private data from our premises. And we can prove our decryption capabilities by decrypting couple of your files free of charge. Here are the next steps to get your valuable data back and get it wiped out from our premises: http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70 * Note that you need installed Tor Browser to open this kind of links. Follow the instructions to install/run Tor Browser: 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge) 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases) 3. Download and Install Tor Browser 4. After installation finished, click on "Tor Browser" link from your Desktop 5. By using Tor Browser visit http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70 6. Copy your client id from the top of this document and paste it into Authorization window if requested 7. This will start a chat with our security experts. Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible. Also, we kindly request you to contact with us as soon as possible. We will start publishing your private data to the Internet if you don't get in touch with us within next few days.

URLs

http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b64331cd8f65c4ab740fabe00375993d6d70

Signatures

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker

Modifies extensions of user files 20 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\CopyMount.tif => \??\c:\Users\Admin\Pictures\CopyMount.tif.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\CopySplit.crw => \??\c:\Users\Admin\Pictures\CopySplit.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\TestStart.raw.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ConvertImport.tif => \??\c:\Users\Admin\Pictures\ConvertImport.tif.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\NewSync.tiff => \??\c:\Users\Admin\Pictures\NewSync.tiff.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\TestStart.raw => \??\c:\Users\Admin\Pictures\TestStart.raw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\UnpublishUndo.png.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ResizeUnregister.tif.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\UnpublishUndo.png => \??\c:\Users\Admin\Pictures\UnpublishUndo.png.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\ConvertImport.tif.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\CopyMount.tif.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\CopySplit.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\NewSync.tiff.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RedoTrace.crw => \??\c:\Users\Admin\Pictures\RedoTrace.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\RedoTrace.crw.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\ResizeUnregister.tif => \??\c:\Users\Admin\Pictures\ResizeUnregister.tif.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\RestoreFormat.crw => \??\c:\Users\Admin\Pictures\RestoreFormat.crw.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\RestoreFormat.crw.ReadManual.64BD3273	regsvr32.exe
File renamed	C:\Users\Admin\Pictures\UpdateSplit.tif => \??\c:\Users\Admin\Pictures\UpdateSplit.tif.ReadManual.64BD3273	regsvr32.exe
File opened for modification	\??\c:\Users\Admin\Pictures\UpdateSplit.tif.ReadManual.64BD3273	regsvr32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\9e26062e-95c5-468b-af4a-4897a7c33adf.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230223170259.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.64BD3273\shell\Open\command\ = "explorer.exe RecoveryManual.html"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.64BD3273\shell\Open\command	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.64BD3273	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.64BD3273\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\.64BD3273\shell\Open	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4804	regsvr32.exe
4804	regsvr32.exe
3576	msedge.exe
3576	msedge.exe
1628	msedge.exe
1628	msedge.exe
2316	identity_helper.exe
2316	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	regsvr32.exe
Token: SeTakeOwnershipPrivilege	4804	regsvr32.exe
Token: SeRestorePrivilege	4804	regsvr32.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4804	5004	regsvr32.exe	81
PID 5004 wrote to memory of 4804	5004	regsvr32.exe	81
PID 5004 wrote to memory of 4804	5004	regsvr32.exe	81
PID 4804 wrote to memory of 3180	4804	regsvr32.exe	83
PID 4804 wrote to memory of 3180	4804	regsvr32.exe	83
PID 4804 wrote to memory of 3180	4804	regsvr32.exe	83
PID 3180 wrote to memory of 3392	3180	cmd.exe	85
PID 3180 wrote to memory of 3392	3180	cmd.exe	85
PID 3180 wrote to memory of 3392	3180	cmd.exe	85
PID 1628 wrote to memory of 3056	1628	msedge.exe	89
PID 1628 wrote to memory of 3056	1628	msedge.exe	89
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 4316	1628	msedge.exe	90
PID 1628 wrote to memory of 3576	1628	msedge.exe	91
PID 1628 wrote to memory of 3576	1628	msedge.exe	91
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92
PID 1628 wrote to memory of 2768	1628	msedge.exe	92

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3392	attrib.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c09b509699aeef71f3e205d53c5f4ff71cb48570.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c09b509699aeef71f3e205d53c5f4ff71cb48570.dll
  2⤵
  - Modifies extensions of user files
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E569B99.bat" "C:\Users\Admin\AppData\Local\Temp\c09b509699aeef71f3e205d53c5f4ff71cb48570.dll""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\c09b509699aeef71f3e205d53c5f4ff71cb48570.dll"
      4⤵
      Views/modifies file attributes
      PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RecoveryManual.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffae63c46f8,0x7ffae63c4708,0x7ffae63c4718
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff656e15460,0x7ff656e15470,0x7ff656e15480
    3⤵
    PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9160981072760491224,14299962857352555687,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RecoveryManual.html

Filesize
2KB

MD5
3beb2aad1b8a94eb26180d08a6802915

SHA1
6349e63b0c4e225c97caa47a2392a32739af6a55

SHA256
0810377bd83cceb2c4fd816778e0bb0851ce570738c924e7e3c4f348a2186570

SHA512
ae7dc71ee7625c77f8cb3b79ff8a239d7506c869254fcb7d51b5784912390eef858f2b569453c79f13a63c681ce67f281be66ae0f4cb765d5d4b1f2152a0f4f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e0e168f-aca2-4adb-b68e-1c2b9db3b82c.tmp

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
596be861534a3ae527492efc4e64409d

SHA1
3ef4b834c15e8b2ad56fad75011f62c251f45261

SHA256
1f8818e13b160965802db438cbf16a696f5bc433a2c13888e76923684bac811c

SHA512
264a3d6be1a8cfa01c89d2996dfa477277c4ac942e58dbd0833e210f8cbb116f7d535ec18dd361fdb4e23673414c7bc6220515f434a095f279f727527031c432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f01c11f632163eaec6d7ab1332707482

SHA1
d85ecfee0350007349a2d55bf353a4dd6bdb7b2a

SHA256
3b26dbdd31b944c82b0a5987b12c647a2646a2265accdaa4da3ded3787147992

SHA512
505e2c166b1bca0ae25238947dc12542892c064f84e3bee1c49393a9e09bafb658c2105c1016f1dbee6ec7cc2b574b0af4f5d733135f7883a122e78cdebc8e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12817fa22ec7b606f40904a34f342535

SHA1
a4f4f68d6dc3e71b0b41d0b2fea5f2be4a5e7cff

SHA256
4645ae9b9df60a3de0c047f953f623bf743c55c8d9ab90d2090b41ab608eb981

SHA512
da2ef9889cd16383b40e7109332846c02a19f4902a41873787959a1792b31d7362eaa50bea2e4be091adfa42713be057ee6a4c32a06113bb45408618fbf62930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
0ae2bba323c59592058892784e5114c6

SHA1
eaffa5d487c2ffe79574e41c30ee6b8012db5290

SHA256
5a0a694b006eedaca37a618522ce919056602ccb2436480bdd1114df4a78f715

SHA512
b782644968bb19ab08527f7a34f32b6acb739c5fdcb5143703e68db59cfc1aefaa27c62784bb149f2a1b4a5d3e905a4d9e58aafa6ffa222b6dc19752674f6227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9fcea9c17d6a3428d8e6cb6d3b57b84c

SHA1
87ea6203b541ee6b350717964faf6996422a9f20

SHA256
233df90520f0a173067151631ec96c0095cb4fcb1af95bffea9cb16938d6dc5f

SHA512
8d852018b0725bccfd03bb87cdb7d8d4450ba483f629dfabb7be5308dec4f69e6442a0a26abc282b9f13f357e53d0ae34504890a9da0f490e6aff17cefbc2555

Download Submit
C:\Users\Admin\AppData\Local\Temp\0E569B99.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
d087ac27cb12d31137f33e6ec2bc62f4

SHA1
20472c03d7f459810711c33897eae0ae5d33606a

SHA256
9103a151412b20d5405e53a49ce40d268248d77aa40e2c7133c7f5a5294260e1

SHA512
07fe28c97f021582608bcc7ac49d3d163e02f92e2a39e1bdfccb912768a90dacd0b71612a8ae6ac6d393c964adca1665f953e4565e1a94a16b8b2958f03fb81a

Download Submit
C:\Users\Admin\Desktop\RecoveryManual.html

Filesize
2KB

MD5
3beb2aad1b8a94eb26180d08a6802915

SHA1
6349e63b0c4e225c97caa47a2392a32739af6a55

SHA256
0810377bd83cceb2c4fd816778e0bb0851ce570738c924e7e3c4f348a2186570

SHA512
ae7dc71ee7625c77f8cb3b79ff8a239d7506c869254fcb7d51b5784912390eef858f2b569453c79f13a63c681ce67f281be66ae0f4cb765d5d4b1f2152a0f4f7

Download Submit
memory/4316-984-0x00007FFB027E0000-0x00007FFB027E1000-memory.dmp

Filesize
4KB

Download