medusalocker | c57b9ceb171de7992bb63df37bdf176ac2efde34a2dff4bb355bb417ad34c046

Analysis

max time kernel
34s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2023 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
Size

669KB
MD5

3618b68d7db4614ec8d33b5052cc0e85
SHA1

15177fbb65d707b308bac50f612b795494314001
SHA256

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f
SHA512

d6ab35314f9388cafc340edc4476f374faddf6b0905d736356be32fc3e77cb2baa09fedc13af5a43c10fb4631cc77e766b530e58fa47f98329e9e2371cdd7e8d
SSDEEP

12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DHKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWaKrKe

Score

10^/10

medusalocker evasion ransomware spyware stealer trojan

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">278D149F96A3EAB2FEC996F8EF94E46C3ECE9AE5A3CB54AB76C1D3832EB0464098A9C0C052D0B3F42AFE4FDD00CB419042E92E919948F7EF6DFB596F7E687F21<br>5E8C111E7AFD93E95BCDDBCCB44208B8FDBDE29460C746529BF413790A647BF452B11442931144C249B10124D4D2A0ACA1E81BAA83A00127015D03933150<br>C4397F99004B0562CC51F24A251C404BD6E9DEB259AD4279EFF372E94A25104911819A162C3E37C02DFB79377B83834D9A8DA1F6C7C499CFEADB76B0C86F<br>645BA5EAA1F1B91466DB23597AA22CBE26E02E1A230ED7D5042BADED191914B729F60A843ED49EF54ADEC904ECE4060F6D659CEF16FB19D3EF3A14FF1F54<br>9F36D570274F4035264B824ECCDBCF4341E309641DB458C1F23B3092EACA16DE4D9DA2548EE203AA503F73EBA436709C08F77CA38829A0285F56BDDA7B2F<br>77FA2BA81CF7575F2D75A1E67AAEBC3BB3733B5FC808319D3F5BFF57177CA293293F59959889CBE1F6A2DCCC3DD67621ED5A6DB959682B1FB89C1CD522D6<br>080E758C2B201CC05EAC1049BA971BAEF6D831D42C4AB831247E390A6AE7C41031CB5F1D31CC52F0D046DF8C4902B4C87F49176213B5D8CA17540499E7A8<br>4A14D00FE544CB727CEC7EBC03869046FF9806D531B8B895C1E5EE4EC503549C0A9E54445713E9518705C93D6D129A4DA0B5EA15D147452D9CB21377CC6A<br>DE862FF47381ABBFFC3CC06AB239</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="[email protected]

">[email protected]

href="[email protected]

">[email protected]

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html

Family

medusalocker

Ransom Note

Your personal ID: 278D149F96A3EAB2FEC996F8EF94E46C3ECE9AE5A3CB54AB76C1D3832EB0464098A9C0C052D0B3F42AFE4FDD00CB419042E92E919948F7EF6DFB596F7E687F21 5E8C111E7AFD93E95BCDDBCCB44208B8FDBDE29460C746529BF413790A647BF452B11442931144C249B10124D4D2A0ACA1E81BAA83A00127015D03933150 C4397F99004B0562CC51F24A251C404BD6E9DEB259AD4279EFF372E94A25104911819A162C3E37C02DFB79377B83834D9A8DA1F6C7C499CFEADB76B0C86F 645BA5EAA1F1B91466DB23597AA22CBE26E02E1A230ED7D5042BADED191914B729F60A843ED49EF54ADEC904ECE4060F6D659CEF16FB19D3EF3A14FF1F54 9F36D570274F4035264B824ECCDBCF4341E309641DB458C1F23B3092EACA16DE4D9DA2548EE203AA503F73EBA436709C08F77CA38829A0285F56BDDA7B2F 77FA2BA81CF7575F2D75A1E67AAEBC3BB3733B5FC808319D3F5BFF57177CA293293F59959889CBE1F6A2DCCC3DD67621ED5A6DB959682B1FB89C1CD522D6 080E758C2B201CC05EAC1049BA971BAEF6D831D42C4AB831247E390A6AE7C41031CB5F1D31CC52F0D046DF8C4902B4C87F49176213B5D8CA17540499E7A8 4A14D00FE544CB727CEC7EBC03869046FF9806D531B8B895C1E5EE4EC503549C0A9E54445713E9518705C93D6D129A4DA0B5EA15D147452D9CB21377CC6A DE862FF47381ABBFFC3CC06AB239 /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: [email protected] [email protected] * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

[email protected]

Signatures

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

Modifies extensions of user files 16 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ExportStep.raw => C:\Users\Admin\Pictures\ExportStep.raw.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened for modification	C:\Users\Admin\Pictures\SyncShow.tiff	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\SyncShow.tiff => C:\Users\Admin\Pictures\SyncShow.tiff.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened for modification	C:\Users\Admin\Pictures\OptimizePush.tiff	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\ReceiveWrite.png => C:\Users\Admin\Pictures\ReceiveWrite.png.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\RegisterStart.tif => C:\Users\Admin\Pictures\RegisterStart.tif.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\SetRepair.raw => C:\Users\Admin\Pictures\SetRepair.raw.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\ShowConvertTo.raw => C:\Users\Admin\Pictures\ShowConvertTo.raw.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\SkipDisable.tif => C:\Users\Admin\Pictures\SkipDisable.tif.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\InstallProtect.tiff => C:\Users\Admin\Pictures\InstallProtect.tiff.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\JoinCopy.png => C:\Users\Admin\Pictures\JoinCopy.png.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\OptimizePush.tiff => C:\Users\Admin\Pictures\OptimizePush.tiff.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\ResizeUndo.crw => C:\Users\Admin\Pictures\ResizeUndo.crw.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\SearchCheckpoint.png => C:\Users\Admin\Pictures\SearchCheckpoint.png.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened for modification	C:\Users\Admin\Pictures\InstallProtect.tiff	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File renamed	C:\Users\Admin\Pictures\StopAdd.tif => C:\Users\Admin\Pictures\StopAdd.tif.itlock4	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

description	ioc	process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-144354903-2550862337-1367551827-1000\desktop.ini	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

description	ioc	process
File opened (read-only)	\??\B:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\G:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\L:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\W:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\X:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\Y:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\F:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\I:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\M:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\N:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\S:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\Z:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\A:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\E:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\P:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\T:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\V:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\H:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\J:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\K:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\O:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\Q:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\R:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
File opened (read-only)	\??\U:	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

pid	process
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3164 msedge.exe
3164 msedge.exe

pid	process
3164	msedge.exe
3164	msedge.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

wmic.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3668	wmic.exe
Token: SeSecurityPrivilege	3668	wmic.exe
Token: SeTakeOwnershipPrivilege	3668	wmic.exe
Token: SeLoadDriverPrivilege	3668	wmic.exe
Token: SeSystemProfilePrivilege	3668	wmic.exe
Token: SeSystemtimePrivilege	3668	wmic.exe
Token: SeProfSingleProcessPrivilege	3668	wmic.exe
Token: SeIncBasePriorityPrivilege	3668	wmic.exe
Token: SeCreatePagefilePrivilege	3668	wmic.exe
Token: SeBackupPrivilege	3668	wmic.exe
Token: SeRestorePrivilege	3668	wmic.exe
Token: SeShutdownPrivilege	3668	wmic.exe
Token: SeDebugPrivilege	3668	wmic.exe
Token: SeSystemEnvironmentPrivilege	3668	wmic.exe
Token: SeRemoteShutdownPrivilege	3668	wmic.exe
Token: SeUndockPrivilege	3668	wmic.exe
Token: SeManageVolumePrivilege	3668	wmic.exe
Token: 33	3668	wmic.exe
Token: 34	3668	wmic.exe
Token: 35	3668	wmic.exe
Token: 36	3668	wmic.exe
Token: SeIncreaseQuotaPrivilege	212	wmic.exe
Token: SeSecurityPrivilege	212	wmic.exe
Token: SeTakeOwnershipPrivilege	212	wmic.exe
Token: SeLoadDriverPrivilege	212	wmic.exe
Token: SeSystemProfilePrivilege	212	wmic.exe
Token: SeSystemtimePrivilege	212	wmic.exe
Token: SeProfSingleProcessPrivilege	212	wmic.exe
Token: SeIncBasePriorityPrivilege	212	wmic.exe
Token: SeCreatePagefilePrivilege	212	wmic.exe
Token: SeBackupPrivilege	212	wmic.exe
Token: SeRestorePrivilege	212	wmic.exe
Token: SeShutdownPrivilege	212	wmic.exe
Token: SeDebugPrivilege	212	wmic.exe
Token: SeSystemEnvironmentPrivilege	212	wmic.exe
Token: SeRemoteShutdownPrivilege	212	wmic.exe
Token: SeUndockPrivilege	212	wmic.exe
Token: SeManageVolumePrivilege	212	wmic.exe
Token: 33	212	wmic.exe
Token: 34	212	wmic.exe
Token: 35	212	wmic.exe
Token: 36	212	wmic.exe
Token: SeIncreaseQuotaPrivilege	3224	wmic.exe
Token: SeSecurityPrivilege	3224	wmic.exe
Token: SeTakeOwnershipPrivilege	3224	wmic.exe
Token: SeLoadDriverPrivilege	3224	wmic.exe
Token: SeSystemProfilePrivilege	3224	wmic.exe
Token: SeSystemtimePrivilege	3224	wmic.exe
Token: SeProfSingleProcessPrivilege	3224	wmic.exe
Token: SeIncBasePriorityPrivilege	3224	wmic.exe
Token: SeCreatePagefilePrivilege	3224	wmic.exe
Token: SeBackupPrivilege	3224	wmic.exe
Token: SeRestorePrivilege	3224	wmic.exe
Token: SeShutdownPrivilege	3224	wmic.exe
Token: SeDebugPrivilege	3224	wmic.exe
Token: SeSystemEnvironmentPrivilege	3224	wmic.exe
Token: SeRemoteShutdownPrivilege	3224	wmic.exe
Token: SeUndockPrivilege	3224	wmic.exe
Token: SeManageVolumePrivilege	3224	wmic.exe
Token: 33	3224	wmic.exe
Token: 34	3224	wmic.exe
Token: 35	3224	wmic.exe
Token: 36	3224	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

3164 msedge.exe
3164 msedge.exe
3164 msedge.exe

pid	process
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exemsedge.exe

description	pid	process	target process
PID 1468 wrote to memory of 3668	1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe	wmic.exe
PID 1468 wrote to memory of 3668	1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe	wmic.exe
PID 1468 wrote to memory of 3668	1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe	wmic.exe
PID 1468 wrote to memory of 212	1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe	wmic.exe
PID 1468 wrote to memory of 212	1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe	wmic.exe
PID 1468 wrote to memory of 212	1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe	wmic.exe
PID 1468 wrote to memory of 3224	1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe	wmic.exe
PID 1468 wrote to memory of 3224	1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe	wmic.exe
PID 1468 wrote to memory of 3224	1468	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe	wmic.exe
PID 3164 wrote to memory of 4808	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4808	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4576	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1736	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 1736	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe
PID 3164 wrote to memory of 4980	3164	msedge.exe	msedge.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe

C:\Users\Admin\AppData\Local\Temp\1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe
"C:\Users\Admin\AppData\Local\Temp\1658a064cb5a5681eee7ea82f92a2b7a14f70268dda3fc7aad8a610434711a8f.exe"
1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1468
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1dfb46f8,0x7ffc1dfb4708,0x7ffc1dfb4718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff62ad15460,0x7ff62ad15470,0x7ff62ad15480
    3⤵
    PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8335215798812704275,4113043271064801751,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
aac710b95b7232ff169182c0f953a173

SHA1
11773dd5c3141e38f807f5add5987994f8be7153

SHA256
44ca760a7e6bcaf46a4976d6f79cb1cbb5f6a9cd271fbf913ca3d4c7c03b3a4b

SHA512
073bb2be4e7cad9a41ac1f90dc812c7ac5eb9fa6e57b30ead7102a7a6851c43aee6a17e3bd2e6e7de81c4847e424bb09f0a873ce5353184d208c5fb080af6e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
b7cc42703d31418f7c0d19a40d852854

SHA1
96e09724d90380af114f4945c309cab95885f96f

SHA256
5a6661d1e0a2411ff4078393f0428537586ca576dfe4d6bf6438e6767d5310e8

SHA512
adffe43b9069925180ff2fc322d24d6675f0a74fba7f4ab629b7881e16f01d9175145913f3e142a44a4414a638f5631f78203aa9603f646d6aa2d638b29b27ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a05e73dc156993544bbfefcb76a56f1

SHA1
3ed728b16b8afec78d3d8818f0b20dc7ad6c6873

SHA256
18da87b9724ad714d4d8460ab5d69f5aee8938cc2a214ca66d272e98f63e36af

SHA512
1987263e681aca37c504cb58837a7de54ca3138d322ca6c16cbcc066fe2cc5d5ec72bb275cd09257e89cfa458d8049a1a081804fa67f9f6b29deebc9b599a564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
130644a5f79b27202a13879460f2c31a

SHA1
29e213847a017531e849139c7449bce6b39cb2fa

SHA256
1306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1

SHA512
fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
19c61d1450f9919b139a517611cb274b

SHA1
195cdf66d47d69eab8748d9b6ea063e53f751297

SHA256
2e4f86a002c0bb4787e20a65653ae9a704a33bc682c39a8991aa7dc76d0210ae

SHA512
98f78958d7fe161477cf5c768f76e5c119e8bfc0e2ee7927983fb36c3b8c30a109130dc9700148409f9f3559996c510b47428a8d18fd31cf79168ca577304534

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
c2aaca87912df76aeb4225146740bbe3

SHA1
a344ebb73003732a018a869e8f62f3c2b5702ec9

SHA256
87d9aafb428322e5c32180c98cc32caa2fe6bf979a07c29cd3426f4352284a6b

SHA512
42f555955157ed1b7c4a7c43cc2415d37b1201be0f4a985a8f4e006e4b1d44a89c1eb5d935ee0e85d5f91089e0c9e136fa81fcc24ed2f418f2eddf1ed55f9bd3

Download Submit
C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html

Filesize
4KB

MD5
0211464b7a5327e6be8f3e6fb07800a1

SHA1
632a3b8ae5111bc26266de5706959699292385cf

SHA256
2caca5547a2917f992999ab78fbc3bbf92892f24a696645b373a0dd0d0b5d96f

SHA512
8d25be6e3e5035cc82a15799a1a208f6aac111e9e271858fb513a74197d4454258cb409ed84da96997ca4003701beab176d1e37f0405daf69355472c3fce85bc

Download Submit
C:\Users\Default\ntuser.dat.LOG2

Filesize
536B

MD5
87c8180fcefaa6166f6c6307ea5afc11

SHA1
7cf55a11876d6586700f5d87c72cde203fd87fab

SHA256
5b773e24cb92c889c2d59e231632b4b1bccb8a765cff9cbe1eba7ff5b8c77153

SHA512
690be8e188f3f846bad3b97e689b31d0fc3b17cbc0e3d28f051441edaf7e577411d67547d5ebcd9f23a04847e2fe53fdbc6c1def289e5e33e29ad65837e68ecf

Download Submit
\??\pipe\LOCAL\crashpad_3164_CNKJLCAYMMHHUXGL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Filesize
4KB

MD5
0211464b7a5327e6be8f3e6fb07800a1

SHA1
632a3b8ae5111bc26266de5706959699292385cf

SHA256
2caca5547a2917f992999ab78fbc3bbf92892f24a696645b373a0dd0d0b5d96f

SHA512
8d25be6e3e5035cc82a15799a1a208f6aac111e9e271858fb513a74197d4454258cb409ed84da96997ca4003701beab176d1e37f0405daf69355472c3fce85bc

Download Submit