xworm | ae045f8e36db8f38af35258127ff43a71d522ae6ad15b7aad527bf75dd7a7666

Analysis

max time kernel
1402s
max time network
1224s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SSF-Bot.exe
Size

63KB
MD5

762f2fc17465058d27010124bb425202
SHA1

1b6b701c9c09128886e4676c4f1e534c7db39ad9
SHA256

ae045f8e36db8f38af35258127ff43a71d522ae6ad15b7aad527bf75dd7a7666
SHA512

329eacc85396f176fb30989f8d85fbeea097388ab37edecf22c3f4f368c1b0b0106cc7ec5c5ad06abbe488868ce4a5731ab04e4e7852a3d37bb1bdc42bb4e932
SSDEEP

768:8FfQVS7rGOe01ZDKMFiw7qyignMEOoCenkHubK23vuEBXKZ7ifudOPJhsAjDOep:Yfo/mKM1qrgnqebKivpaV0udOR3us

Score

10^/10

xworm evasion persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

ways-examining.at.ply.gg:18120

Attributes

install_file
USB.exe

Signatures

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Disables Task Manager via registry modification
evasion

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

SSF-Bot.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\MeasureMount.tiff.ENC	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\SaveReset.crw.ENC	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\SuspendFormat.tiff.ENC	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\UnpublishUnprotect.raw.ENC	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\MeasureMount.tiff	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\SuspendFormat.tiff	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\SendNew.png.ENC	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\SuspendPublish.crw.ENC	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\TraceSwitch.raw.ENC	SSF-Bot.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SSF-Bot.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	SSF-Bot.exe

Drops startup file 2 IoCs

Processes:

SSF-Bot.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSF-Bot.lnk	SSF-Bot.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSF-Bot.lnk	SSF-Bot.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SSF-Bot.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSF-Bot = "C:\\Users\\Admin\\AppData\\Roaming\\SSF-Bot.exe"	SSF-Bot.exe

Drops desktop.ini file(s) 16 IoCs

Processes:

SSF-Bot.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	SSF-Bot.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SSF-Bot.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SSF-Bot.exe

description	ioc	process
File opened (read-only)	\??\M:	SSF-Bot.exe
File opened (read-only)	\??\O:	SSF-Bot.exe
File opened (read-only)	\??\Q:	SSF-Bot.exe
File opened (read-only)	\??\T:	SSF-Bot.exe
File opened (read-only)	\??\U:	SSF-Bot.exe
File opened (read-only)	\??\W:	SSF-Bot.exe
File opened (read-only)	\??\F:	SSF-Bot.exe
File opened (read-only)	\??\L:	SSF-Bot.exe
File opened (read-only)	\??\Y:	SSF-Bot.exe
File opened (read-only)	\??\K:	SSF-Bot.exe
File opened (read-only)	\??\R:	SSF-Bot.exe
File opened (read-only)	\??\S:	SSF-Bot.exe
File opened (read-only)	\??\Z:	SSF-Bot.exe
File opened (read-only)	\??\A:	SSF-Bot.exe
File opened (read-only)	\??\I:	SSF-Bot.exe
File opened (read-only)	\??\J:	SSF-Bot.exe
File opened (read-only)	\??\B:	SSF-Bot.exe
File opened (read-only)	\??\E:	SSF-Bot.exe
File opened (read-only)	\??\N:	SSF-Bot.exe
File opened (read-only)	\??\P:	SSF-Bot.exe
File opened (read-only)	\??\V:	SSF-Bot.exe
File opened (read-only)	\??\X:	SSF-Bot.exe
File opened (read-only)	\??\G:	SSF-Bot.exe
File opened (read-only)	\??\H:	SSF-Bot.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com
101 ip-api.com

flow	ioc
17	ip-api.com
101	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

SSF-Bot.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	SSF-Bot.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ccfef9cc-c164-40e3-a78a-9d13cf096d0c.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230323172902.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 4516 WerFault.exe SSF-Bot.exe

pid	pid_target	process	target process
1120	4516	WerFault.exe	SSF-Bot.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 4 IoCs

Processes:

msedge.exeOpenWith.exeOpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

Processes:

SSF-Bot.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
1396	msedge.exe
1396	msedge.exe
3144	msedge.exe
3144	msedge.exe
1008	identity_helper.exe
1008	identity_helper.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe
4688	SSF-Bot.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3144 msedge.exe
3144 msedge.exe

pid	process
3144	msedge.exe
3144	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

SSF-Bot.exevssvc.exeAUDIODG.EXESSF-Bot.exe

description	pid	process
Token: SeDebugPrivilege	4688	SSF-Bot.exe
Token: SeDebugPrivilege	4688	SSF-Bot.exe
Token: SeBackupPrivilege	2548	vssvc.exe
Token: SeRestorePrivilege	2548	vssvc.exe
Token: SeAuditPrivilege	2548	vssvc.exe
Token: 33	3984	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3984	AUDIODG.EXE
Token: SeShutdownPrivilege	4688	SSF-Bot.exe
Token: SeCreatePagefilePrivilege	4688	SSF-Bot.exe
Token: SeDebugPrivilege	4516	SSF-Bot.exe

Suspicious use of FindShellTrayWindow 14 IoCs

Processes:

SSF-Bot.exemsedge.exe

pid	process
4688	SSF-Bot.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
4688	SSF-Bot.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

msedge.exe

pid process

3144 msedge.exe
3144 msedge.exe
3144 msedge.exe
3144 msedge.exe
3144 msedge.exe
3144 msedge.exe
3144 msedge.exe
3144 msedge.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

SSF-Bot.exeOpenWith.exeOpenWith.exeOpenWith.exe

pid process

4688 SSF-Bot.exe
3488 OpenWith.exe
2788 OpenWith.exe
2500 OpenWith.exe

pid	process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SSF-Bot.exemsedge.exe

description	pid	process	target process
PID 4688 wrote to memory of 3144	4688	SSF-Bot.exe	msedge.exe
PID 4688 wrote to memory of 3144	4688	SSF-Bot.exe	msedge.exe
PID 3144 wrote to memory of 4440	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 4440	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 452	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 1396	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 1396	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe
PID 3144 wrote to memory of 2964	3144	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SSF-Bot.exe
"C:\Users\Admin\AppData\Local\Temp\SSF-Bot.exe"
1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8060046f8,0x7ff806004708,0x7ff806004718
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2284744776130268773,17528901374807013857,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2284744776130268773,17528901374807013857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,2284744776130268773,17528901374807013857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2284744776130268773,17528901374807013857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2284744776130268773,17528901374807013857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2284744776130268773,17528901374807013857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6aefd5460,0x7ff6aefd5470,0x7ff6aefd5480
      4⤵
      PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2284744776130268773,17528901374807013857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1008
- C:\Users\Admin\AppData\Local\Temp\SSF-Bot.exe
  "C:\Users\Admin\AppData\Local\Temp\SSF-Bot.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4516 -s 1576
    3⤵
    - Program crash
    PID:1120

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2788

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x294
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 4516 -ip 4516
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SSF-Bot.exe.log

Filesize
1KB

MD5
5723d041125b6b694b5820bdeecb2a7c

SHA1
c41252e46c6dfa2091cf0829f1a7533d32e48a07

SHA256
d10169d6591b2a6493110b74d55c26ba3f4ee9d43321ac8dd35b1ede0d183b6f

SHA512
aa2b2d06501288bba20f6415d5037265f2e7b32f51a9f5c3f9bc867b951c024c634d5fe6ffa55d02ac2842399ca3d19741ad75350350679d9b953429a755dc8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
42f45fe60d4fc7b74fca481a35dfb6dc

SHA1
cc94dbd2fc84990d3ca849deedbe78d37331c735

SHA256
0ff81bfe8be0518d8f0d6ac60e1782d0c04745701c9ec549404fddf3e0604f8f

SHA512
c8855091db9b73ca924a8d3c8c84edba9bc5cc4766816872561d7f2b0d09874636247db6f82815f3d8dfd7a2202e8d664f7b8668925af166cb3e4b01163a2bf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
112a6e04dde4580e94f090e38ca5f63b

SHA1
d89f1b771681133dc37363aeab8fd0adc9abe598

SHA256
c70bfaa9c6d0008f8a571f4183e8aac3931ddb2dbca702c7f076f1716e90e56c

SHA512
fb21107534cd3063a721eccc4418bc658594500539618bbee18a7b5cbd86760d9b84bdfe727ab6e8ebf1b6e634b2325eb0e06e80ce890ee57aadb75e481d2ca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
90ef056c78bc24338b0d4e5652dbd9dc

SHA1
e2bea834a8683a42cc3ba5c8292b0ba70554102e

SHA256
846e6946d8c695b7bd0caecdf49c8a2ecfd753a5467bf69a9c5a0311662e2b39

SHA512
41207dbcd8fefe15c5fc58f0ef5e665f079c4c2e0603f9a83bf781e53efc3d8dd1a0d41847b9f07c25c07cd736fd3c0e63db032c4feb1e42f543b78a72d3ca9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c33689de36670304189fb01d9cc7031a

SHA1
4309b4ff82fcb3a306f29389239b0dc78a0cb1f9

SHA256
4e919447963bb7b2b64f3cffe3b048657103367f2152ca9326287fc96526dbac

SHA512
f1626c472e75c8f4e13da44b2be4bbab73eff35a7827ea1493d3936a1e0c44100808dde0ab819e38a0e856e46bc4e7a26e3a4b1d9b84ec9b48780a198943570d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8799d31286ce149b9fa087744a04106d

SHA1
0615ac9bc9e6fd9b621c3a9c48d38b72270442cc

SHA256
63f9f4e2311f475a89bdd7ef44e24a169cd7912e95032ac36f4a54518e9651a2

SHA512
77fb464025f911ea75a04ec8561d8a2c7ae702d3b7565679cb084b98e09d2b3736fbfc6e576e3f86063d6d0970f2cd73641ef22c60009243c5f3a5dc7506dd0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
48129fcac98dc3c7188ee45ef9382427

SHA1
c2dcf3f087afef83a394d0f79e22437ffeafa1b4

SHA256
cf873d0b81d2a28af8b9cb3682b7ed9feff34233c3274070c8819df102518c77

SHA512
03f5c8275233b0e5f0ed1fd3ab55be16f3d0fb1ecdbc1602d2c1248ebd5dcdb3ece4a1ecf0688d8c63c04d6550ce9cafc0922cb89c66491f761fef94bffca0ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d718c178da64f9c6cb81945058dacfd5

SHA1
3bd35bd4a6e8a743dc933e2db0263d8068424136

SHA256
9523f98a7f5c29f8813cdfbff61904e698e37853a8d225bb864472fd14da04d4

SHA512
0884e172e854469515d24c1e3e3ae37aa0719d3bb86bae0e5caae516134de949055428eb6d7585e7df5e4d48737ad3b20031c0fd6c5c3ccacfea47cd954d59a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
25047c110587068ddeedc964fa466a12

SHA1
a4488b67850ff0095fcb32c6c843b8257ab7975a

SHA256
92796fe6578cd9766d0446ce91a1aabbc2b963442ea391d1963e827badfcccd8

SHA512
ecb50a91cfa2f1e4e34a1d8e0845d28985a7d072d4c8d90c34783350813c49e3a3663166f190566b2687439059d5b71e396ac40658212a2c59132f96756cb10f

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
708B

MD5
247542cb2038d23c99828d367b5c8a7b

SHA1
f8eb92ceb80c0d8589108d202a56ee951a70e5c4

SHA256
cbf3443ad0d996dae310967c8fbbe1d3f42a05482d0557d8cde8b3ba4c770cba

SHA512
ce70c360183cecc32afc2aebab09c8e614523d2f28b152f751a97812e94f8fe8c565ffac4c32807a1e4345cdf5f20f6d2ec96550a176a7eed7d2cdee85e849e3

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
6ac651988180655a80bbbacb4e193add

SHA1
c88d0b5f36320ee5a504b764e98ae754c22bdc77

SHA256
f33de98fe575fd6cdd1a9fa0f0bdf0ed196fcdec7f6639c02fc383264176ae00

SHA512
2af3ca50e617808e546b267aff2ca38de15b1ae9d04e60050d67cbb6f01e8a82e6fa91eced0c4ec2da4d1d7be55eca3fe3fedff499cf98321f5426ba1b738756

Download Submit
C:\Users\Admin\Desktop\RepairSet.mht

Filesize
931KB

MD5
eae54bd6dfb2b6f9b83695bec66c7f56

SHA1
50044854e2fd3ed6bee99222978b2a9f563a3813

SHA256
f33dbe7adcabc2d2ad73089421d0a493cc777e3e4db08c2a460196dd9b3f065f

SHA512
c7c992e7a4aef314d8d272b120486ec263fac7aba996d264f8352e7ede888eabf232332f5ba60e5bf21ff495bcc0d64f6f719efac32b6eeca472c07d0445e315

Download Submit
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
e10061c6a520ef194130955e29beb404

SHA1
9ffa4942061ebeeb3c4d9fb9fe1ca96cd9b9a7ff

SHA256
dcb9eaadcd30c8cbab92344a092a1aa69c5468b7a94202d6e555d22e17989ff3

SHA512
50a23cde0d3d084988658c7d056461b5e818a2dcad9b8e38ed2596a10cfeb8dd347c7b5bc137880599720bf13e321ee1cda1f22256b10e212c6fd714c750a8dc

Download Submit
\??\pipe\LOCAL\crashpad_3144_GRBVZOCEUILTWEUU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4516-1234-0x000000001D0D0000-0x000000001D0E0000-memory.dmp

Filesize
64KB

Download
memory/4688-1187-0x0000000020A70000-0x0000000020A80000-memory.dmp

Filesize
64KB

Download
memory/4688-1189-0x0000000020A70000-0x0000000020A80000-memory.dmp

Filesize
64KB

Download
memory/4688-144-0x0000000020AB0000-0x0000000020FD8000-memory.dmp

Filesize
5.2MB

Download
memory/4688-1192-0x0000000020A70000-0x0000000020A80000-memory.dmp

Filesize
64KB

Download
memory/4688-1191-0x0000000020A70000-0x0000000020A80000-memory.dmp

Filesize
64KB

Download
memory/4688-1190-0x0000000020A70000-0x0000000020A80000-memory.dmp

Filesize
64KB

Download
memory/4688-1193-0x0000000020A70000-0x0000000020A80000-memory.dmp

Filesize
64KB

Download
memory/4688-141-0x000000001CF10000-0x000000001CF20000-memory.dmp

Filesize
64KB

Download
memory/4688-1188-0x0000000020A70000-0x0000000020A80000-memory.dmp

Filesize
64KB

Download
memory/4688-1194-0x0000000020A70000-0x0000000020A80000-memory.dmp

Filesize
64KB

Download
memory/4688-1197-0x0000000020A80000-0x0000000020A81000-memory.dmp

Filesize
4KB

Download
memory/4688-1222-0x0000000021650000-0x00000000217D6000-memory.dmp

Filesize
1.5MB

Download
memory/4688-134-0x000000001CF10000-0x000000001CF20000-memory.dmp

Filesize
64KB

Download
memory/4688-133-0x0000000000D50000-0x0000000000D66000-memory.dmp

Filesize
88KB

Download

pid	process
4688	SSF-Bot.exe
3488	OpenWith.exe
2788	OpenWith.exe
2500	OpenWith.exe