f11ce7bb0448619dd5488c2bb4a5e44e3e123f9276919bf69f8cd6471dacdcc5

Resubmissions

17-05-2024 15:35

240517-s1lp4sec9s 8

01-04-2023 00:40

230401-a1eyfseg62 8

Analysis

max time kernel
38s
max time network
37s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
01-04-2023 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C.L[]LZ.bat
Size

18KB
MD5

e8587d513e54e911f058af7494b80e78
SHA1

5005f14b178a18334fa794f2aa21e790fd42f8a7
SHA256

f11ce7bb0448619dd5488c2bb4a5e44e3e123f9276919bf69f8cd6471dacdcc5
SHA512

ba9f48f9d9b39ff4c617f62867874166595543b04b017c623efe8fbe3f418eab88e423642b485eba74eafbb5cd57a2e942500d21580261b5738fe0751830e7cf
SSDEEP

192:dMJOA2222222222222222222222222222222222222222222222222222222222+:dgOl

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 8 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
4248	attrib.exe
1708	attrib.exe
5020	attrib.exe
2488	attrib.exe
4488	attrib.exe
4176	attrib.exe
4340	attrib.exe
5108	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Msg.txt	cmd.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e28aa2674364d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = a096207b4364d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7e9dc66c4364d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8a63ac6c4364d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c7e13a7b4364d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a360f8674364d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4836	reg.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2660	NOTEPAD.EXE
4308	NOTEPAD.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4112	PING.EXE
4208	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3740	mspaint.exe
3740	mspaint.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3684	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	MicrosoftEdge.exe
Token: SeDebugPrivilege	4680	MicrosoftEdge.exe
Token: SeDebugPrivilege	4680	MicrosoftEdge.exe
Token: SeDebugPrivilege	4680	MicrosoftEdge.exe
Token: SeDebugPrivilege	4832	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4832	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4832	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4832	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4996	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4996	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4680	MicrosoftEdge.exe
3684	MicrosoftEdgeCP.exe
3684	MicrosoftEdgeCP.exe
3740	mspaint.exe
3740	mspaint.exe
3740	mspaint.exe
3740	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 2488	4148	cmd.exe	70
PID 4148 wrote to memory of 2488	4148	cmd.exe	70
PID 4148 wrote to memory of 4488	4148	cmd.exe	71
PID 4148 wrote to memory of 4488	4148	cmd.exe	71
PID 4148 wrote to memory of 4176	4148	cmd.exe	73
PID 4148 wrote to memory of 4176	4148	cmd.exe	73
PID 4148 wrote to memory of 4340	4148	cmd.exe	74
PID 4148 wrote to memory of 4340	4148	cmd.exe	74
PID 4148 wrote to memory of 5108	4148	cmd.exe	75
PID 4148 wrote to memory of 5108	4148	cmd.exe	75
PID 4148 wrote to memory of 4248	4148	cmd.exe	76
PID 4148 wrote to memory of 4248	4148	cmd.exe	76
PID 4148 wrote to memory of 4836	4148	cmd.exe	78
PID 4148 wrote to memory of 4836	4148	cmd.exe	78
PID 4148 wrote to memory of 4308	4148	cmd.exe	79
PID 4148 wrote to memory of 4308	4148	cmd.exe	79
PID 4148 wrote to memory of 1708	4148	cmd.exe	80
PID 4148 wrote to memory of 1708	4148	cmd.exe	80
PID 4148 wrote to memory of 5020	4148	cmd.exe	81
PID 4148 wrote to memory of 5020	4148	cmd.exe	81
PID 4148 wrote to memory of 5060	4148	cmd.exe	82
PID 4148 wrote to memory of 5060	4148	cmd.exe	82
PID 4148 wrote to memory of 4964	4148	cmd.exe	201
PID 4148 wrote to memory of 4964	4148	cmd.exe	201
PID 4148 wrote to memory of 792	4148	cmd.exe	84
PID 4148 wrote to memory of 792	4148	cmd.exe	84
PID 4148 wrote to memory of 664	4148	cmd.exe	85
PID 4148 wrote to memory of 664	4148	cmd.exe	85
PID 4148 wrote to memory of 648	4148	cmd.exe	86
PID 4148 wrote to memory of 648	4148	cmd.exe	86
PID 4148 wrote to memory of 68	4148	cmd.exe	87
PID 4148 wrote to memory of 68	4148	cmd.exe	87
PID 4148 wrote to memory of 1732	4148	cmd.exe	88
PID 4148 wrote to memory of 1732	4148	cmd.exe	88
PID 4148 wrote to memory of 3968	4148	cmd.exe	207
PID 4148 wrote to memory of 3968	4148	cmd.exe	207
PID 4148 wrote to memory of 504	4148	cmd.exe	209
PID 4148 wrote to memory of 504	4148	cmd.exe	209
PID 4148 wrote to memory of 4008	4148	cmd.exe	91
PID 4148 wrote to memory of 4008	4148	cmd.exe	91
PID 4148 wrote to memory of 1328	4148	cmd.exe	93
PID 4148 wrote to memory of 1328	4148	cmd.exe	93
PID 4148 wrote to memory of 704	4148	cmd.exe	92
PID 4148 wrote to memory of 704	4148	cmd.exe	92
PID 4148 wrote to memory of 1020	4148	cmd.exe	212
PID 4148 wrote to memory of 1020	4148	cmd.exe	212
PID 4148 wrote to memory of 916	4148	cmd.exe	213
PID 4148 wrote to memory of 916	4148	cmd.exe	213
PID 4148 wrote to memory of 1896	4148	cmd.exe	214
PID 4148 wrote to memory of 1896	4148	cmd.exe	214
PID 4148 wrote to memory of 1888	4148	cmd.exe	278
PID 4148 wrote to memory of 1888	4148	cmd.exe	278
PID 4148 wrote to memory of 2088	4148	cmd.exe	216
PID 4148 wrote to memory of 2088	4148	cmd.exe	216
PID 4148 wrote to memory of 1336	4148	cmd.exe	217
PID 4148 wrote to memory of 1336	4148	cmd.exe	217
PID 4148 wrote to memory of 2144	4148	cmd.exe	154
PID 4148 wrote to memory of 2144	4148	cmd.exe	154
PID 4148 wrote to memory of 1468	4148	cmd.exe	155
PID 4148 wrote to memory of 1468	4148	cmd.exe	155
PID 4148 wrote to memory of 4236	4148	cmd.exe	157
PID 4148 wrote to memory of 4236	4148	cmd.exe	157
PID 4148 wrote to memory of 1040	4148	cmd.exe	158
PID 4148 wrote to memory of 1040	4148	cmd.exe	158

Views/modifies file attributes 1 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4340	attrib.exe
5108	attrib.exe
4248	attrib.exe
1708	attrib.exe
5020	attrib.exe
2488	attrib.exe
4488	attrib.exe
4176	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\C.L[]LZ.bat"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\system32\attrib.exe
  attrib +s +h *.vbs*
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2488
- C:\Windows\system32\attrib.exe
  Attrib +S +H *Control*
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4488
- C:\Windows\system32\attrib.exe
  attrib +s +h *.vbs*
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4176
- C:\Windows\system32\attrib.exe
  Attrib +S +H *Control*
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4340
- C:\Windows\system32\attrib.exe
  attrib +s +h *.vbs*
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5108
- C:\Windows\system32\attrib.exe
  Attrib +S +H *Control*
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4248
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\ControlSet001\Policies /v _PM_Allow_Startup_Config /t REG_DWORD /D 01
  2⤵
  - Modifies registry key
  PID:4836
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\dyk.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4308
- C:\Windows\system32\attrib.exe
  attrib +s +h *.vbs*
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1708
- C:\Windows\system32\attrib.exe
  Attrib +S +H *Control*
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5020
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 8015.vbs 1000
  2⤵
  PID:5060
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 29330.vbs 1000
  2⤵
  PID:4964
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13157.vbs 1000
  2⤵
  PID:792
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 29960.vbs 1000
  2⤵
  PID:664
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 18429.vbs 1000
  2⤵
  PID:648
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 23282.vbs 1000
  2⤵
  PID:68
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 17476.vbs 1000
  2⤵
  PID:1732
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4273.vbs 1000
  2⤵
  PID:3968
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 1391.vbs 1000
  2⤵
  PID:504
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 32657.vbs 1000
  2⤵
  PID:4008
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 25659.vbs 1000
  2⤵
  PID:704
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 5320.vbs 1000
  2⤵
  PID:1328
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 15052.vbs 1000
  2⤵
  PID:1020
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 20936.vbs 1000
  2⤵
  PID:916
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 16510.vbs 1000
  2⤵
  PID:1896
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 3666.vbs 1000
  2⤵
  PID:1888
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 30753.vbs 1000
  2⤵
  PID:2088
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 7486.vbs 1000
  2⤵
  PID:1336
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 12535.vbs 1000
  2⤵
  PID:2144
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 11406.vbs 1000
  2⤵
  PID:1468
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 5556.vbs 1000
  2⤵
  PID:4236
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 1526.vbs 1000
  2⤵
  PID:1040
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13249.vbs 1000
  2⤵
  PID:5116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 27033.vbs 1000
  2⤵
  PID:2764
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 6549.vbs 1000
  2⤵
  PID:2256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 10124.vbs 1000
  2⤵
  PID:236
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 11415.vbs 1000
  2⤵
  PID:2248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13971.vbs 1000
  2⤵
  PID:2220
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 7029.vbs 1000
  2⤵
  PID:2528
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 14779.vbs 1000
  2⤵
  PID:2744
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 14293.vbs 1000
  2⤵
  PID:1248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13237.vbs 1000
  2⤵
  PID:1132
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 6843.vbs 1000
  2⤵
  PID:4920
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 24099.vbs 1000
  2⤵
  PID:3924
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 20783.vbs 1000
  2⤵
  PID:2844
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 3125.vbs 1000
  2⤵
  PID:2816
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 31445.vbs 1000
  2⤵
  PID:3344
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 31561.vbs 1000
  2⤵
  PID:4092
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 21153.vbs 1000
  2⤵
  PID:4208
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 18794.vbs 1000
  2⤵
  PID:2116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 6604.vbs 1000
  2⤵
  PID:3984
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 18656.vbs 1000
  2⤵
  PID:3996
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 24489.vbs 1000
  2⤵
  PID:1988
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 24881.vbs 1000
  2⤵
  PID:2980
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13596.vbs 1000
  2⤵
  PID:3944
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 28999.vbs 1000
  2⤵
  PID:4800
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4277.vbs 1000
  2⤵
  PID:1220
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 911.vbs 1000
  2⤵
  PID:3748
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4290.vbs 1000
  2⤵
  PID:3636
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 27730.vbs 1000
  2⤵
  PID:3668
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 29399.vbs 1000
  2⤵
  PID:3888
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 27544.vbs 1000
  2⤵
  PID:4424
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 5270.vbs 1000
  2⤵
  PID:4976
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 30541.vbs 1000
  2⤵
  PID:4496
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 12224.vbs 1000
  2⤵
  PID:4164
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 14223.vbs 1000
  2⤵
  PID:4256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 21467.vbs 1000
  2⤵
  PID:4320
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 20030.vbs 1000
  2⤵
  PID:5072
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 29164.vbs 1000
  2⤵
  PID:5068
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 3150.vbs 1000
  2⤵
  PID:760
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13077.vbs 1000
  2⤵
  PID:652
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 2667.vbs 1000
  2⤵
  PID:600
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 22810.vbs 1000
  2⤵
  PID:4872
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 2024.vbs 1000
  2⤵
  PID:3968
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 8218.vbs 1000
  2⤵
  PID:504
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 18972.vbs 1000
  2⤵
  PID:1044
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4863.vbs 1000
  2⤵
  PID:920
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 18318.vbs 1000
  2⤵
  PID:1892
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4204.vbs 1000
  2⤵
  PID:1840
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 1442.vbs 1000
  2⤵
  PID:2032
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 27707.vbs 1000
  2⤵
  PID:1652
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 1199.vbs 1000
  2⤵
  PID:2144
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 14790.vbs 1000
  2⤵
  PID:1468
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13720.vbs 1000
  2⤵
  PID:2640
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 28044.vbs 1000
  2⤵
  PID:4236
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 3427.vbs 1000
  2⤵
  PID:1040
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 14581.vbs 1000
  2⤵
  PID:5116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 11881.vbs 1000
  2⤵
  PID:2764
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 22850.vbs 1000
  2⤵
  PID:2256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 7178.vbs 1000
  2⤵
  PID:236
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 6889.vbs 1000
  2⤵
  PID:2252
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 21779.vbs 1000
  2⤵
  PID:2248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 7411.vbs 1000
  2⤵
  PID:2220
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 21040.vbs 1000
  2⤵
  PID:2528
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 31756.vbs 1000
  2⤵
  PID:2744
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4394.vbs 1000
  2⤵
  PID:1248
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 2927.vbs 1000
  2⤵
  PID:1132
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 23221.vbs 1000
  2⤵
  PID:4920
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 12755.vbs 1000
  2⤵
  PID:3928
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 8223.vbs 1000
  2⤵
  PID:2856
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 29430.vbs 1000
  2⤵
  PID:392
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 30506.vbs 1000
  2⤵
  PID:1720
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 12946.vbs 1000
  2⤵
  PID:4228
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 11714.vbs 1000
  2⤵
  PID:2656
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 25513.vbs 1000
  2⤵
  PID:4080
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 31869.vbs 1000
  2⤵
  PID:2116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 12180.vbs 1000
  2⤵
  PID:1712
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 22022.vbs 1000
  2⤵
  PID:3740
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 14911.vbs 1000
  2⤵
  PID:2280
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 729.vbs 1000
  2⤵
  PID:2932
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 5483.vbs 1000
  2⤵
  PID:4796
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 29700.vbs 1000
  2⤵
  PID:3220
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 17145.vbs 1000
  2⤵
  PID:3712
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 19656.vbs 1000
  2⤵
  PID:3716
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 26245.vbs 1000
  2⤵
  PID:5024
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 25155.vbs 1000
  2⤵
  PID:4392
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 2264.vbs 1000
  2⤵
  PID:3572
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 10651.vbs 1000
  2⤵
  PID:4396
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 9216.vbs 1000
  2⤵
  PID:1780
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4151.vbs 1000
  2⤵
  PID:3192
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 9485.vbs 1000
  2⤵
  PID:4156
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 22283.vbs 1000
  2⤵
  PID:5108
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 14527.vbs 1000
  2⤵
  PID:4840
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4359.vbs 1000
  2⤵
  PID:4500
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 8881.vbs 1000
  2⤵
  PID:1660
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 9760.vbs 1000
  2⤵
  PID:5100
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 6846.vbs 1000
  2⤵
  PID:4996
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 1940.vbs 1000
  2⤵
  PID:5056
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 19126.vbs 1000
  2⤵
  PID:4964
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 26450.vbs 1000
  2⤵
  PID:684
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 5794.vbs 1000
  2⤵
  PID:656
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 5046.vbs 1000
  2⤵
  PID:3356
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 27678.vbs 1000
  2⤵
  PID:3304
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 25071.vbs 1000
  2⤵
  PID:4872
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 31125.vbs 1000
  2⤵
  PID:3968
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 9416.vbs 1000
  2⤵
  PID:1864
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 29802.vbs 1000
  2⤵
  PID:504
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 23228.vbs 1000
  2⤵
  PID:1044
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 3408.vbs 1000
  2⤵
  PID:920
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 21864.vbs 1000
  2⤵
  PID:1020
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 27734.vbs 1000
  2⤵
  PID:916
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 28127.vbs 1000
  2⤵
  PID:1896
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 6777.vbs 1000
  2⤵
  PID:1648
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13432.vbs 1000
  2⤵
  PID:2088
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 11459.vbs 1000
  2⤵
  PID:1336
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 16380.vbs 1000
  2⤵
  PID:1320
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 25904.vbs 1000
  2⤵
  PID:2684
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 8040.vbs 1000
  2⤵
  PID:2696
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 24565.vbs 1000
  2⤵
  PID:1036
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 19103.vbs 1000
  2⤵
  PID:2716
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 22501.vbs 1000
  2⤵
  PID:1764
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4536.vbs 1000
  2⤵
  PID:2356
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 8958.vbs 1000
  2⤵
  PID:2700
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 18394.vbs 1000
  2⤵
  PID:3100
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 20588.vbs 1000
  2⤵
  PID:2176
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 3512.vbs 1000
  2⤵
  PID:2740
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 23418.vbs 1000
  2⤵
  PID:1200
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 303.vbs 1000
  2⤵
  PID:1268
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 17235.vbs 1000
  2⤵
  PID:1056
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 659.vbs 1000
  2⤵
  PID:3720
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 5501.vbs 1000
  2⤵
  PID:3136
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 1455.vbs 1000
  2⤵
  PID:2264
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 10611.vbs 1000
  2⤵
  PID:4128
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 21387.vbs 1000
  2⤵
  PID:4116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 32202.vbs 1000
  2⤵
  PID:2660
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 2916.vbs 1000
  2⤵
  PID:4100
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 27589.vbs 1000
  2⤵
  PID:4112
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 25734.vbs 1000
  2⤵
  PID:4080
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 19526.vbs 1000
  2⤵
  PID:2116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 32749.vbs 1000
  2⤵
  PID:1712
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 16759.vbs 1000
  2⤵
  PID:3740
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 20426.vbs 1000
  2⤵
  PID:2280
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 12972.vbs 1000
  2⤵
  PID:2932
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 3176.vbs 1000
  2⤵
  PID:4796
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13375.vbs 1000
  2⤵
  PID:3220
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 10501.vbs 1000
  2⤵
  PID:1220
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 9089.vbs 1000
  2⤵
  PID:3664
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4245.vbs 1000
  2⤵
  PID:3700
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 16112.vbs 1000
  2⤵
  PID:3208
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 29072.vbs 1000
  2⤵
  PID:1388
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 1355.vbs 1000
  2⤵
  PID:3888
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 22839.vbs 1000
  2⤵
  PID:4396
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 14923.vbs 1000
  2⤵
  PID:4424
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 8692.vbs 1000
  2⤵
  PID:4976
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 9726.vbs 1000
  2⤵
  PID:4160
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 5566.vbs 1000
  2⤵
  PID:4164
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 3095.vbs 1000
  2⤵
  PID:4244
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 27822.vbs 1000
  2⤵
  PID:4256
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 695.vbs 1000
  2⤵
  PID:5096
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 20772.vbs 1000
  2⤵
  PID:5072
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 19572.vbs 1000
  2⤵
  PID:5100
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 7727.vbs 1000
  2⤵
  PID:4996
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 14252.vbs 1000
  2⤵
  PID:420
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 29205.vbs 1000
  2⤵
  PID:684
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 21868.vbs 1000
  2⤵
  PID:600
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 15911.vbs 1000
  2⤵
  PID:424
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 11363.vbs 1000
  2⤵
  PID:596
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 1618.vbs 1000
  2⤵
  PID:356
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 28875.vbs 1000
  2⤵
  PID:2784
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 22019.vbs 1000
  2⤵
  PID:1324
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 20515.vbs 1000
  2⤵
  PID:1424
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 23895.vbs 1000
  2⤵
  PID:372
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 6192.vbs 1000
  2⤵
  PID:4000
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 180.vbs 1000
  2⤵
  PID:1548
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 31401.vbs 1000
  2⤵
  PID:1888
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13884.vbs 1000
  2⤵
  PID:1648
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 31589.vbs 1000
  2⤵
  PID:1652
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 10163.vbs 1000
  2⤵
  PID:2664
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 17691.vbs 1000
  2⤵
  PID:2716
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 1241.vbs 1000
  2⤵
  PID:236
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 16620.vbs 1000
  2⤵
  PID:2252
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4418.vbs 1000
  2⤵
  PID:2720
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 28482.vbs 1000
  2⤵
  PID:1276
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 4653.vbs 1000
  2⤵
  PID:1280
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 13530.vbs 1000
  2⤵
  PID:2772
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 9204.vbs 1000
  2⤵
  PID:4892
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 9459.vbs 1000
  2⤵
  PID:3988
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 31745.vbs 1000
  2⤵
  PID:3924
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 23017.vbs 1000
  2⤵
  PID:2264
- C:\Windows\system32\fsutil.exe
  fsutil file createnew 879.vbs 1000
  2⤵
  PID:4128
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\Msg.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2660
- C:\Windows\system32\PING.EXE
  ping 102.33.46.1 20
  2⤵
  - Runs ping.exe
  PID:4208
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 4
  2⤵
  - Runs ping.exe
  PID:4112
- C:\Windows\system32\mspaint.exe
  mspaint
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3740

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4680

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4756

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3684

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wsappx -s AppXSvc
1⤵
PID:5068

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k imgsvc
1⤵
PID:2932

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:5024

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4164

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RIZDY293\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\dyk.txt

Filesize
40B

MD5
30910cb2ab0c563f5e1701bd9d0cd585

SHA1
83e72309f199259f898a6e7d3a4e7b8fa84ac55f

SHA256
21417870bd4541025c54848cbe6a2957e398bee76cfcd44332f7b38c39cb5141

SHA512
687fc0407d37dd4c0ad89cabc6b4cd39b9920805eb55f1caa83c0769fc13172d87aaaa829300b04f98cfaea4aa34bcd98e10f0bda273616a7d4aebea132138df

Download Submit
C:\Users\Admin\dyk.txt

Filesize
40B

MD5
30910cb2ab0c563f5e1701bd9d0cd585

SHA1
83e72309f199259f898a6e7d3a4e7b8fa84ac55f

SHA256
21417870bd4541025c54848cbe6a2957e398bee76cfcd44332f7b38c39cb5141

SHA512
687fc0407d37dd4c0ad89cabc6b4cd39b9920805eb55f1caa83c0769fc13172d87aaaa829300b04f98cfaea4aa34bcd98e10f0bda273616a7d4aebea132138df

Download Submit
C:\Windows\Msg.txt

Filesize
55B

MD5
5c808e1fadc76f558b2de3517369f682

SHA1
287a33918206966ca8c931ce0a266b9f5d1edaf9

SHA256
4e3d1dfb2ee00cdd13b4e20073f21eb077a02f468832cb38bab4f46db4e12eab

SHA512
0c78bb104f1bda4e95b0defd11db5596e1f84ed421068977e6b9e8f08957126cf60ad44a12ae7228b254d0b0e67259fce0c0f9472a76ed538cb00f860aca275b

Download Submit
memory/4680-159-0x000001BBB56C0000-0x000001BBB56C2000-memory.dmp

Filesize
8KB

Download
memory/4680-161-0x000001BBBA050000-0x000001BBBA052000-memory.dmp

Filesize
8KB

Download
memory/4680-162-0x000001BBBA000000-0x000001BBBA002000-memory.dmp

Filesize
8KB

Download
memory/4680-214-0x000001BBBB4E0000-0x000001BBBB4E1000-memory.dmp

Filesize
4KB

Download
memory/4680-120-0x000001BBB4E20000-0x000001BBB4E30000-memory.dmp

Filesize
64KB

Download
memory/4680-157-0x000001BBB5610000-0x000001BBB5611000-memory.dmp

Filesize
4KB

Download
memory/4680-137-0x000001BBB5800000-0x000001BBB5810000-memory.dmp

Filesize
64KB

Download
memory/4680-215-0x000001BBBB4F0000-0x000001BBBB4F1000-memory.dmp

Filesize
4KB

Download
memory/4832-190-0x000001FA36D90000-0x000001FA36D92000-memory.dmp

Filesize
8KB

Download
memory/4832-199-0x000001FA37360000-0x000001FA37362000-memory.dmp

Filesize
8KB

Download
memory/4832-197-0x000001FA37330000-0x000001FA37332000-memory.dmp

Filesize
8KB

Download
memory/4832-195-0x000001FA36DE0000-0x000001FA36DE2000-memory.dmp

Filesize
8KB

Download
memory/4832-193-0x000001FA36DC0000-0x000001FA36DC2000-memory.dmp

Filesize
8KB

Download