hxxps://cdn[.]discordapp[.]com/attachments/1174429754988965959/1239233997037506711/PNG?ex=66422e18&is=6640dc98&hm=f4710c03c9b9a35d327c8796bbff0708e031d81b2f0eae777a1ce8a50a36ece6&

Analysis

max time kernel
615s
max time network
1608s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12/05/2024, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1174429754988965959/1239233997037506711/PNG?ex=66422e18&is=6640dc98&hm=f4710c03c9b9a35d327c8796bbff0708e031d81b2f0eae777a1ce8a50a36ece6&

Score

4^/10

execution

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e684dd607fa4da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "422318756"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{7E75E0E8-5338-419B-B053-F17C0C9E8F4 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000001b2951657fa4da011b2951657fa4da016e4f58657fa4da01c50601000000000001000000000000000000000000000000810314001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800b0003100000000000000000010004d6963726f736f66742e4d6963726f736f6674456467655f3877656b796233643862627765007c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e004d006900630072006f0073006f006600740045006400670065005f003800770065006b00790062003300640038006200620077006500000034005c0031000000000000000000100054656d70537461746500440009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000540065006d00700053007400610074006500000018005c00310000000000000000001000446f776e6c6f61647300440009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000044006f0077006e006c006f00610064007300000018004a003200c5060100ac58167a2000504e4700380009000400efbeac58167aac58167a2e0000000000000000000000000000000000000000000000000092c6a80050004e004700000012000000990000001c000000010000001c0000003400000000000000980000001800000003000000bbccb0901000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e4d6963726f736f6674456467655f3877656b7962336438626277655c54656d7053746174655c446f776e6c6f6164735c504e47000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006b7a6f7779736e690000000000000000149e36f4af5c7e4694f2ab08c7f23addfad10a8a87f2ee11a993ca9ac486f679149e36f4af5c7e4694f2ab08c7f23addfad10a8a87f2ee11a993ca9ac486f679ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003800370033003500360030003600390039002d0031003000370034003800300033003300300032002d0032003300320036003000370034003400320035002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000008626fc38000000000000d01200000000000000000000000000000000	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "421689069"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\PNG.q4ef4yv.partial:Zone.Identifier	browser_broker.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4996	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4332	WINWORD.EXE
4332	WINWORD.EXE
5268	vlc.exe
4100	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
804	mspaint.exe
804	mspaint.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5268	vlc.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1508	MicrosoftEdgeCP.exe
1508	MicrosoftEdgeCP.exe
1508	MicrosoftEdgeCP.exe
1508	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3188	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3188	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3188	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4904	MicrosoftEdge.exe
Token: SeDebugPrivilege	4904	MicrosoftEdge.exe
Token: SeDebugPrivilege	4092	firefox.exe
Token: SeDebugPrivilege	4092	firefox.exe
Token: SeDebugPrivilege	4100	PaintStudio.View.exe
Token: SeDebugPrivilege	4100	PaintStudio.View.exe
Token: SeDebugPrivilege	4100	PaintStudio.View.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
4092	firefox.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe
5268	vlc.exe

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
4904	MicrosoftEdge.exe
1508	MicrosoftEdgeCP.exe
3188	MicrosoftEdgeCP.exe
1508	MicrosoftEdgeCP.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
3896	OpenWith.exe
4092	firefox.exe
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
4332	WINWORD.EXE
5268	vlc.exe
804	mspaint.exe
4100	PaintStudio.View.exe
4100	PaintStudio.View.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2148	1508	MicrosoftEdgeCP.exe	78
PID 1508 wrote to memory of 2148	1508	MicrosoftEdgeCP.exe	78
PID 1508 wrote to memory of 2148	1508	MicrosoftEdgeCP.exe	78
PID 1508 wrote to memory of 2988	1508	MicrosoftEdgeCP.exe	79
PID 1508 wrote to memory of 2988	1508	MicrosoftEdgeCP.exe	79
PID 1508 wrote to memory of 2988	1508	MicrosoftEdgeCP.exe	79
PID 3896 wrote to memory of 5092	3896	OpenWith.exe	87
PID 3896 wrote to memory of 5092	3896	OpenWith.exe	87
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 5092 wrote to memory of 4092	5092	firefox.exe	83
PID 4092 wrote to memory of 3888	4092	firefox.exe	84
PID 4092 wrote to memory of 3888	4092	firefox.exe	84
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85
PID 4092 wrote to memory of 1840	4092	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://cdn.discordapp.com/attachments/1174429754988965959/1239233997037506711/PNG?ex=66422e18&is=6640dc98&hm=f4710c03c9b9a35d327c8796bbff0708e031d81b2f0eae777a1ce8a50a36ece6&"
1⤵
PID:4952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4904

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
PID:1476

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3188

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\PNG"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\PNG
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.0.990700767\448836028" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5080507e-0510-4417-9734-0ce7743418c9} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 1796 1e4156f7058 gpu
      4⤵
      PID:3888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.1.533543485\2036466381" -parentBuildID 20221007134813 -prefsHandle 2160 -prefMapHandle 2156 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98febcaa-b843-4cbd-b153-953b772e975d} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 2172 1e415603b58 socket
      4⤵
      Checks processor information in registry
      PID:1840
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.2.765803446\1960703622" -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 3040 -prefsLen 21646 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecc82e38-ae80-4472-bdad-d4f5d97fe491} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 3016 1e4197d2658 tab
      4⤵
      PID:2152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.3.1117153296\126217194" -childID 2 -isForBrowser -prefsHandle 3276 -prefMapHandle 3224 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {303cdc19-75d3-4f39-bb53-9bcc32eb42ee} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 3464 1e417fcff58 tab
      4⤵
      PID:5092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.4.1480204594\215181855" -childID 3 -isForBrowser -prefsHandle 4708 -prefMapHandle 4704 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a8e560a-1f07-46de-9041-3cf7ad2ffd8c} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 4716 1e419fc8a58 tab
      4⤵
      PID:5612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.5.1757832415\235897642" -childID 4 -isForBrowser -prefsHandle 4832 -prefMapHandle 4836 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e6f17c7-5d5f-43c3-abb8-07d4832064c0} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 4716 1e41b8c4e58 tab
      4⤵
      PID:5620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4092.6.180574795\1706484080" -childID 5 -isForBrowser -prefsHandle 5024 -prefMapHandle 5028 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b04ecbcb-ba62-4d63-ba1a-a5fa29208c64} 4092 "\\.\pipe\gecko-crash-server-pipe.4092" 5016 1e41be99e58 tab
      4⤵
      PID:5628

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "C:\Users\Admin\Desktop\RestartWrite.dot"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:1952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2936

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ConnectMerge.js"
1⤵
PID:3924

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\OptimizeExit.mp3"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ReadFind.bat" "
1⤵
PID:5608

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\ReadFind.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:4996

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ConnectSelect.jpg" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:804

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
24f055c061cb540ab1edb2d163ee7bb9

SHA1
a87cb4e8ded24a2c92ac02896416859f05099c8f

SHA256
909322ba78ed73a4fab41e5aab4481e4a31dcc33f787bee5af66c328a8121bcc

SHA512
4012f182972698a179fcdd47422da312384d26dca6b0bed5ad15fdc1b528ac5bd685909c38981e2c68b66a4c14df5e59f096ac7557d4e0470bd401da8ca6709d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
0dd9fc4fa79615f7b7cf423e9b745d8a

SHA1
f06c7d514abf02d3de6293addd777426c5be2c86

SHA256
f1fcb2926e6bc219ba486c757819f0d97c09b65fa08ac40d9030a5441d3a6450

SHA512
a1d8be838077ad48f278f44855aba74a76540f4f05dfd83657df0c9d004cc1dc01e5dac50425636c98f6e21a3331ce0db3ffd8e5f5b325ba0ff16f48ed7ba66d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L5P12AEX\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
233B

MD5
d0480c539c48d289180e19019e15cea6

SHA1
7d44fb9223225362beb4ccb4458e2c05970d8969

SHA256
ef9f05c28cea02e4f9699f025a781872caa4b9646bb94d22e895d1115abb5822

SHA512
880a12c0742b667aac9ebeb10c6fce734f6e74bc05d34a216dfe516f478066269725a3e34dcde2383ca0eba868b00b322f7d57060b8bd142e1935601b8bb0653

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

Filesize
2KB

MD5
404a3ec24e3ebf45be65e77f75990825

SHA1
1e05647cf0a74cedfdeabfa3e8ee33b919780a61

SHA256
cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

SHA512
a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\6QIPW3VW\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFE063BB5AAB182790.TMP

Filesize
16KB

MD5
cbbf4a32798002f536f76e46b3d0056c

SHA1
6a2aaf8e2e322973f3e9e5226317dc90d39227fd

SHA256
e4bd48d6e534fcb34f833f7ccb56dc84b2f70170c842f1bf0be7ca11c4bd5c27

SHA512
dcfe93034e154cf1e72f657861b0de604ac82fb623241ad3e898bc3e18a24c0f5a08787b71e164760288301a0ec2996c8e040df463d5e54437f8a3d466ced122

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1E18XCS6\PNG[1]

Filesize
65KB

MD5
bae74301785767897ea813d1da790e3e

SHA1
670977a9e4df1ba075774c110cb01e521dcd728e

SHA256
97f8e1d9d572cfe3a4eb55fe1430357ed4d476ea58d71010cf22b25474f2f26f

SHA512
603f74fb5f44b9f737d2b4b754c999039a440ae56b448e6564b8a3b797a4338acb224e02f49926a2fc08eed6824d54fe2c23cd8ed0d31e021f8d5e3ee0dfcaf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDAD3C.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
261B

MD5
b3ecfc35719e1070fa1c7610beb8dfc7

SHA1
c00a1612ea1bcc11dcf856095be77cd78084e7a8

SHA256
71b477143c04734ea38a24c9b91c40905332ce2b9e3b979782e4dbd3a77f73d5

SHA512
91668f70741a3aeb23c145b414eb17356be02fb41b9265211069e21079a859d65b8bac8197d460300e3898d650bd471e122d97b466a31896ac4ca06240fabbad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
c525a91d0bbe3a29450ecb933af039ad

SHA1
4d6c88bfe74a2018f09c3e7534a331947fffc3e3

SHA256
389b8032854ecda51830486b9e942bf2563b3060396aa44083a08896c84e6262

SHA512
23c06961388c487fb62a0100f1f0f068448809c45c6c4af6b6a5e8b59bc14b039c91f3b14d9893f506edf72d16785930be1bbcc3150a2a75bed59a75197b8e93

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\0cee9954-0c4f-4597-b6cc-a9379ec958c4

Filesize
10KB

MD5
5d114253d8ab8379180760b820e35e7d

SHA1
fe6fc98c8046498dc9667ccc5587229ec177d455

SHA256
2fb819d69b480818d0bcdec46b62c6aa98db454003e5db895133308d8097eba9

SHA512
26d8b8b60e9941c3fb6af27d57a62caddb363d6cf4176339d1dbf8c01b0440e4b6e2251408a2a33b3d0f79a11d29f78822e55c5ccd39420822e7f7a5e9647293

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\datareporting\glean\pending_pings\dbe76662-c64d-45f9-808c-0ce6e4f3d8c0

Filesize
746B

MD5
955daf5e56732c0d9580b03e229f6de4

SHA1
6b0f585f19762968bab337b93c1538c9e4287ef5

SHA256
b98eaccee934e49f177cf67b91a8766ed3f3132d474ff9eba6155184f7ce7bce

SHA512
e9f7994759d81b06cc43760244f628c24c3c661896d809c20c63905d30d5e181129f4e1b7d27dc22aae0b9cc71a6b0f0c9886e1ac1c03cf934dcbe6990df28e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs-1.js

Filesize
6KB

MD5
2b40eb78ddf719afd85317c7428376d2

SHA1
7a1f355aed08df41b257dde91acd89b06d008cce

SHA256
6ef5cdaa39481d57de60fe6fb1816244b7a32391a533fecfb31eb466ce409ed9

SHA512
1a51f57e8b4e48a5d0fe0b501f49002f8e1eeeb26ae7cf8d189261273462da3ddd5fb4ef70051a10620914191eb4443658904b9e075201d82d73d56e722cdcaf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js

Filesize
6KB

MD5
ef26efc3bd66df49cb44452e34a859c9

SHA1
69c1b9da82b17ecd49a964ee318076157695739e

SHA256
aebe8fbb9091159c4709081f2b77618e3ed61cceaa4f59b24a750c4e12e4d176

SHA512
76ff106b57b4416f821da2a6e3b751dce7672acbc082c9431164db40834440b15c1a619c87601dc81c01e9c1eec236b7b73595cc6d698045e209bce05bf62850

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f5fac0ae4e1e290e3022d264b2076716

SHA1
0cd9f5c8f714bcdc07ec65261f58e789b35caa9a

SHA256
1ed79886dbe57b0dd46f29d3105f8f054c9e79d36cb9ffdcdbae4603c94fc51f

SHA512
f4299e4ea7bb55985e55ae3f52ef20f808dcddc1c1037d4355f946148cdf3f195346aa12c37d5f3cf124502b2d89c14e169b4dc6861463cb6148cb8badcd11a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\sessionstore.jsonlz4

Filesize
1KB

MD5
09dc80e708f19a3be6ef155551c95d58

SHA1
c25b54703ed380a6317f72e995f7e5454da750ce

SHA256
a2009e4aae56ca0a18672c3c6808a2df006fb8700a2db8da3e9f8905c6d366c1

SHA512
cf0240bb2b6c72b5f21f0ff6a48c40794d5011f097e1e17d75c5445edc11de52fe9ce6f548b2d6a4b47d8418a87d55aa2d92d4d9fdec74d896e4c0f69f48a270

Download Submit
memory/2148-58-0x0000021DE9BD0000-0x0000021DE9CD0000-memory.dmp

Filesize
1024KB

Download
memory/2148-66-0x0000021DF9D70000-0x0000021DF9D72000-memory.dmp

Filesize
8KB

Download
memory/2148-64-0x0000021DF9D50000-0x0000021DF9D52000-memory.dmp

Filesize
8KB

Download
memory/2148-61-0x0000021DF9D20000-0x0000021DF9D22000-memory.dmp

Filesize
8KB

Download
memory/2988-70-0x0000028D6D780000-0x0000028D6D880000-memory.dmp

Filesize
1024KB

Download
memory/3188-44-0x000001BAEEFC0000-0x000001BAEF0C0000-memory.dmp

Filesize
1024KB

Download
memory/4332-330-0x00007FFF6A270000-0x00007FFF6A280000-memory.dmp

Filesize
64KB

Download
memory/4332-1023-0x00007FFF6A270000-0x00007FFF6A280000-memory.dmp

Filesize
64KB

Download
memory/4332-328-0x00007FFF6A270000-0x00007FFF6A280000-memory.dmp

Filesize
64KB

Download
memory/4332-329-0x00007FFF6A270000-0x00007FFF6A280000-memory.dmp

Filesize
64KB

Download
memory/4332-1022-0x00007FFF6A270000-0x00007FFF6A280000-memory.dmp

Filesize
64KB

Download
memory/4332-333-0x00007FFF67080000-0x00007FFF67090000-memory.dmp

Filesize
64KB

Download
memory/4332-334-0x00007FFF67080000-0x00007FFF67090000-memory.dmp

Filesize
64KB

Download
memory/4332-327-0x00007FFF6A270000-0x00007FFF6A280000-memory.dmp

Filesize
64KB

Download
memory/4332-1024-0x00007FFF6A270000-0x00007FFF6A280000-memory.dmp

Filesize
64KB

Download
memory/4332-1025-0x00007FFF6A270000-0x00007FFF6A280000-memory.dmp

Filesize
64KB

Download
memory/4904-284-0x000001F5AE320000-0x000001F5AE321000-memory.dmp

Filesize
4KB

Download
memory/4904-0-0x000001F5A7020000-0x000001F5A7030000-memory.dmp

Filesize
64KB

Download
memory/4904-317-0x000001F5AB520000-0x000001F5AB522000-memory.dmp

Filesize
8KB

Download
memory/4904-320-0x000001F5A61F0000-0x000001F5A61F1000-memory.dmp

Filesize
4KB

Download
memory/4904-324-0x000001F5A61B0000-0x000001F5A61B1000-memory.dmp

Filesize
4KB

Download
memory/4904-285-0x000001F5AE330000-0x000001F5AE331000-memory.dmp

Filesize
4KB

Download
memory/4904-35-0x000001F5A61C0000-0x000001F5A61C2000-memory.dmp

Filesize
8KB

Download
memory/4904-16-0x000001F5A7120000-0x000001F5A7130000-memory.dmp

Filesize
64KB

Download