hxxps://www[.]mediafire[.]com/file/u4fzdvuiy7z1488/Pooke[.]rar/file

Analysis

max time kernel
198s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/u4fzdvuiy7z1488/Pooke.rar/file

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4576	Cookin The OOPS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Cookin The OOPS.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Cookin The OOPS.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4936	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
3488	msedge.exe
3488	msedge.exe
1312	identity_helper.exe
1312	identity_helper.exe
372	msedge.exe
372	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4452	7zG.exe
Token: 35	4452	7zG.exe
Token: SeSecurityPrivilege	4452	7zG.exe
Token: SeSecurityPrivilege	4452	7zG.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
4452	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4868	OpenWith.exe
4576	Cookin The OOPS.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3536	3488	msedge.exe	81
PID 3488 wrote to memory of 3536	3488	msedge.exe	81
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 636	3488	msedge.exe	83
PID 3488 wrote to memory of 2992	3488	msedge.exe	84
PID 3488 wrote to memory of 2992	3488	msedge.exe	84
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85
PID 3488 wrote to memory of 1528	3488	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/u4fzdvuiy7z1488/Pooke.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5ce246f8,0x7ffa5ce24708,0x7ffa5ce24718
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6425432897340266386,12534383864583371029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1116

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Pooke\" -spe -an -ai#7zMap835:72:7zEvent19555
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4452

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Pooke\INSTRUCTIONS.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4936

C:\Users\Admin\Downloads\Pooke\Cookin The OOPS.exe
"C:\Users\Admin\Downloads\Pooke\Cookin The OOPS.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 4
  2⤵
  PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Pause
  2⤵
  PID:2280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Pause
  2⤵
  PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\274ea8d8-4cd9-4667-88b1-ded22ae267f2.tmp

Filesize
11KB

MD5
45c234b2746f686d7caebb244a3cea42

SHA1
be13625d483a212609f71cbc02d00a62c0d21cab

SHA256
14dad05f06614c2b6bf3169d7471ff1384e0408ce8b43a5b6be07736a114c4c6

SHA512
bb0e50fd481aae0ed32d88bd3690b97f3153f7ed2677132b079e4282bebde349fa0db19690cfdd78dcd6d290af15d14b3126b765c0cc66aaef0859c2d8a26ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
aaaaae94b1eba49ec7f887b98da77451

SHA1
1eb016597077a680656ce8061ff8abdbaf08b310

SHA256
02f8e0f27c7293c1a34d7271e619408cdb402999e04b3f5a4f82f5a1b4eb0816

SHA512
39eba0d0ceb3afa26f754d36c8b68420d282d87710e12c22572db85ab4e1ed979abb084c321b7f5b4aa799d103f55a8d4e1cd482871c4cd29df04da116b4e8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
85391e38b31d74a3c8a6d796fb57a8c7

SHA1
a3078e9093b924d74a066d2a2d9434097538afc3

SHA256
88de20e970dc631b03916e52eff55973f7bf1e4afdbd8fbd723d478cdb61eced

SHA512
b658041defcc7886c1a1cf982d5fe388498cbf787256faed7c634f06a0022eeee3c87e99b1d0eaed67d2cbdcc583704925945fd2990baf5f9a7f96751ee13c43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2bdbadf3e8b045fadb1e75ced46a7a45

SHA1
4fb3af6b5c3e13b4da86bc54e8158abdd3fbfdf7

SHA256
ab1b230b6e08ca854608589721a842f586dc44d697b3f0923447c8176bd66635

SHA512
ef0c39e11ce585d487799254d0075634953f4f3189e66068cb62a85ddd066bd976725681613689a332d8a4bcbaba9b598acdf617397f44dbe5ada1450cb61b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
42ee582683b0d1d85ef88f2eb798a561

SHA1
52ab5c82fed9bc77dc6196de56cdd5a71853d9b7

SHA256
0b604c59f5a05b8d837716145629659734ed9b536a22ccf8df5e57f8343625f1

SHA512
8b94f150c451e6692adfcb781680fa17cf17bd9703a73acca2475442591b8a29e4ca81b3feb9200e098d1cc585ea3d948907c935f456a672017e753b1ca7ea0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
9087d4a70714b25f2b7f5a63409a95c4

SHA1
7f267748fddd9d0bbfd8d763dba0f54606d94d0c

SHA256
d64a7828df6f1247605a6245c8c1591f44fb3b74faa7b96ad3ec234a20089bf3

SHA512
4a25d44014ceebbfb39697036e8e1153cc5ab35d0dc5939f01d8a614d767134923f3e9c705ed5d80d2f748000d4e23b85a37ba51cdde07a149c77e261dd6b8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
86d118fc8331604204fb6017ec6fb843

SHA1
7ead36a2348922cf0abc20cb569fef6b554775a3

SHA256
4b52b0ebad04ab1efe98c192cf1df6281fea22d6d929defd93f954a2d1613c27

SHA512
7c0e8b46b4c721779dcf9357fc29b3b104fbfdef2b1ae3c63be95171314cfe56d8df630571988e122e18fdd3186cc5ae2e7d258fcec005b75e5f0a91c6280cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
4eb1fc9a4492c116eb3480ddc2dd27a2

SHA1
f7ce8e6e400c93703c9fa0cf1a6e428a6cfd05dc

SHA256
9dc888ab66ed71745748b77cb0264e8fc22ca114ae23f90c0b98913c5062836d

SHA512
ef4431796d9f4439caf8947b08c8adc2dfd4f4bb6c84a18d82783136d5ad12b15b46cc2d0530cb5faafdba9424a58dad8a2198c609277b10759a6e9d04984a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f908c1e3fb0bcc61fa8fbdf1dbacd24f

SHA1
e0bf6128c3b5166574862a73db658aed54100fb1

SHA256
e9e953905647e9f9333ed4c45eacf93cd61ed034772b8012129509f8b62ecec0

SHA512
deed0692d8e62d6e49184f3803ef41cb5b827c82b7be6badaad80fb9d70293e6a0e066fefe82a065c3e17ca4b9a71588e0ea0f9b916ea1764a242c347c028f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
00d1746d91a08f98c082532bb5cfeda8

SHA1
b3f50952d325212b258fd75156ab23f065f1ea84

SHA256
011266064ca6d4c02f7a427df452afc270862b88986c1361f2777684bf50db69

SHA512
5c31844714dc984b0b6192cd40549dd32744afedcc3da47ffe7d9de92d6503591d49520642ab9a1ec7ef04460f3f2f4423b7eb6d31dc7f7f9bae2b097007cfb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e4bd74bc9ec2595223878978c0cdf31b

SHA1
3a4d81d29634d2d14f9a06dd5e8dfed8dbb7649b

SHA256
9c4e4ee91acee06cefc55c0130f32bdd3646466bf83ef5164f5f574d654527b7

SHA512
d46f73d24c68e0a221528047a27627e6426b53f3a483a18983abec635f3cbabc9e5b0b9021075cd6bb2d40c3a11d8fec39b3b4e5e3ba1f00a723e4bd53a8b14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3a4082a071b49ecb66f6e708a2cc16bb

SHA1
324a2badc55b11e76682a54534ef60b9e8418c03

SHA256
d1551fe477b2bfe1b8b6511ef86ece496a1118bef77800db63799b47d362e8a2

SHA512
bbfddda84a02fcf3b0e5be457f9102a0603a4a09067babaf99e3321a41f9fc8dc2426b31bad4e584fe89a779d6eda2a6fb6f4879fd7cef3c33cdd66fb7347532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5929a6.TMP

Filesize
1KB

MD5
879f872d29d70f7e4b040815cade5898

SHA1
d15d171267e37b37d5ffd46c3a59b27ff1941cdd

SHA256
00cd01ea96bb4153394bc611d0087ee5c8dec04bb8fa798d0225cdee7b6a04ea

SHA512
969ee7ea15ecfab36defd9672535c1d50ad578578f33cab18d2c4b5f672ebe0742036b944a5810176b73a07344c0d9c1df274bec815b75083e622e01448a55bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ae2f0730540367e92db7991f88cd3d43

SHA1
7c670bfaacd66d2b96b31823b37029b983071cb3

SHA256
ec99f1d6cb05260293922a535a6100c45aa0286baff9084efae405b1388196bb

SHA512
d012dec59e475d01e466942a5c8a905f523e38aa4af1965586839c0f91cf485f7b96f4c70e3a2d0a88cf782d0a54524d4132eeeca4a2069bcd05e50b4c8e6b0d

Download Submit
C:\Users\Admin\Downloads\Pooke.rar

Filesize
148KB

MD5
bf097e8ab6e2b7be7a2bf990cab6bd81

SHA1
daf1d46d1351263e7e039f5b966814abd6a40cd1

SHA256
bfbcb6e23d5b93c3fbc34c591acd9293069e2cdb903f080ac5950ec41e324c30

SHA512
86794913b090d20df6e38cc6fb82c3e1178c944229ef16a456905e7fd7a196c59c10f711e5c4825232cc66f1182c392958ebf9522f093a5c8ed3abbcdf0b6dbf

Download Submit
C:\Users\Admin\Downloads\Pooke\Cookin The OOPS.exe

Filesize
349KB

MD5
fb8bb2f17c0146f470b2709efafbefa0

SHA1
25d242382f10216de7eca27d85fc19d5958bafc8

SHA256
d1465690b1f7c20fae2fa7fa61a7183f12a6dbc22c04a4df20eecc0375f04acf

SHA512
7257f7a559caec91d35b0cc67ff31cedbdb0ae507ef8ac651d15036310101eb445587933e4db637242fbaaaceefc6fabbf288df0a58c84ea5d1ea5379cce6bd6

Download Submit
C:\Users\Admin\Downloads\Pooke\INSTRUCTIONS.txt

Filesize
829B

MD5
0b747cc3abc9fc97cebb1255d0d234f9

SHA1
02a7d05261aab8f928fa15cee51e51ead0b14e65

SHA256
c35df1419892aa96ee4982dadf81f350593c96a37e2ba3c67d22985029cf15f1

SHA512
7665d45b09bab8c9b2b9b23fd2f34cbf25a34349f0bf814920e38fec78a3f96fa9ed680e475bb960fc636198563fe1b5ad05cc28c06a4933b13633d8479d9ee5

Download Submit