maze | df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d

Resubmissions

22-06-2024 18:41

240622-xb3pjsyhpe 10

22-06-2024 17:04

240622-vlcj1azdrp 10

Analysis

max time kernel
145s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22-06-2024 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe
Size

534KB
MD5

8e8eaa9b81f664c796225ac49e9ecb71
SHA1

320e25a4b4918dd76582c7f7e68f3d68268b17f7
SHA256

df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d
SHA512

66529bd7faa3275856fa87e7ec5ed250b0fc694f12e5fab2d1e84aa367844d42c7a19911065c9f2985752d55addc921797c77861081f2f40b5f1a69f84d935d0
SSDEEP

12288:1FF+1IiVMR/La01MZa03EiYIRKoMDKd+A1Ll7e7:1FFroMROFZa03EiYILWWvll74

Score

10^/10

maze defense_evasion execution impact ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\DECRYPT-FILES.html

Ransom Note

<html> <head> <script> function CopyToClipboard(containerid) { if (document.selection) { var range = document.body.createTextRange(); range.moveToElementText(document.getElementById(containerid)); range.select().createTextRange(); document.execCommand("copy"); } else if (window.getSelection) { var range = document.createRange(); range.selectNode(document.getElementById(containerid)); window.getSelection().addRange(range); document.execCommand("copy"); alert("Base64 copied into the clipboard!") } } </script> <style> html{ margin:0; padding:0; width:100%; height:100%; } body { background: #000000; color: #ececec; font-family: Consolas }; .tooltip { position: relative; display: inline-block; border-bottom: 1px dotted black; } .tooltip .tooltiptext { visibility: hidden; width: 120px; background-color: #555; color: #fff; text-align: center; border-radius: 6px; padding: 5 px 0; position: absolute; z-index: 1; bottom: 125%; left: 50%; margin-left: -60px; opacity: 0; transition: opacity 0.3s; } .tooltip .tooltiptext::after { content: ""; position: absolute; top: 100%; left: 50%; margin-left: -5px; border-width: 5px; border-style: solid; border-color: #555 transparent transparent transparent; } .tooltip:hover .tooltiptext { visibility: visible; opacity: 1; } p#base64{ -ms-word-break: break-all; word-break: break-all; -webkit-hyphens: auto; -moz-hyphens: auto; -ms-hyphens: auto; hyphens: auto; } p#base64:hover{ cursor: hand; } </style> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta http-equiv="Content-Style-Type" content="text/css"> </head> <body> <table style="position: absolute;" width="100%"> <tr> <td style="width: 15%;"> <td style="width: 70%;"> <div style="text-align: center; font-size: 20px;"> Encrypted by Maze ransomware v1.2 !한국어 버전은 아래로 스크롤하십시오! ******************************************************************************************** Attention! Your documents, photos, databases, and other important files have been encrypted! ******************************************************************************************** <div style="text-align: center; font-size: 15px;"> What is going on? Your files have been encrypted using strong reliable algorithms RSA-2048 and ChaCha20 with an unique private key for your system You can read more about this cryptosystem here: <a href=https://en.wikipedia.org/wiki/RSA_(cryptosystem)>https://en.wikipedia.org/wiki/RSA_(cryptosystem)</a> The only way to recover (decrypt) your files is to buy decryptor with the unique private key Attention! Only we can recover your files! If someone tell you that he can do this, kindly ask him to proof! By us you can decrypt one of your files for free as a proof of work that we have the method to decrypt the rest of your data. In order to either buy the private key or make test decryption contact us via email: 1) E-mail: [email protected] 2) E-mail: [email protected] Please write to the both email addresses Remember to hurry up as email address may not be available for very long as soon as law enforcements of different countries always trying to seize emails used in ransom companies If you are willing to pay but you are not sure knock us and we will save your e-mail address. In case the listed addresses are seized we will write you from the new one Below the Korean text you will see a big base64 blob, you will need to email us and copy this blob to us. you can click on it, and it will be copied into the clipboard. If you have troubles copying it, just send us the file you are currently reading, as an attachment. ***************************************************************** 주의! 문서, 사진, 데이터베이스 및 기타 중요한 파일이 암호화되었습니다! ***************************************************************** </div> <div style="text-align: center; font-size: 13px;"> 무슨 일 이니? 시스템에 고유 한 개인 키가있는 강력한 신뢰할 수있는 알고리즘 RSA-2048 및 ChaCha20을 사용하여 파일이 암호화되었습니다. 이 암호 시스템에 대한 자세한 내용은 다음을 참조하십시오. <a href="https://ko.wikipedia.org/wiki/RSA_%EC%95%94%ED%98%B8">https://ko.wikipedia.org/wiki/RSA_%EC%95%94%ED%98%B8</a> 파일을 복구 (암호 해독)하는 유일한 방법은 고유 개인 키로 암호 해독기를 구입하는 것입니다 주의! 우리는 당신의 파일을 복구 할 수 있습니다! 누군가가이 일을 할 수 있다고 말하면 친절하게 그에게 증거 해달라고 부탁하십시오! 우리는 귀하의 파일 중 하나를 해독하여 나머지 데이터를 해독 할 수있는 작업 증명 자료로 무료로 해독 할 수 있습니다. 개인 키를 사거나 테스트 암호 해독을 위해 이메일을 통해 저희에게 연락하십시오 : 메인 전자 메일 : 1) E-mail: [email protected] 2) E-mail: [email protected] 두 개의 이메일 주소를 모두 적어주십시오 다른 국가의 법 집행 기관이 항상 몸값 회사에서 사용되는 전자 메일을 압류하려고하자마자 전자 메일 주소를 사용할 수 없을 수도 있으므로 서두르는 것을 잊지 마십시오. 지불 할 의향이 있지만 우리를 잘 모르겠다면 전자 메일 주소를 저장합니다. 나열된 주소가 압수되면 우리는 새 주소에서 귀하를 씁니다. 아래에 큰 base64 얼룩이 보일 것입니다. 이메일을 보내고이 얼룩을 우리에게 복사해야합니다. 클릭하면 클립 보드에 복사됩니다. 복사하는 데 문제가 있으면 현재 읽고있는 파일을 첨부 파일로 보내주십시오. Base64 : </div><div style="text-align: center; font-size: 12px;">4UpXQzguVgcgsEr6J+wvR2RCaMtk4j5JzjzR1zHSf7968P8Rxwzp00ZpnaGeBXQ7x6vaDEqZB1CW5bxJwN03FuuRzps4zCSMeiXDxblxcz3f4g+yiRoGllOjPE4md1qC+e2j/9lhc3SdF+7b1ST8h2Uu3gqnAkT8cuH7u1GDwsvBC/Sdjp0jPUJxNCoOGsBVl1iwDv9Pr6966V2BcKjOpfiAqD+AfWFdihsZ8XURjy/Pmyj7dXubE5CAxJwG52HWXQjMaX5osqQ6zXDV4/fkCWCpCqABtZ3J+3deLd1njPY8lcHmEDOxJ67PVSnXJBn13/73dcQBCxfrF/i8GGnj5duubDHGAF4mx2hIv+SnnDzRPY0FYlGgYgebeYX2g3cHUt/YCISJnyoomgD36zChoC7sYoqmwbVxzIbuk0g7KlP8Kbw9nXqbGuDH/DsRVVvcjWBNT6ue5zDEQ/sy237h6ODSPHmu5sejVZWKf1DV6SGDDHfIk4h9Royta6iUC+LFnN3uTXvFBc4wYe1kRfbeIqiIJCZnEb6TvaUchBgvtEHeofHw8k5WkWzIGcAxCHnYqh8EyJLA/qhJc4e7WdaNNSzYeAg2J1jHfxjyD4tknVCGZnSUBLGCIeInF4nnytJQRp2hmfSo2+wpD3mhP/xFklu6c28xjcCgKgyoqOYm83K2scLh2tPGivEVQ/f38hM/69pzrjO/maH2k9LZDdY78FiIvwBVbZGO6+Os0Eve256+gzCL+0p4xdzShzlML1PZQS4mHEfpdfIt89UjHvH5m9McKD1G/18XHhs6tjb9eiK+rAK6C9w0v8TBzi3Y9u2BE6FYFnupaY4runpTQUUXHqYwCIRbKzl2iR1bXdk8SjJF6r4Uww9b38Y1sjO9morLSw1sDbwa2SNWjz0t9g2LxbSc1kLekGvP0sCcpOCR74baN5hX0z9uGm7BWbEiu7e9m9RhnSs6v6W7Y5tv89AnraVd0zpYxVk0p/H/YAM/PSck0jWBadJa4Sy7eaBT7ddBXOsVN4P5qFIZVQuSwB1T3HSMpbaHsDcloHLT/pKKGY5zv0WTaj0FYVNYfhL7fUojX7mb14XQf79CwYmQm8uofo8+di6XvPJ1CBIkqp91y35sMBwyTGbLzB4IiZpsEqXRDhNJ7gMkhh3rM4Q2aRyiDxpSDu/7Nd7UsJUUpJxiGq4jrGr9stPVaJ5ewooZ3ozAlMCO47A1L5iLLSHjOE3dxYQSwLUiRnsksg5EL3V/b8oniBpg6ckVWNTKZ3WQfxAO5YPPhtlUWQiUKAB7Fk6UMGXagYveisz7PAHg5a3KQ2xgQZZyeYOm81NP3dw/XB7ZgufL6RQ228cNB4g+v/Ro/AempK/K+wkogAFn2nMY4GxLDTZUUJQ4AgoSXXbaJ0hITReXCJ3z8INrx9kCR2dg9Fy0RLuo9zWIRCtyLoa3Ppcy6ndl78pKtPF14VabBO/8puufUi2gjh/t2T42IEr8BEGXT7jHiaYSF013e9t4od3gYhcTOV0XCmcCuNKX+bbElshA94rbwMAwsRDrW8edniyseNrp5xOUzgZWQm9HcXNh3aV3EymaDY7dCjeENLE/PTdjA+6VAIkfk1zU7VClOgmRPMqD6Y7B7IkuqMS4f40nyGqtVEF4+aTxFMBAd39LCji+mFLiWTXFXmbFoSOxByBOevF2CzQXqYgRuw2rroIt5v9gFpsNlFd+mJhe0GolXfYYBZEcIoyLX2eDIQSfEFOdta03bjR7mIgO+5THxf4Chxv+6UwlLcsDXbd5xwYqiGPpzVZqKBt+tmxLRCmeiqCyGRUIPy3K8eOvYkhWZMW2lGD8/U5dzdm5U/AF6cQW0g0hP/zuBLsJHWOktaTp+GjHrK9vIcH1TbHCXJ9ic1Birw9KJ1eBLAU/mR1bgHxEjtKP9V4paCH3ZqjHqh5AvTjPU2Y77+8+NzoL+owWO0bxlYUN9quFWJpQif61qVj7FfjZmggcjtpITxqa1jqYERo/z2tRMDBjupClYUJkGogmJ8/CsNrYce42e8NkYXUV3UiAhx8o3oFpVBsxKuwYYVs3/AyKum4jElQeRv5WZ3LMd9xndYEnqZSuJ7d60Q30Re6DfaF1UGJXwavCw/9n91Ot6EbbPGKQ0lW/F4gNih5aSkLOXK0mOzpHfpDw40Zh6dnM8hYdqPTS3Y55t3cegaOAJ9igVweGdwX9cunqjyKUTg8w08UgTgWqOjfKe8eCgZtA0woiOAA4ADYANAAwADkAOQBlADMANQA5ADcAMAA4AGQAYQAAABCAYBoMQQBkAG0AaQBuAAAAIhJOAEQAVABOAFoAVgBIAE4AAAAqDG4AbwBuAGUAfAAAADIeVwBpAG4AZABvAHcAcwAgADEAMAAgAFAAcgBvAAAAQlZ8AEMAXwBGAF8AMgAwADQAOQAyAC8AMgA0ADEAMwA2ADEAfABEAF8AVQBfADAALwAwAHwARgBfAEYAXwAyADAANAAxADUALwAyADAANAA3ADkAfAAAAEgAUEBYiQhgiQhoiQhwodTfcngJgAEBigEDMS4y복사하려면 여기를 클릭하십시오</div></td><td style="width: 25%; text-align: right;"> </tr></table> </body></html>

Emails

[email protected] 2

[email protected]

URLs

http-equiv="Content-Type"

http-equiv="Content-Style-Type"

Signatures

Maze
Ransomware family also known as ChaCha.
trojan ransomware maze
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 4 IoCs

Processes:

df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\81fab7.dat	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.html	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\81fab7.dat	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp"	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 02c3df0bd4c4da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f1fa471ad4c4da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6704501ad4c4da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000054ec3593c629475e76fdbe4979de84d65c271b63ba88508393b0b77409559c7e9c13100aedd3ff61f89e3f4aa354e7b174746900348ea94ea928	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = d0e05c6d06c5da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "425911800"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "425909687"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 50db863646e5da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4608 NOTEPAD.EXE

pid	process
4608	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe

pid	process
1640	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe
1640	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

208 OpenWith.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4896 MicrosoftEdgeCP.exe
4896 MicrosoftEdgeCP.exe

pid	process
4896	MicrosoftEdgeCP.exe
4896	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exevssvc.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3608	wmic.exe
Token: SeSecurityPrivilege	3608	wmic.exe
Token: SeTakeOwnershipPrivilege	3608	wmic.exe
Token: SeLoadDriverPrivilege	3608	wmic.exe
Token: SeSystemProfilePrivilege	3608	wmic.exe
Token: SeSystemtimePrivilege	3608	wmic.exe
Token: SeProfSingleProcessPrivilege	3608	wmic.exe
Token: SeIncBasePriorityPrivilege	3608	wmic.exe
Token: SeCreatePagefilePrivilege	3608	wmic.exe
Token: SeBackupPrivilege	3608	wmic.exe
Token: SeRestorePrivilege	3608	wmic.exe
Token: SeShutdownPrivilege	3608	wmic.exe
Token: SeDebugPrivilege	3608	wmic.exe
Token: SeSystemEnvironmentPrivilege	3608	wmic.exe
Token: SeRemoteShutdownPrivilege	3608	wmic.exe
Token: SeUndockPrivilege	3608	wmic.exe
Token: SeManageVolumePrivilege	3608	wmic.exe
Token: 33	3608	wmic.exe
Token: 34	3608	wmic.exe
Token: 35	3608	wmic.exe
Token: 36	3608	wmic.exe
Token: SeIncreaseQuotaPrivilege	3608	wmic.exe
Token: SeSecurityPrivilege	3608	wmic.exe
Token: SeTakeOwnershipPrivilege	3608	wmic.exe
Token: SeLoadDriverPrivilege	3608	wmic.exe
Token: SeSystemProfilePrivilege	3608	wmic.exe
Token: SeSystemtimePrivilege	3608	wmic.exe
Token: SeProfSingleProcessPrivilege	3608	wmic.exe
Token: SeIncBasePriorityPrivilege	3608	wmic.exe
Token: SeCreatePagefilePrivilege	3608	wmic.exe
Token: SeBackupPrivilege	3608	wmic.exe
Token: SeRestorePrivilege	3608	wmic.exe
Token: SeShutdownPrivilege	3608	wmic.exe
Token: SeDebugPrivilege	3608	wmic.exe
Token: SeSystemEnvironmentPrivilege	3608	wmic.exe
Token: SeRemoteShutdownPrivilege	3608	wmic.exe
Token: SeUndockPrivilege	3608	wmic.exe
Token: SeManageVolumePrivilege	3608	wmic.exe
Token: 33	3608	wmic.exe
Token: 34	3608	wmic.exe
Token: 35	3608	wmic.exe
Token: 36	3608	wmic.exe
Token: SeBackupPrivilege	4872	vssvc.exe
Token: SeRestorePrivilege	4872	vssvc.exe
Token: SeAuditPrivilege	4872	vssvc.exe
Token: SeIncreaseQuotaPrivilege	796	wmic.exe
Token: SeSecurityPrivilege	796	wmic.exe
Token: SeTakeOwnershipPrivilege	796	wmic.exe
Token: SeLoadDriverPrivilege	796	wmic.exe
Token: SeSystemProfilePrivilege	796	wmic.exe
Token: SeSystemtimePrivilege	796	wmic.exe
Token: SeProfSingleProcessPrivilege	796	wmic.exe
Token: SeIncBasePriorityPrivilege	796	wmic.exe
Token: SeCreatePagefilePrivilege	796	wmic.exe
Token: SeBackupPrivilege	796	wmic.exe
Token: SeRestorePrivilege	796	wmic.exe
Token: SeShutdownPrivilege	796	wmic.exe
Token: SeDebugPrivilege	796	wmic.exe
Token: SeSystemEnvironmentPrivilege	796	wmic.exe
Token: SeRemoteShutdownPrivilege	796	wmic.exe
Token: SeUndockPrivilege	796	wmic.exe
Token: SeManageVolumePrivilege	796	wmic.exe
Token: 33	796	wmic.exe
Token: 34	796	wmic.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

OpenWith.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
208	OpenWith.exe
804	MicrosoftEdge.exe
4896	MicrosoftEdgeCP.exe
4896	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

OpenWith.exedf2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 208 wrote to memory of 4608	208	OpenWith.exe	NOTEPAD.EXE
PID 208 wrote to memory of 4608	208	OpenWith.exe	NOTEPAD.EXE
PID 1640 wrote to memory of 3608	1640	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe	wmic.exe
PID 1640 wrote to memory of 3608	1640	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe	wmic.exe
PID 1640 wrote to memory of 796	1640	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe	wmic.exe
PID 1640 wrote to memory of 796	1640	df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe	wmic.exe
PID 4896 wrote to memory of 4400	4896	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4896 wrote to memory of 4400	4896	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4896 wrote to memory of 4400	4896	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4896 wrote to memory of 4400	4896	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4896 wrote to memory of 4400	4896	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4896 wrote to memory of 4400	4896	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe
"C:\Users\Admin\AppData\Local\Temp\df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\system32\wbem\wmic.exe
  "C:\okytd\ucgg\..\..\Windows\rnkmk\xmc\ai\..\..\..\system32\bxy\..\wbem\kemw\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\system32\wbem\wmic.exe
  "C:\aprwx\wxm\qevc\..\..\..\Windows\xnskx\vn\..\..\system32\iff\..\wbem\tp\pby\..\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\CloseSelect.lock
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b8
1⤵
PID:1140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:804

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:4400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
6d368b48a16c11ae83b200ac061e36e4

SHA1
c3e2bc56b20ccdfe930f94f1799817122314504d

SHA256
770b6aec48121a264af30c9fe9f92741aa59b1fa92c3798b59f2b7efd2d26322

SHA512
40c060df2c4844aba18b38d7e00e57784a0e5395d3bd2610b2bd33a3e536e3cd5f1eb7c0b481ba76f870029367dba20ee43d52dbf5249a483d3a4ddace179346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V28C7N3J\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ECRD2SXD\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\1568373884.pri

Filesize
218KB

MD5
13e8857c11c103c86af5a010ba171f66

SHA1
dd8f6ee3cd8b1ac01c480e0843c323805c3cf2ae

SHA256
8b69fd5d6b540b3080b438f3cf0d42f3266654e786ce7dc5e85855d309e962ac

SHA512
8454d4a02c15e12428628aaf9df2f5ec48d261e692a8b4f2e7e81d83c3acd6921bfb2d3ebc76f78f124fd0065852af348bec56a91e7ba9c54525615d6b7804b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_178B43A3E1704EC3B46D3FB1FB61C144.dat

Filesize
940B

MD5
ff283ff5efd9a52726d550a3454b8b0a

SHA1
627312ba63b1cfb8ad0f825e95433377d5d2d17e

SHA256
41da31ecedb0e533bbd7899c744cca240ac27f27384c1e30bda4d6d1fc645724

SHA512
b90c1a87fd4cf97213128f7bd44e791d988261c332a60ce943b25f4a76c6aa46ee64d7111a6009cff4e57ae35e6cdd381977067597465104ebd95fb6e8fa11fa

Download Submit
C:\Users\DECRYPT-FILES.html

Filesize
9KB

MD5
4dfdd91a8a05c9effc8408af947321f9

SHA1
9f8f17dca78335ce6c82f964d486513d0f91a661

SHA256
a86ad920a3cfc59b26c3a2ea35683d8bcf56cfe89dc330d070ffe78878b1edb4

SHA512
6da6ecc045beb9670aaaafc2f69c0e3eef2cd5d136c324d6b790575394808be60b7cc723f0ad70a8cb38a2855f0663055bf06281ef2c00c5a34677c8c4b77740

Download Submit
memory/804-4855-0x0000020E58860000-0x0000020E58862000-memory.dmp

Filesize
8KB

Download
memory/804-4829-0x0000020E54020000-0x0000020E54030000-memory.dmp

Filesize
64KB

Download
memory/804-4848-0x0000020E51390000-0x0000020E51391000-memory.dmp

Filesize
4KB

Download
memory/804-4852-0x0000020E58B50000-0x0000020E58B52000-memory.dmp

Filesize
8KB

Download
memory/804-4813-0x0000020E53F20000-0x0000020E53F30000-memory.dmp

Filesize
64KB

Download
memory/804-4850-0x0000020E513F0000-0x0000020E513F2000-memory.dmp

Filesize
8KB

Download
memory/804-4911-0x0000020E5BAF0000-0x0000020E5BAF1000-memory.dmp

Filesize
4KB

Download
memory/804-4912-0x0000020E5BB00000-0x0000020E5BB01000-memory.dmp

Filesize
4KB

Download
memory/1640-4254-0x0000000000400000-0x0000000004E4F000-memory.dmp

Filesize
74.3MB

Download
memory/1640-4806-0x0000000000400000-0x0000000004E4F000-memory.dmp

Filesize
74.3MB

Download
memory/4400-4862-0x000002AA80BD0000-0x000002AA80CD0000-memory.dmp

Filesize
1024KB

Download
memory/4400-4865-0x000002AA93090000-0x000002AA93092000-memory.dmp

Filesize
8KB

Download
memory/4400-4867-0x000002AA930B0000-0x000002AA930B2000-memory.dmp

Filesize
8KB

Download
memory/4400-4869-0x000002AA930D0000-0x000002AA930D2000-memory.dmp

Filesize
8KB

Download
memory/4400-4873-0x000002AA932B0000-0x000002AA932B2000-memory.dmp

Filesize
8KB

Download
memory/4400-4875-0x000002AA93370000-0x000002AA93372000-memory.dmp

Filesize
8KB

Download
memory/4400-4871-0x000002AA930F0000-0x000002AA930F2000-memory.dmp

Filesize
8KB

Download