locky | 90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674

Resubmissions

25-06-2024 11:46

240625-nxaffsxfme 10

25-06-2024 11:35

240625-nqbpyaxcke 10

24-06-2024 09:07

240624-k3smfaxgkq 3

Analysis

max time kernel
300s
max time network
302s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
25-06-2024 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe
Size

236KB
MD5

2fde1e85e1ead98a8c0e1ca7eda2a243
SHA1

4e195c7dc0d7bd995b81fc481dd300e966481201
SHA256

90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674
SHA512

b56a5d33fd6f99d092e5a2b7d332c0632eb4354a1c64cfb66b4a9997e5f6e0fd9d019b775705e89fe94c26b41762e11ede9dda150fc19a857ca9e2cfc05b65b2
SSDEEP

6144:FXtIh3WC7HpTBJNDrSfdH/qiNMxsJSoR:FXtsPpTrhgdHChxsJN

Score

10^/10

locky ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\International\Geo\Nation	90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_HELP_instructions.bmp"	90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

Drops file in Windows directory 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exeWINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies Control Panel 2 IoCs

evasion

Processes:

90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\WallpaperStyle = "0"	90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\TileWallpaper = "0"	90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ae3e97c8f5c6da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "426129716"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "425478266"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0f871bb6f5c6da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 27cc4abaf5c6da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "426081130"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{0A186305-99FB-4EAB-8224-142FD6C0803B} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5a6387b5f5c6da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 80fd93c8f5c6da01	MicrosoftEdge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

5068 WINWORD.EXE
5068 WINWORD.EXE
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

688 MicrosoftEdgeCP.exe
688 MicrosoftEdgeCP.exe
688 MicrosoftEdgeCP.exe

pid	process
688	MicrosoftEdgeCP.exe
688	MicrosoftEdgeCP.exe
688	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

firefox.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	212	firefox.exe
Token: SeDebugPrivilege	212	firefox.exe
Token: SeDebugPrivilege	296	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	296	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	296	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	296	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5100	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	212	firefox.exe
Token: SeDebugPrivilege	212	firefox.exe
Token: SeDebugPrivilege	212	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

firefox.exe

pid process

212 firefox.exe
212 firefox.exe
212 firefox.exe
212 firefox.exe
212 firefox.exe
212 firefox.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

firefox.exe

pid process

212 firefox.exe
212 firefox.exe
212 firefox.exe
212 firefox.exe
212 firefox.exe

pid	process
212	firefox.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe

pid	process
212	firefox.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe
212	firefox.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

WINWORD.EXEfirefox.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid	process
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
5068	WINWORD.EXE
212	firefox.exe
2688	MicrosoftEdge.exe
688	MicrosoftEdgeCP.exe
296	MicrosoftEdgeCP.exe
688	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 212	2104	firefox.exe	firefox.exe
PID 212 wrote to memory of 192	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 192	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4144	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4008	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4008	212	firefox.exe	firefox.exe
PID 212 wrote to memory of 4008	212	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe
"C:\Users\Admin\AppData\Local\Temp\90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe"
1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Modifies Control Panel
PID:4368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\90a7f7065d8dd058ab7049cd3f0c8788ae8950a8d2366a372571dbb800590674.exe"
2⤵
PID:3380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:696

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:212

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.0.951136640\644503053" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1496 -prefsLen 20935 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ac8e2c2-a67b-4de5-b3f9-426e8eb5600e} 212 "\\.\pipe\gecko-crash-server-pipe.212" 1792 23468d04458 gpu
3⤵
PID:192

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.1.424257929\22278801" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 21016 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {576b5cc3-cc9c-4592-a0b1-16a63572bfe1} 212 "\\.\pipe\gecko-crash-server-pipe.212" 2148 234679fb058 socket
3⤵
PID:4144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.2.1099902881\999332257" -childID 1 -isForBrowser -prefsHandle 2988 -prefMapHandle 2984 -prefsLen 21119 -prefMapSize 233414 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d5211d2-1ac2-4f0a-8dbd-de18ec9fad9e} 212 "\\.\pipe\gecko-crash-server-pipe.212" 2996 23467a59158 tab
3⤵
PID:4008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.3.347651317\725885863" -childID 2 -isForBrowser -prefsHandle 3444 -prefMapHandle 3440 -prefsLen 26212 -prefMapSize 233414 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c390f24d-fff1-4636-9a8c-f09163f2f6eb} 212 "\\.\pipe\gecko-crash-server-pipe.212" 3488 2345ca67858 tab
3⤵
PID:3028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.4.2075617772\370280494" -childID 3 -isForBrowser -prefsHandle 4128 -prefMapHandle 4060 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd273b37-df49-4d41-a787-e47691171155} 212 "\\.\pipe\gecko-crash-server-pipe.212" 4164 2346d036f58 tab
3⤵
PID:3004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.5.401690551\1751468418" -childID 4 -isForBrowser -prefsHandle 5052 -prefMapHandle 5024 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3789bff1-5501-4092-91c7-bd1ed04cfc26} 212 "\\.\pipe\gecko-crash-server-pipe.212" 4972 2346e05c758 tab
3⤵
PID:388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.6.373658163\1287476048" -childID 5 -isForBrowser -prefsHandle 5160 -prefMapHandle 5164 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b2cc722-cb5c-4b48-b0d6-28697344837b} 212 "\\.\pipe\gecko-crash-server-pipe.212" 5152 2346e05e558 tab
3⤵
PID:4284

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.7.1607005351\994873627" -childID 6 -isForBrowser -prefsHandle 5348 -prefMapHandle 5352 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d16dcdd4-a7ba-4100-9c8e-79c6110a89c8} 212 "\\.\pipe\gecko-crash-server-pipe.212" 5428 2346e05c458 tab
3⤵
PID:1480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="212.8.802995096\286237787" -childID 7 -isForBrowser -prefsHandle 5164 -prefMapHandle 5240 -prefsLen 26509 -prefMapSize 233414 -jsInitHandle 1088 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b052b380-92a0-43c8-b7f6-f1f08fff7e8c} 212 "\\.\pipe\gecko-crash-server-pipe.212" 5612 2346a546158 tab
3⤵
PID:1100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2688

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:688

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:296

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5312

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BU0KRETY\edgecompatviewlist[1].xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp
Filesize
27KB

MD5
45a10ffca94ec4205f6c1cf6d6c41e15

SHA1
18eb676439b9f2ff902c0b8842356e007a70c7fb

SHA256
0602366dd12c245a8e0935b9d4d6b2728fd811bfc0b53d222f680cef031fb42d

SHA512
43c7274702b80421fae8153ba2fb45549608ca95ae5ece16d6e793c4688e32869c264352aa4284ba77107a55f60e641fe73d518dae59060e51a0eed19804925e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UB8QGJZ8\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Filesize
222B

MD5
d7b64993f7dedb792ef00f99ab4fb3d5

SHA1
2ad6efb43fe5e6de69b6e4313833ad8b799b3bd4

SHA256
e71bb4c4d5d9969a3a958ff9dbd3f878830e1984706637a0a51d63f2e208667c

SHA512
28c666bf91f8caad1f63ea997e608c053f1bc223683953a1240fe417e04e5304e3d1768d83d0ecf873034c87f881d87a2d87272ba5324a9613523e1dda86151e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
45e23feee1420cb74f7ce8b1a5b1f51d

SHA1
486e37076a05681e857070e1d9f6b2361899a4e9

SHA256
443fc0996fa848f37baba2e221f763c9cf9c0b20a3ac7c72030026ac4e82bb76

SHA512
f7934560b224039152f246800c5447e5a4698c263e80a420ced70feeb531bad7b6a068174ebe6d5fdbca4989b67fd07f15e83d12670fadebe4ab00373ac44403

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\67f19007-c901-4d55-83bc-8658299cc8a8
Filesize
669B

MD5
43415a2805e304bba90319b5485fcdc2

SHA1
d54d01104090e84d813adc1922ff577ef407398e

SHA256
8aacf5b962f8291fed84c09e14e01a61b5de5adf91b1d23e47dad4410db9e08e

SHA512
e4d6c3458ade34c74b61e68b3db13df605a8a1bfedc3ab7a35aeca564c60c295fd0b73579dcb0e2ddc813732c961059440000ba54c88dd682f52e648f6090bcf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\6c9df291-6aaa-4fae-adf8-2b2ab7281b33
Filesize
10KB

MD5
c441ee84bda7899615c8d15b82639dfa

SHA1
7b5f5f9ec31ae0cdcff2f6a821404c58ea03b66c

SHA256
45caec207f3a956959dfaa0e4c3b5f4b300ee987036b2139e4df5ec768b444fa

SHA512
fedf7d6d5633298e1ed564c479abebbc25ddf4805cc9d64282952956aaeb2870562869528ba0cdffca48d78795fc57a5c2a220700a0e0b035b3c0e4ffe30110e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
7KB

MD5
605fe6654a1a6c8e7f6fb01703430feb

SHA1
7c114310a96b623fb6186af7ab7fc89697215bdf

SHA256
0e4b704a5eb741917042dff9359dc540c6a63750f3e442008aa948c2f38397d0

SHA512
9bbb1638dd97dd66682538c631c27f6f21a1f8a98b7ffd211ab0c80e2e176241b99685c09d6714caab8c0bd86e48330d4bfb5e1de6a3630f3af8ed319c66c207

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
6KB

MD5
88e73566540eec3520a43063ec27d235

SHA1
1ee5a5a9ab2daa25b7be37d21efe56bccfc4c83d

SHA256
c3013057d265b7793efc8a1b314c3b381739607439e2e7226d4fc3536c54b3ce

SHA512
a1ccb879526492d480b0d58519cda76af21f05cd5d486dbc6e097fb1e5375e03ab727bae1259d3f74229a09b880736f954c1a1e73d88e2a7fc5ba8c37c41b5dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
7KB

MD5
8aee5ea7bbd794daadbf508f24e68a8e

SHA1
82ffce75e9663a73c383ecf0aea248cc2088eab3

SHA256
8dfdb59cbe91dec69ca44ba836a6b0170ada58d7e39dd7fede142132e15e4f1a

SHA512
979445efc0f8b74f4e7fc1f7a3c0f20091d98897cdd0584d72410ea0687f96d8a342c1ef7442ef6cef4cf9f5ef4bb856377bc6047c9ce7b53508920a72be34db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js
Filesize
6KB

MD5
5deafbbaf869ea43f2ec9c8d6289f8b0

SHA1
b58bf80037acc7673cc261015b265bc13f0371a4

SHA256
5c2453e0a749b98313cce2da7b491993523d5672cecf34d50d4e66c481c1af49

SHA512
24e00bb4b6f09b4cfdc53e42daebdf3f4acb02737387bab20d8fafb82dd648d679304f5c2e233b99a9ac705ca6d9540f6edf419feeac91abf71270f1044e9ab4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
a87ef09761c59c1ed58552728053a488

SHA1
cb4f5e6d39dc7b7b28d83f04ccbbbd4dc768956b

SHA256
f2d5986c3cdb2e46934a30ff4a52888cd2de68652eb0266d7e3c4e50f68e8e01

SHA512
a3da367627888a5f69172d2d6555b56bbbaf5b44c9cf921855182b5a6134eddd55ff643ea37dd48e79333153de8fbc9c37d9ed75588ecb8a2100ad0f462a2c37

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
62c8deb197834f2d3e07ffb3dfb088e9

SHA1
12db87cf9d2e0a50c7d94ad66be70c7491b8c2d9

SHA256
cd82ff3da7d96536e47d85183515bc03d4d0f69f2c0bb8ea62888c094f6d9b80

SHA512
5b11e87dbc1cc491feb1e93fac42bb396a127e35406894e1aba03f119811c3ed291e269859f814e29ad644e29f024e1567710d267a7e5b296ec1a5593320a359

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
d2fa85f05119b91b4bb7478e3c7a9734

SHA1
6c298b1168bbad01393fe336af4f95a0d11fd639

SHA256
38b8b4d73f4aec4fcf602463b771f220874cda2c4fecf0ec007e525eb4d73c71

SHA512
2c1894238bfde48eb29a94aee29df3a7f9d93e51d86a1cbae7a5f5c8c8a0e946c2c2bd027b61a6875384d394d1531867b128059a4af5f537f92b93a8949b162c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
de9ccbc0cc8f29924c609b8e1e119963

SHA1
b67396b32abf0118892f6401059181e6497e2cb4

SHA256
6777bb08ba1f87cc2389a285e484445d014282df83a21f69d3978533c7daa17d

SHA512
f7a5888fd3eb5883e1c72e5ce611b7268730517c4ec673098c7ebb14664e4a4f24951e8731328414046dcfb7bc6f273f4a6361ce78d4258bbdddd277024619d0

Download Submit
C:\Users\Admin\Downloads\_4_HELP_instructions.html
Filesize
8KB

MD5
759ac073b2c0de342e0848dc96eda2f3

SHA1
c09527095a01147d1cde457a876c175904b51bd7

SHA256
0cc4747c380f3611e1d25559206cd39b9d026091e4e00cfc0c7bec31cb72d5e5

SHA512
3d36d25b220bb4cc355140516c26acbc7dd3f31494c1d031e757f6f6e210d5a11f50facb3615191e103948289453f77ac7448e023044d30a7d384b96ccc519ad

Download Submit
memory/296-1002-0x000001D87A040000-0x000001D87A140000-memory.dmp

Filesize
1024KB

Download
memory/2688-972-0x0000021F7C820000-0x0000021F7C830000-memory.dmp

Filesize
64KB

Download
memory/2688-956-0x0000021F7C720000-0x0000021F7C730000-memory.dmp

Filesize
64KB

Download
memory/2688-991-0x0000021F79CE0000-0x0000021F79CE2000-memory.dmp

Filesize
8KB

Download
memory/2688-1044-0x0000021F069E0000-0x0000021F069E1000-memory.dmp

Filesize
4KB

Download
memory/2688-1045-0x0000021F069F0000-0x0000021F069F1000-memory.dmp

Filesize
4KB

Download
memory/4368-281-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-627-0x00000000004D0000-0x00000000004F6000-memory.dmp

Filesize
152KB

Download
memory/4368-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-3-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-278-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-279-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-282-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-0-0x000000000043B000-0x000000000043D000-memory.dmp

Filesize
8KB

Download
memory/4368-280-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-993-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4368-951-0x00000000004D0000-0x00000000004F6000-memory.dmp

Filesize
152KB

Download
memory/4368-628-0x00000000004D0000-0x00000000004F6000-memory.dmp

Filesize
152KB

Download
memory/4368-626-0x00000000004D0000-0x00000000004F6000-memory.dmp

Filesize
152KB

Download
memory/5068-20-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-31-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-25-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-24-0x00007FFF02B10000-0x00007FFF02B20000-memory.dmp

Filesize
64KB

Download
memory/5068-18-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-19-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-23-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-22-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-21-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-273-0x00007FFF05660000-0x00007FFF05670000-memory.dmp

Filesize
64KB

Download
memory/5068-15-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-14-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-13-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-12-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-11-0x00007FFF05660000-0x00007FFF05670000-memory.dmp

Filesize
64KB

Download
memory/5068-29-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-30-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-27-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-8-0x00007FFF05660000-0x00007FFF05670000-memory.dmp

Filesize
64KB

Download
memory/5068-28-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-9-0x00007FFF45675000-0x00007FFF45676000-memory.dmp

Filesize
4KB

Download
memory/5068-10-0x00007FFF05660000-0x00007FFF05670000-memory.dmp

Filesize
64KB

Download
memory/5068-7-0x00007FFF05660000-0x00007FFF05670000-memory.dmp

Filesize
64KB

Download
memory/5068-26-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-32-0x00007FFF02B10000-0x00007FFF02B20000-memory.dmp

Filesize
64KB

Download
memory/5068-272-0x00007FFF05660000-0x00007FFF05670000-memory.dmp

Filesize
64KB

Download
memory/5068-275-0x00007FFF05660000-0x00007FFF05670000-memory.dmp

Filesize
64KB

Download
memory/5068-276-0x00007FFF455D0000-0x00007FFF457AB000-memory.dmp

Filesize
1.9MB

Download
memory/5068-274-0x00007FFF05660000-0x00007FFF05670000-memory.dmp

Filesize
64KB

Download
memory/5100-1012-0x000001D9F2600000-0x000001D9F2602000-memory.dmp

Filesize
8KB

Download
memory/5100-1015-0x000001D9F2630000-0x000001D9F2632000-memory.dmp

Filesize
8KB

Download
memory/5100-1017-0x000001D9F26F0000-0x000001D9F26F2000-memory.dmp

Filesize
8KB

Download
memory/5100-1019-0x000001D9F2710000-0x000001D9F2712000-memory.dmp

Filesize
8KB

Download
memory/5100-1009-0x000001D9F2140000-0x000001D9F2240000-memory.dmp

Filesize
1024KB

Download