hxxps://drive[.]google[.]com/file/d/1YE5lT994prZQl3lWdp_ficIrlR8VR0_m/view

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240729-en
resource tags

arch:x64arch:x86image:win10v2004-20240729-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2024 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1YE5lT994prZQl3lWdp_ficIrlR8VR0_m/view

Score

6^/10

defense_evasion discovery execution privilege_escalation

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
5	drive.google.com

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
3420	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4856	powershell.exe
3976	powershell.exe
4108	powershell.exe
3720	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f8033e348271af390000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f8033e340000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f8033e34000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df8033e34000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f8033e3400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
4260	timeout.exe
4136	timeout.exe
4088	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-735441492-2964205366-2526932795-1000_Classes\Local Settings	powershell.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 42407.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
3220	msedge.exe
3220	msedge.exe
1632	identity_helper.exe
1632	identity_helper.exe
3124	msedge.exe
3124	msedge.exe
3420	powershell.exe
3420	powershell.exe
3976	powershell.exe
3976	powershell.exe
4108	powershell.exe
4108	powershell.exe
3720	powershell.exe
3720	powershell.exe
4856	powershell.exe
4856	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeBackupPrivilege	944	vssvc.exe
Token: SeRestorePrivilege	944	vssvc.exe
Token: SeAuditPrivilege	944	vssvc.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeBackupPrivilege	2704	srtasks.exe
Token: SeRestorePrivilege	2704	srtasks.exe
Token: SeSecurityPrivilege	2704	srtasks.exe
Token: SeTakeOwnershipPrivilege	2704	srtasks.exe
Token: SeBackupPrivilege	2704	srtasks.exe
Token: SeRestorePrivilege	2704	srtasks.exe
Token: SeSecurityPrivilege	2704	srtasks.exe
Token: SeTakeOwnershipPrivilege	2704	srtasks.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 3244	3220	msedge.exe	82
PID 3220 wrote to memory of 3244	3220	msedge.exe	82
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2936	3220	msedge.exe	84
PID 3220 wrote to memory of 2944	3220	msedge.exe	85
PID 3220 wrote to memory of 2944	3220	msedge.exe	85
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86
PID 3220 wrote to memory of 3832	3220	msedge.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1YE5lT994prZQl3lWdp_ficIrlR8VR0_m/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9738546f8,0x7ff973854708,0x7ff973854718
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4112 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,4523808121608668668,3488245719904761035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3960

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Honored_Tweaks_1.bat"
1⤵
PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\Downloads\Honored_Tweaks_1.bat' am_admin
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3420
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Honored_Tweaks_1.bat" am_admin
    3⤵
    PID:5008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('MAKE A RESTORE POINT BEFORE DOING ANY TWEAKS, DOWNLOAD RESCOUSES EVERY TIME I UPDATE THE PACK/FIRST TIME DOING IT', 'Honored Tweaker', 'OK', [System.Windows.Forms.MessageBoxIcon]::Information);}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('USE THE TWEAKER IN FULL SCREEN', 'Honored Tweaker', 'OK', [System.Windows.Forms.MessageBoxIcon]::Information);}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4108
  - - C:\Windows\system32\reg.exe
      Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
      4⤵
      PID:3228
  - - C:\Windows\system32\reg.exe
      Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
      4⤵
      PID:4516
  - - C:\Windows\system32\reg.exe
      Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
      4⤵
      PID:1960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\', 'D:\', 'E:\', 'F:\', 'G:\'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Unrestricted -NoProfile Checkpoint-Computer -Description 'Honered Restore Point'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4856
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1304
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:4260
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:864
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4136
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:2992
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:3976
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4072
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:1528
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1492
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:1660
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3176
  - - C:\Windows\system32\timeout.exe
      timeout /t 3
      4⤵
      Delays execution with timeout.exe
      PID:4088
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" /va /f
      4⤵
      PID:4436
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Regedit" /va /f
      4⤵
      PID:1540
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites" /va /f
      4⤵
      PID:3164
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites" /va /f
      4⤵
      PID:2948
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU" /va /f
      4⤵
      PID:3992
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRULegacy" /va /f
      4⤵
      PID:2960
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List" /va /f
      4⤵
      PID:4808
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List" /va /f
      4⤵
      PID:4784
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List" /va /f
      4⤵
      PID:2932
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU" /va /f
      4⤵
      PID:3532
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU" /va /f
      4⤵
      PID:2284
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Search Assistant\ACMru" /va /f
      4⤵
      PID:1752
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /va /f
      4⤵
      PID:536
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /va /f
      4⤵
      PID:964
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU" /va /f
      4⤵
      PID:3304
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\MediaPlayer\Player\RecentFileList" /va /f
      4⤵
      PID:3988
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\Software\Microsoft\MediaPlayer\Player\RecentURLList" /va /f
      4⤵
      PID:2324
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\MediaPlayer\Player\RecentFileList" /va /f
      4⤵
      PID:4188
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\MediaPlayer\Player\RecentURLList" /va /f
      4⤵
      PID:3520
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\SOFTWARE\Microsoft\Direct3D\MostRecentApplication" /va /f
      4⤵
      PID:3860
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Direct3D\MostRecentApplication" /va /f
      4⤵
      PID:3852
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f
      4⤵
      PID:2372
  - - C:\Windows\system32\reg.exe
      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths" /va /f
      4⤵
      PID:4428

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e004722-1070-4e5c-b6ac-8ca128165ac3.tmp

Filesize
11KB

MD5
a55023b44c03f840b97651a489af79f2

SHA1
b167ef3e166852cad68901b97b6bce14372d96d7

SHA256
4ab8abf703f7369462cb507a3a20d385cfa4aca23c0db217b2f04ce2aea4d9c8

SHA512
d5fa0d033a2dccd26616bb2402ac532a7575bb52f435dac6b71d67aa69b38a8c7dc4f986c9e441330844cba99bdef204b6f6d7ba7ca8da85a621c19d7469136f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8004d5759305b326cebfa4d67dee5f25

SHA1
36b9a94959977f79dd0a14380ba0516d09f8fcaa

SHA256
21f35e2ac53a817389d7027e99018450993fc66e37f916e454bff9eed95562d7

SHA512
7afba827395c1a5438091bd2762a097f6ea098fcbf3db99f90f9bc442afee7a7841a6e0e83f9cbf017cda0e52d35da93f8efd60cec73638baea5eaf1c85b7089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
368c244e384ff4d49f8c2e7b8bea96d2

SHA1
69ce5a9daeaf1e26bba509f9569dc68b9a455c51

SHA256
6f8cb8fe96a0e80be05e02f0f504e40d20e7f5db23fd0edee0e56bcffa1059a3

SHA512
ac460f1b35bcdefa89104e26379fc5639499607be6559353665a73ee8dd41822699d767532d48cffc67c755b75042294c29e93062d4eab22ca6bcbe054108a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
0b5ad562d51469505b8fdc46ea4b533a

SHA1
134c3a8961df4241f58f57da8383b6265e8b0aaa

SHA256
9d5bee5f22c9d336afc8696ab4fc9047648889af49a10115addc99cf6662f412

SHA512
6735bc596b2018199096987983902d5b30f6cc0c5386b498063b540e1f1575195c8eb5be1555410bd67c878e7f7ba1b49eab61153db3fd43684f7b396633a750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d9a1de9220db138ec4b52bad322dd8f3

SHA1
10d21fcfd69088e7008fcc4f000bb8b959ca6069

SHA256
269df104d712b7ecfeb6404cefd2bc3770e1b97399ef7ba4248a005d8025fbd4

SHA512
fef44b00c6228eb9e3c0fb39322025718ad8604a7b5ed1f16ece3c13621671be399d08d72c2d02dfcc56068a4f8b70501e4eaf0804fb5cbb09082d33931b61ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86486c6ef365c7674071926c7b8f0f10

SHA1
ab8532f3db64135597edca8b77fdefb0b70323e0

SHA256
c1dc4983fbe478343a2bfe8474e84f8eaf1fc1577d84658d67cba021a2dcfa82

SHA512
c4304cd66c1d16a998f2f202958134f35c3e7437044107f70760fc4c09bcf6039f28a26d2de4f49dfa4d3c8557e91b0a03045d77d6f815b3875372f43c746647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1479394d7fbf1fe45a6b2c91ce258ca1

SHA1
5f96ad6d3f368f116cf0d60fbc8f007508b57b9e

SHA256
1f8042609d93577c7d2bb7af047ae416d3b6167558e440440893497f4ef589e0

SHA512
98e74c6c7bc2b4bc3e7b073e13688bcb582b1f70465fa8ecd6be71237ded4e198bc8aac34f9b1a6032677ace88bfd77ed06fe89dec0e4ecdffb7d5c09d47b1fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98a7c2d7cf678609392537131ea4df97

SHA1
1d21b5646dab21a7f10aba7b07e249d551d656f3

SHA256
5bd8143bf5f258f62a6212e21bcd6e8c94e0e17473fe110eecb800b6bb1b446c

SHA512
21a55c1463040ccd563cd04ef01e8888ee3e0ccaa41c251cd4dfb8f5eddfd9fc2abfd4586898cc7173b01649e9f994e344bad9ec7778eb18863bec1d1ebaa735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
70b41ecf4429da24e43e9534bcceaefb

SHA1
08bf4fc945c01f9dfc434097d7ae293e1f44da51

SHA256
8f3672cad1037090eb8dab170595fdd24e509c64da479157b7ceb73e8231dcca

SHA512
62322db3665556e11ab4830b81279e28de2aaa378a94b2f956e878a79f2ef38589f5569f2ad5931a178cd4b08a2a7ca39d18043ecca512c9bfb3b314b995cf86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
7ede42e5af61f101ef19de6a68869d0c

SHA1
c396c7496e049b025720409babdb77d646781649

SHA256
63157cf1d6056d84a9c37010f9f6b55b9fcfdd60fe008e46b8618c0946f5394f

SHA512
df74d41ba710d238fcb210b9ec63eafbce02cbc8a6ff94e204a4cd2b330592f6ec0ddb4c488b9b879444d8a4408b0b062f1548b786f0978cff793b7dc607376e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
224dcf4c17389871fa59fe45c7acd94a

SHA1
d02998277a18745bc5a5209d80a4d5c5077772ff

SHA256
c10c307786cba93488fb258b288490207e01024028a4340eab17f0c0b23dbb0e

SHA512
8e30a4a06f9a06dd2556ee9125e9dc9effcc1cbb3ce6ff9fabee383db8e4fdbe7f638ea71d5a42d6722748543c8f2a4399baefdd2a2cc20e531c966b29f32e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d7cc6f8bcdde0d48a769f385f6e85a01

SHA1
68b09cbf621bf0103f46d4a9a724e7ac7bc555f9

SHA256
9e53725d765b5a6a606b81f27ad74b8c8c8c5090c5ed941a4f8e66eb081907b7

SHA512
4a8bc55cb9e66208e20ac4965d69b8ed21d94d491f7e89aba1a627dcc51441bdd12be0e684356ae4d109fc3f5a41c02eca8b6b27c16cf97758c1b7e2ea0c2826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9ca98d64a5f0b68432ab50785fb17c69

SHA1
eb23e0efeefebdf85203bcdfd9dd8d85f2ff675a

SHA256
1400968170cf5cb965ec25374f3933e7e95881081dbb3ee192420c389cc9247c

SHA512
5ad859fb2aa3291cc99f29c2af66920b8d10a95c3e3d7981e48589287d968333efc4ca7b83ddff52220794aeedca6a719dbda2e95dfda6417f59182744b0c262

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_snii5gla.akz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 42407.crdownload

Filesize
100KB

MD5
002f84ea9760e4fdb4a61d515a578566

SHA1
cf2b6c06302032ea79685f4bdab974e6a3ca947f

SHA256
5b3a0e9c29be3bd7c2f4051722be188e87138e418b454d99282e03e22c98b75f

SHA512
acb204395fe9210363f89e110d8c9544b8da30d892677c76a181c62968948a63a77e7ef82cc6f46f12840a499ab490543c4ef7cedf1cac3affa3e68038c60c4d

Download Submit
memory/3420-226-0x0000021776570000-0x0000021776592000-memory.dmp

Filesize
136KB

Download