Analysis

  • max time kernel
    113s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-08-2024 15:55

General

  • Target

    https://github.com/ThreatLabz/ransomware_notes/tree/main

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\ransomware_notes-main.zip

Family

avaddon

Ransom Note
PK �����N�X������������� �ransomware_notes-main/UT��ǧfPK �����N�X������������� �ransomware_notes-main/3am/UT��ǧfPK ����N�X���@��Z ��+� �ransomware_notes-main/3am/RECOVER-FILES.txtUT��ǧf�U�n�6��+&1�z �>���Cўz���聖(�k�Ԓ����w��d9�� aX�4���7C�MKp��o�e��b��% ������Q�X�B��9�F"�N�01��]5�1B�hq�f��'��h֖��y�k���m�R�Ɯ<e˹<}]�G�7rg��3����X�)�s����+!V���> ��?��Z�~���p���� �o�<U8M�����,t�La�� "�G���Y# �f|Chc�5c�#<}G`���@��F���G(Qs'�f�ڰ��\e @PΊǵyA2E����Β\�|I�`��v����m�+�����[����C���̚��H�j^�͝�k>]��t�b�ƃc��&����P:0����+��9 �������_����X���iC��M��r�,�� �����Ӕ��:"�V�/��f�}�f����{pΓ^*c���G��=|�+��Q�jh�u�C�A�S+�ߍ��ujmT��U T^�.��-}�FUq�������7��ޝ�:zg�0�V�<mey�����m�V��"���B��We�X��|�:]�"��*vނ|A߸Vy��To�&:p^ﴕB�Q��81��)ʫʬd���a���L '�s���Q!�dE�XD{�n�NM��u!��6:�D�8�!�o�\�.��M�l�R�K��z �̝�������2f��P�6� PN��DdMN8d� ���:m�3��� R�ZjO2�'ލ�0 �e���8P{���ƕh�U����-�ҖU��PD ��Sp䰶���Ԉ��+8��h0�C+}�x� wK���a�L���:tʖ���+��`�P8Z�zU�`���TKU��p���G2v��al�w}��킶*ɾ�zO�M)��5vh� :$���H��)r��"��a�li�����4Ԡ�ԕ������4XX-8�Ơ���6 �l3g�O�9�(�觤.��)���'���Q���p"k��Q4X������?o�;埋}���f�H]6믏���O�ɘ��ҷ��C��_�O!"�w۝�����:}���ب�8޸�ʒ�T�\��n�-�PK �����N�X������������� �ransomware_notes-main/8base/UT��ǧfPK ����N�X>M=�����*� �ransomware_notes-main/8base/8base_note.txtUT��ǧf�X]o�6���ޭbM��E���n#̵�ZJ�\�ms�H��캿~��$�ɺ�����E>���G#� ��_�B(w���{ъ�uŸ��I�fn#-+��Xw¤�5W��{��=�z�0%�N�{&��p�L�� [m�eK!KuQ]H+���wS#�Ly�2�8�au.���5+� � *5�҉���د=��%��c\eL�|OQ@,(6)W,� Aq)�S�*�������� Vp����+ �ڳ\[ �t�V�O����{3%�b�t�}��q�|����[QJ���"�����pi�.�p����?�n����-�F�j��_�NK��6{��%"k� v��J����bo⭐덣S^6������%�c�a6��n��G�,N�U2����e4���W��.x�ƣ(�e��8f�)������B��>Ab�=e\V�-]Q��"|~�TWy�F����ا>����Rz��L�¦��d��X�,J��\�"`�g��&&���h1��Er��ه�6\����}Be��-��I���Y�r;���P�<��-�?��=x�zD@;0�|,���3_�$�����l1����?����R��m' c���g����޵e� ��K]9{'l��LS,�G��40�] �z����>� ���埛�9���N6�}> �a�]f|��(��7��St��얍�U_̮���n9�K+�d���^�1�V # A��- `����2��a�J�G?��o(#�GH_oH�b��>�Vd�q��)]��� d����7� �K#�ș���a���1 2�[�r����� f����� ���&u���5��8��3TH광�M���N�ZO��Jԕ�M6| �s��=*n�r�3ă�M�慮�����d�=��Z�6�;����T�UIa����}/ @�g(�P.(��>�s�0]l�Y��9�I�����9�܄��1`/ ��uN��q2'��/��fb��CN��"M�� �� i m ���������.nmW������������U*��e�c��h,�j�eJN�4�<ybq�iEU+\��4���T#~��T8EY�*��*C��n'a����UIy��U}�J����� (�g,��bM�8a��* � ��봫]�Ʒ-��.��׽���Q�ݐz�T�;��A��JQ�Cu��(D���y��E���G����}��{us�$ �o!�k#�W��LЄ$�;O]�˯�3 N�����-�J�� ���m��Ԃ^ �w����E}N@�s%n�ǮnD^����O��a!�F�k���M-Yp�:ɻ���W��%7�%�爗q��h*P���g�Q�td!�F �� �~y�l>���c��*���q�wʜ��)���l�4�tmE�y8ڣyBV˶- ��XOH��Ԩő�)Ɗ��FQ�셑Ď���e*��B�[�[!�`R�Di��J~="�cVx���C�݋�<��Qy=.�o�⮣&���9�אt���).fmE�F�O�^]L?�qYek�|�����҈d�ߕλ������c�J�Q4�xh�F�N*4#�tX�%S�Dn�+�q!x�!&�kj�-�!{C�����c! $���(�Ok�3��ـ=�j�� Qn�3�p7�TN׵(<����jQ!!?��:�E%�CV�K��a �6�F���<�s��9��{5n��d����[�����Gۯ$����e�b_�ͱ��ZY���'t�7���y.%5�����a�G���4 �(Zzs@52�װT�g�Y�A��li�i?�@��T���QS��- ;�4 �^8 C踻V"�?+R�%z�V����O[)v�x�^�g�ap���.��c_%5,�L�ge �� F��y>�S���v��j� �n�X��gI��M ����]�o� �<�uL%���ᩝ�H���c{�����Jc\�)da]F�(���.P���-���Zϐ�,����APR��tdG,���)��,^ ��-G�i��~��6��]���G�e Ḃ��yk��g��'���1I�N�t:<:�4�͜��g�;����PK ����N�X`.(+z��3��� �ransomware_notes-main/LICENSEUT��ǧf]R[o�0~��8�S+E��ǽ��k��1e��$�x 1��P��wN��: )��|�C!5䮵c�����:�C��}���OO�3�f��~�&�f����NG��#����������Oւ�Cۛ�`��� ';\��h���h���d�&�}����p&�:�x���|�c4���n��co᮹m�=�$�5s#P��{�0�'�Fnl�sG�ڃ;�������HgG߹=}�l�t� .� t��w���@�9̄||�; ꞽ~��gH�����U.�?~v�۟�)���y�lf�e�H��a�����s�(|cLc���o;{��x��^%�NW��Bo�v��b��;ч��wf���f��m>"�J@S-��+��ZU/2���w l�^Uk 8�x��P-��[�.�,��V�i�RLu.�d���L�ϰ������,�FP]ޠ�h�*]��/d.�6aK�K�\V 8�\i��s��^��j�g[�r��E�ԏȊ5/��f����_�zE� �ꭒ�+ �*���E.�Th*͹,�x��żU!�b4vU����q��ZV%�H�R+|&�R��ՍlD\ɆY��Hʼn� �{���P���"8B�u#�!<G�������#� PK ����N�X�"�\��������� �ransomware_notes-main/README.mdUT��ǧfE�1 �@ ���l�N��� ��!=R���H�z�_��*� ���������Q�l�ε!*�C��y�<��F�<)�f�����^��kR�r�RV8C1�N��I�S��v�c�^�Ե���<�?8wN�l�_�9W�zL�jW��J~�h�����PK �����N�X������������"� �ransomware_notes-main/abysslocker/UT��ǧfPK ����N�X)�$���?��2� �ransomware_notes-main/abysslocker/WhatHappened.txtUT��ǧfmUMo�F ��W�V,�:�|�@n�=( ��XE#��&�(�+�������#E�5b8�H>�����d"S��>U��a��=�HuF�g����Q�S�1qC�74�Sc���U̞$��H���|��Bh��$Ԇ����}�@_��x��X�������2K�᠎��Q+�!���5��XOc�����n���I6�{���`B��b%+��fj�7����� %�K�;��().�Kd���3ԃo!�qBC����.��i�Ђ]�Z@�����;!~�F*�m��k�Gu-F�)��/�` ]�|���Hm ���m�,�=e% eoZ�/yI=MֹB�C�Z��R%�\�mI�˅�R��� �~�{�ϩ���������F�G���u�����~��g �B�=.d/�C[s>l�_r%������yso��.7�Ҥ�}b�,j��#S����cNO3�����6­���R��m^�LEuF� ��U��֪������G�i4Q�wnT�G3#��\���� !��^�fZ��毈�� �a ��CN S� �1�,�~Ã%�?���X#ҿ�!n�ް��Y80�e v��,6�2aD��rlM���a�y\ �:�jM�T|�2���'�'l��&��*�>���1L�S*:��F{����͏ԧ4����4M� ���u:������E/�-�(�T�~�Vu����eaKf$~yuu�����7�����.��qJS����o����JN�����پ��<���!ގ��v��sV���z�ئ��$�:b��Z����ʁ>/��H>����.��l�����:n�� ����?ez��N�S�6�`q�1˟�(gu��7�4����/[푋4_�Ũ*ǃ�:�PL5/2�}�啴l)n�G��;/���5��� ���ַ��ҝSy�v����� ;�N���PK ����N�X�������� ��M� �ransomware_notes-main/abysslocker/[victim]-[encrypted_file].README_TO_RESTOREUT��ǧf�V�n�F�/��K.�je+�H��$H$H,D��ds9Zr��.͜��k>�_��R�+���GuU�ܒ��Ljȼ*�͏\�(��.צ\S���m�q�ض56�T�hF2=��C�1g����<Sr�[?�w���n%`e���[��il4�7��䗍������4��<p<��;��x�����<�� õ��`Ne�u�,�C��@1q@�b�<o� S�Г�an�%�0��uX�q-��\x�5���C���d����j�ȑC[I; ���!� ݒݙ:p��-�����$�4��0�n#8|����luk}��,�vH �Em�K��F�C�)R��Ⴙ�B���im�!'�o<'��d����<�-=�s���X4d+[6���{�Yt��@KI�:?�y�� 1���O>&��1���룈B��2��o�slLa(� �h�۠����ZI^�O���b�h�J�eCm�O�"S ��;}��@V_���q #��JKw~��� �1:mu��.rGR�;n� ��=5.T�R��:�yce�(�����oї��� O�y4@�^��n�]�J!Be;�%e�RRǵ���]^�yk�~u����rc~� �QJ>�x�*��`� ���)�A��I��+��ż�)�PRJ��R���dQ=�>=�h�����0$��Y�@�o��atB?FE�y"�<8X�̼ ����m�Ar]+=��� N∨t��"/A�������;48c��([G��ZOPrhtT9��q* �J�R�Es�p�T�1'���<���xZ�B��=�:�� ������>����̎�� !5��I�����Q�@�*����`.T�剤T�˧��a���d �������Cb �_�*2�*��+%�{X���%������/u}��<��5h�b�6��(��v���c:�+��(U��e���o�=&4�0=���ub\`���T�Y��D�;X�N�ʖ#�� ��;�:�9�_���6�Zx�����m�����F�ȅu���f�����=�`s$:�Y�Φ�;���1ľ|a`�aF��"��T�E7AV���ɖ�$Ϟ��1l ����ʝ�'V1Δ�x�SC8�X:�Lsa��EK{�V�b��S�-�- ���/�_X!݉�ؔ�����Z����\<��J6��� R�����<�M�}�ᨯm�y{���x�-��H7P���#z�%�)��;�-���.siR�����8�����P����BÊpq�%n>���� ���\${#��H��������~(G�mӹ��O_ߏ�鯩����],�^�����~���L�/�ч�ڰG��?�w��y�P8,/@[�|-<x�2�L�8�p�X� ��y�-� -���; ޷�p�7 �C&W��ɛ�bqU�F������L��G��{v��./��t��Ř�u`�bi�����H�0r�?�s�n�,��� 0K�@%�𫫧7�����W]��ow�y�J�5P6�՗���j����PK �����N�X������������� �ransomware_notes-main/akira/UT��ǧfPK ����N�X�T"o��� ��,� �ransomware_notes-main/akira/akira_readme.txtUT��ǧfeV]o�6|�����E�Cω �-E�h���(�@I+�9���q:��wv)�]��A-ggf���Q]0��X�~� _��@A̓W��JRڵ�׉�L��LT��WXH���* �8������2�(8mq�S�M���w�X��I���u��E��&��|Ӣn�pY׺��)�ku0!em+5 K4 �_+������ؙԨ���U�3�f�*��7��;��ڍ���*T�ݠ��ޓSZ��4)=����0���T��VS0��m�5a���n�J0;�u~V��*�=�$]1C�t�Bq�H.���J�%�=Py����ll L�w�K�-��}���B�F!RϺ�,ʵz�[�s%���o�̖4t*⮡�Q���=#�� �����]��Ǎ����:�I��QV��E^�^�����,bF�|*RL�b� ٸ��8�����K�]xiK��XH����������QǪ�ǝq T(��R�n�B<3�6���oi�e6��;S����}����� (�0CenV�}6-� x��S�903��F_�6��g&|.�;�=Ɓ-��@�X*Z ���!�扱���F��~� "Z���>T����W��Ǐ<�)Pk� S�(�`AA�� 0g6��G3j��z@��������>��B���X8���GH�� �Q�F�@��Q�P>e���5�#��m��H�`�<�Q� |���2�P9D���*��� :#>���2��u4,��u�pN>�?,O �ҍh�J��v�ϱ��C:�<�~#2u%eg���e�ىU�٨Gt���$&!��87J���Ȯ�L��z`ѐ����n!}/�^I� ���&���+�)w�6��SD�����ҹ5��s�X�u"�ɼ�;d�(�^L��K_�I���$q�����%�Ξ$0B���5�����`��<Y� _&� �'JʞW|>�l./]W�y\kYbz{I�#Њ�R�r���m�GH��D=q��q"�yZ}w � �2\�a?�=_3�1�d&v�P��3��@��0�-�PB��2?S�����%�8 PsHi���[@��y��wO}{�����.��;w���[��o�nﭝ��}�y����u��n=�޾�+#�HnȽd�W2����46r�ve���^INIZ��l�=Or�����#����zz$�q��s\������C���Q�$� N6�^����H��K�� ����~f���� �帅 ��=��&��������琐Db�� a�y�@c@������o[D{{{Jp�ThC���Su�||~ڵ1<�p�����u��}�ai�4���H�۝���v�BUD�_q-�^F��3ӿŏl"����_��I��c��=e�Q'7C%+,���!�ׯ�PK �����N�X������������� �ransomware_notes-main/ako/UT��ǧfPK ����N�Xq؈� ��|��(� �ransomware_notes-main/ako/ako-readme.txtUT��ǧf�T_o�0���p}c�� D�� ��&�A]`���䚘ƾ�v2��9;]��y����ߝ ���nDE%��G~e8XSm@�k�l�;�QCI���p0��� �������B�ٻ��ZO��%�c�(�jǿUA���p"-�� HU�qB�� � �NM[9�BYp���?j+I���������Ӟ�t[W�-DF �TI�QZ�a���v����!��ƕ0�K�xj%Z֡D�W�%�M�1R�0���!�Q,(�F�A:h$ǐ`�e�LJ�NP[�b�Z;Yz;m����$�%f�����X���N�|�t X�&-8I�͐��F��� ��Ŗ�"� �\�KN�[Ӊ�zj�b�����Ay_ ��C����܄9�������G'��޸��s� ��R��C�jҋ/?��#�^�<E>�`W�0x�pMA�?�/<��Ʒ;��u�`��1�9��+���Ky��� w@=-��-8���0�~���

Signatures

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/ThreatLabz/ransomware_notes/tree/main
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff889ca46f8,0x7ff889ca4708,0x7ff889ca4718
      2⤵
        PID:3520
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
        2⤵
          PID:3076
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:116
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
          2⤵
            PID:3672
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:4484
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:3084
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
                2⤵
                  PID:3976
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3716
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
                  2⤵
                    PID:3644
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                    2⤵
                      PID:4416
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
                      2⤵
                        PID:1884
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                        2⤵
                          PID:1812
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5492 /prefetch:8
                          2⤵
                            PID:2292
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
                            2⤵
                              PID:112
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2808
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1
                              2⤵
                                PID:4972
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2228,16194915837431233586,6280862420720269569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4696 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3728
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2900
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:312
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:2760
                                  • C:\Windows\system32\NOTEPAD.EXE
                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_ransomware_notes-main.zip\ransomware_notes-main\8base\8base_note.txt
                                    1⤵
                                      PID:4536

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\575ae8e2-f9d1-4a66-826f-d310ba060491.tmp

                                      Filesize

                                      11KB

                                      MD5

                                      51c9b85e6b678c69dfd7c3c45163564b

                                      SHA1

                                      ac33bb14fd9c79a8ff4fdbe5b1e2c391fa5d2c87

                                      SHA256

                                      661291b96e3d3f090545161cbc31384c61445526f398a07a86bdbfb99e955f42

                                      SHA512

                                      115ac90cf2de8d981b3b04b956c08a35e7714ac2126ff743e5d7a59d6aa7c0fe131a781b94996893a06cf2abe1b6321accdc6ac4c9bdb30b32f881ce03044c1c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      ff63763eedb406987ced076e36ec9acf

                                      SHA1

                                      16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

                                      SHA256

                                      8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

                                      SHA512

                                      ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      2783c40400a8912a79cfd383da731086

                                      SHA1

                                      001a131fe399c30973089e18358818090ca81789

                                      SHA256

                                      331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

                                      SHA512

                                      b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47441f8e-e096-41f9-8385-5bab3eddafc9.tmp

                                      Filesize

                                      6KB

                                      MD5

                                      5f488556074e49ae9e8425f591649707

                                      SHA1

                                      88467b501a0660fccded583f7796a1eba5852282

                                      SHA256

                                      3655f3596279eca97331b29e8b1391596fd2f199c22a1d7dbd1d05b313958649

                                      SHA512

                                      8dc657d9c5529ce6542eb53b8b7bfbedca16c1a84e9d97abf00bea417accfe56d733737f3720e8e5025aa84f4f895cdd2bfae3d9052e927e78497266abb00e7f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      2KB

                                      MD5

                                      595cf02fafd62c5961e3a38952cdf13f

                                      SHA1

                                      2bed3d8ea9a818e26de4a9e346e6e27e62d80e6b

                                      SHA256

                                      7840124719282dfeca3c451514d9e760345260f4193ac84445946efeb630f98d

                                      SHA512

                                      ff6fb62db3b1882fab3f7e51fa53353b2c7a480e9bbbe1d284be2a7b281648b11c05c4d9ec5bdac1f73814b4a673373ba8b9fed389f0417658eede5bfb1b7e7b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      573B

                                      MD5

                                      a6d346f58cbec0a6e4015327b25f1537

                                      SHA1

                                      750056e65a8b1c20b1a6051f5adcdf35821a6ac1

                                      SHA256

                                      1a715b1b5b62ef83ca8c62a18eddb3b5b6b738be2c654ab7a38cf22fdc8bea56

                                      SHA512

                                      74e563217a28cd6427739731f51ba2e35ee060c8ae6959d458d06a0416e17ffc6a49f8d0bbcb8d17cef144a45c36eb9f3b92305389ab0cfc5043f530d9f28d89

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      b5ff210a7144c1d5414dadc3ce6b1d49

                                      SHA1

                                      b8be1293a6ad8a62b48ad4983351f48188d0fb66

                                      SHA256

                                      f7ca18b44755861cda4b6ed7ae2fb6762b63524d9cf39c4c27db425dd9838c04

                                      SHA512

                                      896e5e253623f87bffea6b24a06b7d522f9f6621e98738e9da986dec0b4ceb8d32339be524e4f7c81f202352b152f5cc8c570771e42517a1f13ba541f596dd39

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      8acaff40377903e02cc9887eb4b5556f

                                      SHA1

                                      5f9ae8db08e6336f9cdfeaa072443c0424e9557a

                                      SHA256

                                      829edfc4928d18bd2da4e733f1e6548d2a027f8d63b48305d1546fd30a96f993

                                      SHA512

                                      2b959f4a3aa496f4a55118562a9b82ff9f03c87c51e556c6d5480fcc2e07b084eec5728798a2030eaee5233856a8e690548685801dfb77d83a4a4699a4f0e558

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      7de4167eccb7b1a39ae5d4f1503b2595

                                      SHA1

                                      61322d581ab011e8c5dbd678c2f4243ee9c215d1

                                      SHA256

                                      02b39de19be426c11c22d86ea3a151220426f72809e8575f5ad6579c2c280b5c

                                      SHA512

                                      44031e9231bb0587c9eb3ed9101ec3a7afed1014884f4915aa30b22f0a699115a916e9c26b905f7d80b3216bd6aeea2a24b0033001a575588cc880750706b6af

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      dc6459f915df2079b941e8c09e4323cc

                                      SHA1

                                      3c699b84e3a379b3aa8f116d586d92918054116f

                                      SHA256

                                      357782632baae9ebfa5ac09a3df16ffc82b8be1135b44e4b3cc35d803e1a92ef

                                      SHA512

                                      957449313e3e57b96f271f84c0ec72093b5e8d0e80a2d9f60cbcd9eafd5b0d6799762bf7232ae7cd85b050e76b8d9e4b0a8e6473a4cc5b44ba3219445884cb28

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      137544d897aac02f006b62a5c6b67e83

                                      SHA1

                                      e372f9f8dee27b707fc1134fe19a4cf18fa33514

                                      SHA256

                                      28e252b87c6bee4520dd70fd8010b440fc6b0abf3155004113440c9edd683eb8

                                      SHA512

                                      1ae9b86216a4fe25781eaea8664770bfc34f886d5741966d3e03a6cfaa822a867b3ed975384517dc465a15f0224bac80f6b18a60c3bd1a4230d42a5ba075c1b0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581373.TMP

                                      Filesize

                                      866B

                                      MD5

                                      a19105c80cb2160877f90dbf790c494a

                                      SHA1

                                      2f3c9de598fb556c14f674614773d09c8eff283f

                                      SHA256

                                      df03166cb443ad6c84c7a31d289cea50b5026b1947bbb89caa2521604eb0090c

                                      SHA512

                                      315b5678d8e744861b9bf71c3aac811b710fb90a269dab8a7077fef6f53b29ef5b0727888ea4e3c37d6e17ae6f67ebae8af6fa2654037cb4f3dfcaba08a8b49a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      0b26d15957541f767cd124ac5b83c003

                                      SHA1

                                      167191589d161185b1dcffa87b6dd3c0ee7f8970

                                      SHA256

                                      66fcdd65fd6b4d67555adb7932d3748dfe318f095a6ad8241d17d1fd9ede38f2

                                      SHA512

                                      f7ceac1e4c7acc37b1fa39b5d45730d942d91ba34d1393315e003ce1ba16670f1608d4f870e0d46e2a019cb2d32f9b5080670275784f3df3eef76eabfbec2504

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      23cccb13ff480fa94524ece5e6ecfb9d

                                      SHA1

                                      55231b763ec5ce793802286961d02ce4cdaaa244

                                      SHA256

                                      5fa80ec47a5ee8b647f6443b3f8db67a8f73bddfe6c999d68d91908451fe1183

                                      SHA512

                                      302e9db430e160fd36222a8234a4dc1f61fceb7f2120b807ca91e74092d4a3b8022ab0febd9548d9c6403ba22901c14024f7d1b8b547c1ff0ee45aeb93611e86

                                    • C:\Users\Admin\Downloads\ransomware_notes-main.zip

                                      Filesize

                                      744KB

                                      MD5

                                      ad0d490a06f055f226b3f9406a36db0e

                                      SHA1

                                      62180786a609e567ba02b28fb682b794bea900af

                                      SHA256

                                      f1ca8bd994b88eb52d6d0662ad13caf7ef1dd7a6aa1b0e0ceca481f947fad0de

                                      SHA512

                                      33d3cf950c414ff08a64ab9a4731789858ad1f2a5f55282353f8c80d63df9d75d9f190916443e1441fd332292768435163c2e3121d00c2caf98527e69cd0602b