70b68ac1477e49a4342383c6eff1056f6a18ff0727aa20630e9e7bc8701011f1

Resubmissions

05-08-2024 17:14

240805-vrzlqawfqe 8

05-08-2024 17:12

05-08-2024 17:11

05-08-2024 17:08

05-08-2024 17:04

05-08-2024 17:01

Analysis

max time kernel
164s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 17:14

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

sample
Size

7KB
MD5

4b320922990cfb723b67147a7a97d345
SHA1

5d134dcee4aaeadbea36761640434a45c708b081
SHA256

70b68ac1477e49a4342383c6eff1056f6a18ff0727aa20630e9e7bc8701011f1
SHA512

b21548566a22c31ca19de100264d1c2cefe0c8d8a0361f325194e6514453813376da301b4bb71c9ac0e4c3c1c84589276af79e7f48dd4e6d8ae553590ac823d3
SSDEEP

96:SDQ1jWHRUV/okJOlIDNSW0S9I3gtYEMLX+jZEBZu:oQHokYlIVYFSjZmu

Score

8^/10

discovery evasion ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\A:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\Z:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
135	raw.githubusercontent.com
136	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\Wallpaper	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4564	2356	WerFault.exe	121
2112	868	WerFault.exe	125
4012	3876	WerFault.exe	128
3164	3936	WerFault.exe	131

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3784	taskkill.exe
1932	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	[email protected]
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{FD4C5F94-2C21-4AB0-B1B0-3FDB9D2E0E22}	[email protected]

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4092	msedge.exe
4092	msedge.exe
1044	identity_helper.exe
1044	identity_helper.exe
536	msedge.exe
536	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	taskkill.exe
Token: SeShutdownPrivilege	4908	[email protected]
Token: SeCreatePagefilePrivilege	4908	[email protected]
Token: SeDebugPrivilege	1932	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2884	WMIC.exe
Token: SeSecurityPrivilege	2884	WMIC.exe
Token: SeTakeOwnershipPrivilege	2884	WMIC.exe
Token: SeLoadDriverPrivilege	2884	WMIC.exe
Token: SeSystemProfilePrivilege	2884	WMIC.exe
Token: SeSystemtimePrivilege	2884	WMIC.exe
Token: SeProfSingleProcessPrivilege	2884	WMIC.exe
Token: SeIncBasePriorityPrivilege	2884	WMIC.exe
Token: SeCreatePagefilePrivilege	2884	WMIC.exe
Token: SeBackupPrivilege	2884	WMIC.exe
Token: SeRestorePrivilege	2884	WMIC.exe
Token: SeShutdownPrivilege	2884	WMIC.exe
Token: SeDebugPrivilege	2884	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2884	WMIC.exe
Token: SeRemoteShutdownPrivilege	2884	WMIC.exe
Token: SeUndockPrivilege	2884	WMIC.exe
Token: SeManageVolumePrivilege	2884	WMIC.exe
Token: 33	2884	WMIC.exe
Token: 34	2884	WMIC.exe
Token: 35	2884	WMIC.exe
Token: 36	2884	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2884	WMIC.exe
Token: SeSecurityPrivilege	2884	WMIC.exe
Token: SeTakeOwnershipPrivilege	2884	WMIC.exe
Token: SeLoadDriverPrivilege	2884	WMIC.exe
Token: SeSystemProfilePrivilege	2884	WMIC.exe
Token: SeSystemtimePrivilege	2884	WMIC.exe
Token: SeProfSingleProcessPrivilege	2884	WMIC.exe
Token: SeIncBasePriorityPrivilege	2884	WMIC.exe
Token: SeCreatePagefilePrivilege	2884	WMIC.exe
Token: SeBackupPrivilege	2884	WMIC.exe
Token: SeRestorePrivilege	2884	WMIC.exe
Token: SeShutdownPrivilege	2884	WMIC.exe
Token: SeDebugPrivilege	2884	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2884	WMIC.exe
Token: SeRemoteShutdownPrivilege	2884	WMIC.exe
Token: SeUndockPrivilege	2884	WMIC.exe
Token: SeManageVolumePrivilege	2884	WMIC.exe
Token: 33	2884	WMIC.exe
Token: 34	2884	WMIC.exe
Token: 35	2884	WMIC.exe
Token: 36	2884	WMIC.exe
Token: SeShutdownPrivilege	4908	[email protected]
Token: SeCreatePagefilePrivilege	4908	[email protected]
Token: SeIncreaseQuotaPrivilege	4492	WMIC.exe
Token: SeSecurityPrivilege	4492	WMIC.exe
Token: SeTakeOwnershipPrivilege	4492	WMIC.exe
Token: SeLoadDriverPrivilege	4492	WMIC.exe
Token: SeSystemProfilePrivilege	4492	WMIC.exe
Token: SeSystemtimePrivilege	4492	WMIC.exe
Token: SeProfSingleProcessPrivilege	4492	WMIC.exe
Token: SeIncBasePriorityPrivilege	4492	WMIC.exe
Token: SeCreatePagefilePrivilege	4492	WMIC.exe
Token: SeBackupPrivilege	4492	WMIC.exe
Token: SeRestorePrivilege	4492	WMIC.exe
Token: SeShutdownPrivilege	4492	WMIC.exe
Token: SeDebugPrivilege	4492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4492	WMIC.exe
Token: SeRemoteShutdownPrivilege	4492	WMIC.exe
Token: SeUndockPrivilege	4492	WMIC.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4908	[email protected]
4908	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 552	4092	msedge.exe	90
PID 4092 wrote to memory of 552	4092	msedge.exe	90
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4528	4092	msedge.exe	91
PID 4092 wrote to memory of 4976	4092	msedge.exe	92
PID 4092 wrote to memory of 4976	4092	msedge.exe	92
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93
PID 4092 wrote to memory of 4676	4092	msedge.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sample
1⤵
PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc4ba46f8,0x7ffbc4ba4708,0x7ffbc4ba4718
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,5370455876719067104,14110862689586839697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4212

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 1556
  2⤵
  - Program crash
  PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2356 -ip 2356
1⤵
PID:4144

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1528
  2⤵
  - Program crash
  PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 868 -ip 868
1⤵
PID:2496

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 1444
  2⤵
  - Program crash
  PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3876 -ip 3876
1⤵
PID:4960

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 1536
  2⤵
  - Program crash
  PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3936 -ip 3936
1⤵
PID:528

C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\[email protected]"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='UR NEXT'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'UR NEXT'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /f /r /t 0
    3⤵
    PID:3620

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3975055 /state1:0x41c64e6d
1⤵
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
28bd0cdacf528f8d6afc9a352339d20b

SHA1
844e2acf30b3a03ace0c7ec6c7b70fe75bdae7e5

SHA256
ad0101cb090376f20d92addc5e3f563a5cf142217076ec6190d98fcb3b94f679

SHA512
09b792fd10bb8c8b8c0bee53c161307b281c1473e10a9c5d7e851c7f2d9918c9c96251d4ffbeeed583d1420e0a1b14be638020ccaf6a78442d6854c0a2c92362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
10dce191df8b96022320fd6417f563c3

SHA1
2d5a6fe7302f9ba89c181b7e3025e23902a50a58

SHA256
a4e1c2e7b24da21e1c3eb210772cbfafd4744dbed2520cfcc5b207a445184b24

SHA512
6dbf5fe11b960e2a4618ca035e84639c738d28f2bde6a5b6f8f70b42575c28eff67206cfdf2deba54d806e203c1285a961a8df2b391fe61a5384816fb7b2bdc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
de26e7021b1f76b38ff46b076c9325bf

SHA1
db867f577ceb796c4907b445eea2ddaf65a58942

SHA256
25c0cfc7456b2d43fe19d9a5b5cc8e26e178b3c968eda540ebf1138c727d45ff

SHA512
c4c43212a032d0e705935c00546959300845b4fc0f18911b168845983d1c272f024f0b605c7f36ec78e0e45071b4c2fbaf8b0859810cced66db5dcae99b6825e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
24aa622edf4ba9d5d9641a66cbd85d86

SHA1
b744040ae3a5215f397781d8dae8f93a495bd56f

SHA256
2fa3e90bd33cd2c195c4db803477894772d11a9bb70db26e80e01c5513495e66

SHA512
1097b6e5b1c1b0b5d2f880d716a694008bb110a825303d0a22a815446e4d65ad39f0685e5501f1f5f7bd6d6a93634a811e8dd798265755fa2043680d754b75fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
517ef1d7bcad6b3f199cde70e3b01a27

SHA1
7c9df37343a0bb744da0e40d28c92df3921d2fe3

SHA256
114572e80c4635ff1588ba13a3ffc7e93688c3d0853928f8ec509f203df95387

SHA512
d4b70de3ae773856fb958fcc5a029fdf067a768879a5db3635920a992b8481194c74253dd505f0ad84cadebf09ec7e0519ea5c8abf6aa732efc9a3bf150297d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e0bf1e8cb0916d15a0ef1d1fa4e0f45e

SHA1
5fd6b7dbe7969cdcf3cbe39856eb7ceb62c657bf

SHA256
db28ee307d0e7ad7cf55ccb3cabf0039ab2a9c9bf741b8ebbc32667ad15e0328

SHA512
003125befb31f02fb8f2e1100ee026e3dfd4b19d1fc6e546ef80becc78091f8cd48e030c49370522145b2eb59b4eeec1e9fae3cce49bc2458cbf6e2918f50cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b84f879bb6495bcb9af1520c8dbedf1b

SHA1
087f02d0f9ebddf31860274275c44bf32ce6b223

SHA256
dce74f4190489fdebeac7a84225ef427f9419adbcb8cc816338b2b1bb1de2f2b

SHA512
98f285be70f9ec523101057e3455d40c6c592178faf6acc39c57022fc312346a0c55af0109114b06894602ef4aa928b2cb9720126bd87255e269cfa0a838b28d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
379012b3ca334164fecf9d39c2df2a2f

SHA1
9800360f47ef5dcffdefefc63f2e8eb8c11d2e16

SHA256
355eedf7d19d317b00768d7dbf20f9c6493f43cebd08eb5b7c8f972e60a3b925

SHA512
5e5f5bece5079ef8e5f8ff2e92c062f04ab6c3622f94be54ca3b9a1b507d870223c116d793a2a3e30835fc4436a4a2b82b041de59cf657af52d4a03bad8db978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9880d1a1e7fb26df748756a976ccba09

SHA1
98d25566e1f8467a3d6a97047e4be27fe2dbcff4

SHA256
081028dc91d268185b86fca9c9a688f0dbcac3015de06f38cfa1ba3081e07fe6

SHA512
700c3f59faeb0fbbf1a5f1a3d48b1e8e747cadf7939a35042fefe7427af60c4f4f6b4fac9a56ca562afa1eee35e6f520372b23ffbaeeb4ada12fb99f68156431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5c364dee2d35ce16831ac57386652f33

SHA1
f45df7c07f644186dd275f77a0cff71b8c2f1228

SHA256
c0c243d9cd54a10d8125d16792d9474189fb857d7888c7f8c6c0ba3b467e7ccb

SHA512
9d20b85701d6334381bbfc9752388a6cb368feb9ce2a4a308e3ddeba61186c1d0ff8e91b26ab980cd34e04ab27d8f70c132c265999401ff93b8212fe8ff1d470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0db6d07339fbe72173c2d25f439f19b0

SHA1
2c3d31d4353c254a8a584d19cc6235a5f9cbdcce

SHA256
a1b9c5383cf41bd8288da3bb3aebeef33305d7de1a67d38c4d92f98f6d7efd6f

SHA512
30ef9e1e74f9780120b07ba301ae474f8f8086c02119b9066dd65540b2a7bca2cf860f7e750cb50985afc4c6f5a4337982fe67761043c212a7d8ecae2d468339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
116752e4428678aad14832b400cd0264

SHA1
a5b3d048fe511caad0bbfd4044c2943845704dc0

SHA256
f3b1b5186e53ad94c62c644bc39bc34efed0a1aaa05de7f0678ea9b480494cbd

SHA512
2ec870dcdeb2334238693702d8fa63b76bcdc36d4dea97977aa58734d8ba0f621ba127cbc1c677de040ec5570fe25c3f370a0dec46efa75ede15e42693554865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9a2cead88ffc22ce91dee988c05a0f3f

SHA1
8b29978e797b534dd35f440c64ecc968c3c30218

SHA256
b4f6872dce40c5ec26025181024ff43244beca04aba2fcf7ae77f34f9a6e9e2a

SHA512
9493558b8b0e9929464535df05f067b409bd49e49ad3d0fb47bdee4a6cea99282fab2f729b6d6a710fa5260190ba10a372bc1389d1077686bf2042c1929dafe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cd27f93c944bf7aba2646f0599b99ff7

SHA1
fc70163a204036c8c66c53f34c9653687bcbf449

SHA256
17e66534b2ed6a8d4950e0b1c29e086c1202dcb9a5dd7b89dbdf66e398ccf690

SHA512
684dc6788a6a69238377b4cc83f0162ab3633ba01cb5b1ef5ddc6aa24d065277aa156761af6e2e5a59c3f0a0f491015dba0731bec6e2e6f60986b4b5deff0977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7cc562e1f1dadf74562d136ec3af9b4c

SHA1
64d41f7616411a21d704d7cb43eb02876d0e1397

SHA256
c3e372e8db562fd94e131e9d4585c4b243fa7dc87ca24837363d4c518d583195

SHA512
8101b692cf4270c73ff8dbb82bd780837be951d76141b41ea3b2f58d8541391179ced0a7b0a3e1415e8ad5ba92a11e6b57e115254e4a030264ab62093a4cc3f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67de93bc4fd4d99ab2c1adba2d6d58a9

SHA1
50a127021854d3670b78db23a847615fa8e84db5

SHA256
8c65f54e8c65a4303e5e8f890331e3354f919b30850ad4e3bd333940acd75e3c

SHA512
adddc615459c0498918c9b6d0bb6deb89169b3a65b73991e813b54b468048cd4fa98b602f22008d53057eaca2bb1962d92e58a7d72fe90a77b408ebc27bc4c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581393.TMP

Filesize
706B

MD5
da9a2bfb55ba3a5ac11e40e72a37018a

SHA1
71bba00ca244f622d2428445a3d6754c3eb892dc

SHA256
7971038d3924d61d042aea578bc37eb7454e9facce0d062e93b6037c1f6908b8

SHA512
411b8df09e19e36e06f936e4f842684b66c731ccaf8b1f01992ce16975f74a0ac6efd95af03129482809714c40bbdd67690e6d666b7a765f31c202e8f2620b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4e7af30ec68fcaa181c7543d73d79ebe

SHA1
b96fecffe0e1c11d901d8b9dd7bcae798582c731

SHA256
5a544256f20d7417602306fbe046ff9e0aaa9da57d4f2a7414ffd5eee5502942

SHA512
eddd59062e4a2f2e3c2ab6f526648735116ec42ff3cd852696f1901802344bc04f294a8bd2553b1331b28d029884ffe6d60ee9f0fccd13c8538646f0c985f7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
93f988bc95ceaa78891299b3f3145ab6

SHA1
06fdc8884b31d9371f56ab90ecb7ba1258a6cc2c

SHA256
9da93c3c4b43393e154fd1a463e461768009aadd0d03ebfec1f303f63ce1e155

SHA512
9756a9aaeb58491318057d57c000147b8a2a4183515a89c2011a6b9b78c65bf62a8e2ce75e0c7ce7cb1d7be3db3fc87e8778b1e4af6d847187a802c6ab2d7b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
143e95249efcc6e2a3ce3c249aec7356

SHA1
2897594e8607846b2a2139b713d6fcd01de731f1

SHA256
6ebd352e78ca6116f47aa34233c36d28ed22cc19e0c511cf193fb586c77cc859

SHA512
80d7111fe2c4d8d640cb9ae0b7ef7a5f42a1fd77305e66885818e1968d1d25d59b3463581109f45d4bae9c9483b62c4833c1f1c8393691f82e0dfb3942ddf1f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
640KB

MD5
a6a3cb49b08528d0cee1f2cd19bc0497

SHA1
a2358815f2164b983c054e94e2ea93f0c5c5fe14

SHA256
3bed09bf69f7a17d8e6e91768363bcb28515d30bd1b96cecaaba5d94c58dd780

SHA512
d9f45068498cf3189e1df095d04058b92fb16093939fbc2de2958c0ae2ba10fa7159a198a9bc473196ada3cbc2711debe100df22ccf6ce0a37a830fa5c935f5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.2\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\one.rtf

Filesize
403B

MD5
6fbd6ce25307749d6e0a66ebbc0264e7

SHA1
faee71e2eac4c03b96aabecde91336a6510fff60

SHA256
e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

SHA512
35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

Download Submit
C:\Users\Admin\AppData\Local\Temp\rniw.exe

Filesize
76KB

MD5
9232120b6ff11d48a90069b25aa30abc

SHA1
97bb45f4076083fca037eee15d001fd284e53e47

SHA256
70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

SHA512
b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

Download Submit
C:\Users\Admin\AppData\Local\Temp\windl.bat

Filesize
771B

MD5
a9401e260d9856d1134692759d636e92

SHA1
4141d3c60173741e14f36dfe41588bb2716d2867

SHA256
b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

SHA512
5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

Download Submit
C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\Downloads\000.zip

Filesize
119KB

MD5
d113bd83e59586dd8f1843bdb9b98ee0

SHA1
6c203d91d5184dade63dbab8aecbdfaa8a5402ab

SHA256
9d3fe04d88c401178165f7fbdf307ac0fb690cc5fef8b70ee7f380307d4748f8

SHA512
0e763ff972068d2d9946a2659968e0f78945e9bf9a73090ec81f2a6f96ac9b43a240544455068d41afa327035b20b0509bb1ad79a28147b6375ed0c0cf3efec5

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.zip

Filesize
223KB

MD5
a7a51358ab9cdf1773b76bc2e25812d9

SHA1
9f3befe37f5fbe58bbb9476a811869c5410ee919

SHA256
817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612

SHA512
3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d

Download Submit
memory/2356-493-0x00000000060B0000-0x0000000006654000-memory.dmp

Filesize
5.6MB

Download
memory/2356-494-0x0000000005B00000-0x0000000005B92000-memory.dmp

Filesize
584KB

Download
memory/2356-497-0x0000000005A50000-0x0000000005A5A000-memory.dmp

Filesize
40KB

Download
memory/2356-496-0x0000000005D10000-0x0000000005D66000-memory.dmp

Filesize
344KB

Download
memory/2356-491-0x0000000000FA0000-0x0000000001012000-memory.dmp

Filesize
456KB

Download
memory/2356-492-0x0000000005A60000-0x0000000005AFC000-memory.dmp

Filesize
624KB

Download
memory/2356-495-0x0000000005A20000-0x0000000005A2A000-memory.dmp

Filesize
40KB

Download
memory/4908-575-0x000000000B320000-0x000000000B330000-memory.dmp

Filesize
64KB

Download
memory/4908-579-0x000000000B320000-0x000000000B330000-memory.dmp

Filesize
64KB

Download
memory/4908-552-0x0000000000120000-0x00000000007CE000-memory.dmp

Filesize
6.7MB

Download
memory/4908-574-0x000000000B320000-0x000000000B330000-memory.dmp

Filesize
64KB

Download
memory/4908-581-0x000000000B2F0000-0x000000000B300000-memory.dmp

Filesize
64KB

Download
memory/4908-582-0x000000000B2F0000-0x000000000B300000-memory.dmp

Filesize
64KB

Download
memory/4908-583-0x000000000B320000-0x000000000B330000-memory.dmp

Filesize
64KB

Download
memory/4908-584-0x000000000B320000-0x000000000B330000-memory.dmp

Filesize
64KB

Download
memory/4908-585-0x000000000B2F0000-0x000000000B300000-memory.dmp

Filesize
64KB

Download
memory/4908-580-0x000000000B320000-0x000000000B330000-memory.dmp

Filesize
64KB

Download
memory/4908-570-0x000000000B0E0000-0x000000000B118000-memory.dmp

Filesize
224KB

Download
memory/4908-571-0x000000000AC80000-0x000000000AC8E000-memory.dmp

Filesize
56KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads