hxxps://drive[.]google[.]com/drive/folders/13gJsVTDAyHLVJHNX9GC9r_Ajd5LqpsUn

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2024 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/13gJsVTDAyHLVJHNX9GC9r_Ajd5LqpsUn

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\py_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\py_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\.py	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\py_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\.py\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\py_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\py_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\py_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\py_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\py_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{E9FB1F2A-F1C0-4181-BC39-49304471C7C1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\랥৥᐀耀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\랥৥᐀耀\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3224	NOTEPAD.EXE
548	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
1440	msedge.exe
1440	msedge.exe
5036	identity_helper.exe
5036	identity_helper.exe
1792	msedge.exe
1792	msedge.exe
4244	msedge.exe
4244	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4920	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
1288	OpenWith.exe
2956	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe
4532	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1036	1440	msedge.exe	88
PID 1440 wrote to memory of 1036	1440	msedge.exe	88
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 4900	1440	msedge.exe	89
PID 1440 wrote to memory of 3896	1440	msedge.exe	90
PID 1440 wrote to memory of 3896	1440	msedge.exe	90
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91
PID 1440 wrote to memory of 4376	1440	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/13gJsVTDAyHLVJHNX9GC9r_Ajd5LqpsUn
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb271d46f8,0x7ffb271d4708,0x7ffb271d4718
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1860 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4609021333785766244,13177659499231337786,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1288
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DestroyTools.py
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4532
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DestroyTools.py
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
36KB

MD5
eae5fc6db735938044a4741054dca29e

SHA1
5ad3a1d30f1123fda791830cd373b9d9041a5663

SHA256
967e35cf9787773151cb0a3945617f4a25b0232c8af0b8b8db30797426c40d3f

SHA512
a996760ff518a4781eb2d5b6074fad7645b1c06fb98d1dac86c919b67d0e04289790a7e45c57c22b8ac28421b46ed299ecb38d6d979711bc95bf804f47c8556a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
32KB

MD5
b582b2eca79a750948dbb3777aeaaadb

SHA1
bf0ea1c8a7b4a55779cbb3df1f1d75cc19910e9f

SHA256
04c7f19e1ae294cc641f6c497653b5c13c41b258559f5f05b790032ccca16c82

SHA512
35cfd88afe4e4e8091d3a5c53f0f3e2dcd92aa58b7544b94d4d9d7cdf508d429c5292aa97b813c9c8ad18e4d121d4e6595c49f5ddafbeab7b39f3a7c9d0b58dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
66KB

MD5
33411bb179575dfc40cc62c61899664f

SHA1
d03c06d5893d632e1a7f826a6ffd9768ba885e11

SHA256
274befc7b39609fed270e69335bc92b3d8251545594636eb408d5d93e0ae1a4f

SHA512
dc830766c928ac84df16d094fc92586b9c2c25f819123dc9b5ec259220b4b1c45e2af28c89a710f047c00c9dcf7df8dd859a9a7a2d2228703f616df13caef2c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
5360ecb0feb9be005a10d3b2c2d68a66

SHA1
39fba3feaae3e45348ae10940616dc52ccc1f499

SHA256
2ab16a56bc18fd6bd2152940a4be8e6fb05b6faefd27c5a66c9150534354728c

SHA512
b0049356e1778e203a73effd1649276406394a5af8ec276077fff69e21510d357b3ce97ba344f09c9180bb9c5c2facbdd7cb74b616bb67b01e9e6e8db135cbaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b8d9e0bf596f742c4bdb5d428841b493

SHA1
d559fa9415f4b463eb4af6f8d7c0d5e392b6c35c

SHA256
bfd34417cdcecc6ea1d507f30f871ab386428e04b36e5c1118f562c1446d4403

SHA512
d04c5e5e2f42d6933e2d30474f3f9b7bf2f9d3c9321ba04e39ac143938a93243ed074f823a4b7bf9790005a7a83b372039bad5a1376d52796c53f8c14b646852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
e9a7013d5ddc3a5cff7061fd260f85ce

SHA1
21bbb5721df6282ef94075a80c72c86cce490a52

SHA256
45208ce0f76e135e7baefc0f3d1da10a35afde5f7dc31c86ccee7dbc9c0c1cbd

SHA512
1d00105a1364f77a8eeba7f7a878dd6d2fcd049606c7fba336627a90331db65e98b552b2bd56797d0d0e195d89c3da4edd6e86fb8d1deaa070200c35fb333a3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
60a001f68e1c4f0d621818f7cfcd9077

SHA1
549adc3a63fd93aa7fcb1084a822d3a17677355b

SHA256
c30e7e01e8ca8b6a0e50366710e665384ab55abc8b5a4bfe6299be68604128f4

SHA512
9506e80db25822b2cb0c3fb12e50fefc897a2b6ed1393fd713b878ff50c216038e7b66810cf1f7f312553ca66ffec783a012b8919b8f16c2353cccea132a5b52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a9c54a7a7136220a767812491a6a74b

SHA1
2696aa72cea4622946c8be7433cfe3d6d5d39e1c

SHA256
6d4c0a3ae6fb7d02ce5a4e83ac72cba0c6d2ad2631a22f9b3b3278cd276ca436

SHA512
0824a0e1bae94f49d74b5e688229bef5d50a3b6875bf74d9283a439985d5e9a4e010a33637ee99c2c851014aceaba05faec89bb6685a78663e005edf9a4fd30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbe7105cb981e36f713f43462d82cdab

SHA1
c401e6c780d94ca91d69e60a4826dd322c691dc8

SHA256
0b85f0ad32421f6daba4cf3c5edd9c4691708d1aaf4a252d656a89dfeec049b3

SHA512
86ca15ab12fd74b0a10d3375d858bc6f5b88eb9e70f57c57e9dc156d179a289810ea007f5f381e1a05f04a67efb64ffb4f3f5f26d1a3eef3e1de02c3af02e701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02010f2a7197a1a45d1df637a7df8a9f

SHA1
e1153ada86b6cf64d5e5d0326d03057f3e42da69

SHA256
7679bef72c9fbc39c6feaaaf6f05c6ac2305bf6dab2435cba4b61d2179803a28

SHA512
4298460ba1e09bf489c84b9f21b410d1886af5f006ecc9951be992464e3cc497dfd611eee3a8d3154a03aa7bcd9dae454b600308ba6c4a9e3254a1173b8da984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3db33014431107e4caaa65b945f018d1

SHA1
e999f562f0034864b6e773bc24eccc5525816366

SHA256
277ddce3b7534da5f377000e6e0b6bbb774c275c6de7e49a156a3c813b4ab351

SHA512
4a732353d5c95e58b6b2dacce6effdb1b36fd35618cf73bbad37ad26be5d73d9041efb69a588d614df286cea9e2eee46fecc476834dcb7ae637ce726440dd94d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2923c1015289481f98927ebac3447185

SHA1
0c44a495b38fe60346e80e2e7900e3c233444867

SHA256
feb779fb1c57fdce2533735bc8ec63195bbc4c5d14ee3b16235437f2dda864d4

SHA512
b528a97443d08ddc8be9e954947f4e1ff5896baa7eee52da78c00a14cbf0bcedee755af2ee400bea669677ae57834a2aca911aac7fc82b5583beb72474b956ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2b9c3262d799df37ce43f0aa5d1d1e2f

SHA1
d314aa52bb8dfd1034b3b634d5e33aaa4d4512e4

SHA256
8ae13cd8af3e3690fc8dc58524c6c49c5efb6f9dca877e5dcd806384ec13a4f9

SHA512
c9c8dd85284c5a5a0c1cee6c606387fde956c73983c2b5bc91e3828dcbb9990c10be200140166f10ca687cf8c752a764c4ee01ba8cbb39a0b0f523885e928857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6bfba61a2eab807be3cb6c575c35159f

SHA1
8dec35f345b2c3e8a75e2afae4fdc638e7ca5500

SHA256
f0a97756a94a5b238aec377b37aa04d9e3da847e4bb85dbdc95989c9c60c5a95

SHA512
a054f1cb330cda96cc43e3581d574ecba75852d4e0267d2f9a43ae1e2a8137fe018a9204b73155a3c7db8e4f2f10199e2aebab3dcdc13b7d76f09b02d1423f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c324df0f4a53870cf4acb574a3352f8c

SHA1
236d5f299a8a4d7b1e99fe4f8ee1d70d83a54dda

SHA256
e26fb76194d62f4d1ea377f6b7d2af07ffe2da8092f6d1b1854b4e9e8a994f28

SHA512
b127912d25f2e043013f763ba06cfbe935ca3759e835224096a25c05e171f60b115630990ec7cf19b59b4569f0d49590481158c6ab2431f056ffcc0658f731f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586d1d.TMP

Filesize
1KB

MD5
dae60e0da9194aac5213e7493d7940bd

SHA1
659fb0cdb7ecaad112acf20ff68846fcc29c78ef

SHA256
09ec19bdd896cf27c20184543fa512035041838f98b41d5be507132d1fe85637

SHA512
17ebb84ef81ec853f23eae5b994896b7b61339788190d37f17f3a71671950b67d58326ae6c7c9dd6515dbd8585459dff5eeb3ad8169e1c88edc764384866b034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8c73840e9865b91dcaa83b92196d186

SHA1
2dda09e83c600d3cbbaa0b6abd7887ad9e4491d4

SHA256
34ac297f192c2ff9b205820eb2f50372c63992a6b90b1593b917aded75e44fda

SHA512
f75c67ccdd754f191262c357c352e8f4aa156e82513f2d5c9f6b891ca08ef8c40de505e7ea48aa40e12a417e91d9d77d680041fe9189c61f355412ff61ddcf3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b86e7419-9777-47df-b894-50ad8f8acf33.tmp

Filesize
11KB

MD5
1881155109fdf8290277e6effc7b7eff

SHA1
d9fe00569ed60a79c06c3c65ef9935e6f2a79a2d

SHA256
162f489c577f02991b0f59acb6ba2a6011e77dad5abcab3d793609e479b01d5a

SHA512
4061d89a7ff9ab358942041c91b44f11f37a6600a077fc5a3a9171076e7ccfaac90f25619541d8911edd20ee30624808f5703093139b5f20206aaaabb65f5008

Download Submit
C:\Users\Admin\Downloads\DestroyTools.py

Filesize
2KB

MD5
186299e0ca4b4a36d9f2a3614e3b7ff8

SHA1
81faa0c1f28a1a27cd43bff66eaeba2640323a2a

SHA256
a820f1cd933edb94e005196508a6148e3c3ce0c57f59c9e6a5f572c746e8d1c4

SHA512
ae804b27b9a12477e7119f3099759b888baea7424d7d778bf99359a738913d77f9f0585dacd76d958afe45c9c4e81e646610d0bd4e4e4353742abf6f335ee13a

Download Submit