djvu | 4db18bb82c0143d95eea29fb1416348936007290889eb5ab1f5332d09db43bdb

Analysis

max time kernel
75s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
Size

732KB
MD5

cdc4132b29e414f192431cf17c959a56
SHA1

a26f541c8130c404020d76d98b4fb4c3c9600f99
SHA256

d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701
SHA512

d85935b75ce1a78b026ccc2e015c1cf1e3013114a8ba0f2e48c2bc4d93cdbd913f18016214335c5111c491716f7a823e58366fb4a37778d32be78478ed128eef
SSDEEP

12288:HLtTB27VeNWombj8dJBpuz4I3hrJAb8hWzmYe9VOucjSdsdfyv:rtUJ6W7WEcENAbbqmSdsNyv

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/lancer/get.php

Attributes

extension
.qual
offline_id
KLbRmn6on3AXGFgDLGtd0IkHmV7uHw9VxlcxO5t1
payload_url
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool. Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0876qual

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 16 IoCs

resource	yara_rule
behavioral1/memory/2160-2-0x0000000003FA0000-0x00000000040BB000-memory.dmp	family_djvu
behavioral1/memory/4624-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4624-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4624-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4624-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4624-17-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-20-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-28-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-39-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2716-61-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4068	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\69f95cca-3591-49f1-b059-c0efcaf97ae9\\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe\" --AutoStart"	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	api.2ip.ua
20	api.2ip.ua
25	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 3360 set thread context of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4624	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
4624	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
2716	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
2716	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
1412	msedge.exe
1412	msedge.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	taskmgr.exe
Token: SeSystemProfilePrivilege	3932	taskmgr.exe
Token: SeCreateGlobalPrivilege	3932	taskmgr.exe
Token: 33	3932	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3932	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe
3932	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 2160 wrote to memory of 4624	2160	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	85
PID 4624 wrote to memory of 4068	4624	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	88
PID 4624 wrote to memory of 4068	4624	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	88
PID 4624 wrote to memory of 4068	4624	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	88
PID 4624 wrote to memory of 3360	4624	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	89
PID 4624 wrote to memory of 3360	4624	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	89
PID 4624 wrote to memory of 3360	4624	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	89
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 3360 wrote to memory of 2716	3360	d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe	92
PID 2876 wrote to memory of 2452	2876	msedge.exe	102
PID 2876 wrote to memory of 2452	2876	msedge.exe	102
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103
PID 2876 wrote to memory of 3760	2876	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
"C:\Users\Admin\AppData\Local\Temp\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
  "C:\Users\Admin\AppData\Local\Temp\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\69f95cca-3591-49f1-b059-c0efcaf97ae9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
    "C:\Users\Admin\AppData\Local\Temp\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe
      "C:\Users\Admin\AppData\Local\Temp\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault847e87efh98b6h4818h8e13h7b9071883b7e
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe560746f8,0x7ffe56074708,0x7ffe56074718
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15736582945888184315,13628732392928538742,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15736582945888184315,13628732392928538742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15736582945888184315,13628732392928538742,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
8652856f5816ad977ff460ef3ffaf573

SHA1
01727313280f45b62e0e7d1bf6f863e4e7a5ac9b

SHA256
3858758afc30c9a4452fffa6282057afaf8e9790623f19f49b9901e8e6e663c7

SHA512
a9330047457c88cfdcae9605ad7ca94e86f32eb62b96f6c3e9964bc686a2c6de2c829a04ba55cfcc2dbecc8971b13c69381b09c5b7c2ac70245476d72190c388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
37fc369f6ce313b96005be14bba3ed2b

SHA1
6ff8c24cb66423f261c81a39dd4dbef9f48c991b

SHA256
a75dab13d4f4ddbbde271662685a22fac2fc885870703b711cbf64e0b4784c1b

SHA512
1b24f32ea52190ca20f0fb65b5fab62deda5c4e2bd886f13f52fa68cba11a54cbf3f291022556e05d5c0f046aeade8aa883124e2fbaf1f38bce7d90235a48a68

Download Submit
C:\Users\Admin\AppData\Local\69f95cca-3591-49f1-b059-c0efcaf97ae9\d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701.exe

Filesize
732KB

MD5
cdc4132b29e414f192431cf17c959a56

SHA1
a26f541c8130c404020d76d98b4fb4c3c9600f99

SHA256
d148dedc9b654f78a2ddd2298663df99d57d00cdec9e97a3722496cc51c60701

SHA512
d85935b75ce1a78b026ccc2e015c1cf1e3013114a8ba0f2e48c2bc4d93cdbd913f18016214335c5111c491716f7a823e58366fb4a37778d32be78478ed128eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\17613f16-c897-4fe3-aab4-0602d055e17b.tmp

Filesize
8KB

MD5
73e1af6783cba84f75e341a408c9d6eb

SHA1
939f1713654fce0fb5d9c030fe431ccbf3d4bd40

SHA256
aa2d06f306508fd9d6866553840d65f226bf736fa74fc0fd6726c13e9bb904da

SHA512
01e4cdc51c3296ec3588b6fb1a21ce1f2167c71ae99fd31bdd90eb3ab05a1aaebea507c984414d2138db7cf66df96483b968fac3b3d2eff6ea6450282062f6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d88f91d92bbf9142d6e24db1137b275

SHA1
6a45217208daf5bae5a8b0b16aa9adf5a52b080c

SHA256
cebe753a562875a0c80fa8a45bc17278e1d18da1d848190d80925b39110cc597

SHA512
c70f9ae79d9e91ce4e7d8ab1127425d5a027b0294c2de141cccd65c86969ec9037eec7d018da2fd1408c3f136ebe8c0604de9f3c86a43f0edb547aea54649a93

Download Submit
memory/2160-2-0x0000000003FA0000-0x00000000040BB000-memory.dmp

Filesize
1.1MB

Download
memory/2160-1-0x0000000003F00000-0x0000000003F9F000-memory.dmp

Filesize
636KB

Download
memory/2716-22-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-61-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-20-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-30-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-28-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-39-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3360-23-0x0000000000400000-0x00000000020FF000-memory.dmp

Filesize
29.0MB

Download
memory/3360-38-0x0000000000400000-0x00000000020FF000-memory.dmp

Filesize
29.0MB

Download
memory/3932-92-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/3932-102-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/3932-98-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/3932-99-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/3932-100-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/3932-90-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/3932-91-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/3932-101-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/3932-96-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/3932-97-0x0000029CCA1E0000-0x0000029CCA1E1000-memory.dmp

Filesize
4KB

Download
memory/4624-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4624-17-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4624-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4624-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4624-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download