hxxps://cdn[.]discordapp[.]com/attachments/1231953046066434059/1286793157824090213/main[.]bat?ex=66ef3304&is=66ede184&hm=7babf26fea84a56a0cf2cd70610c8efe98bdfb40730dedebf56387826b5e8230&

Analysis

max time kernel
105s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1231953046066434059/1286793157824090213/main.bat?ex=66ef3304&is=66ede184&hm=7babf26fea84a56a0cf2cd70610c8efe98bdfb40730dedebf56387826b5e8230&

Score

10^/10

discovery evasion execution persistence ransomware

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2180	bcdedit.exe
4712	bcdedit.exe
2208	bcdedit.exe
2804	bcdedit.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Power Settings 1 TTPs 58 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2872	powercfg.exe
2200	powercfg.exe
2380	powercfg.exe
3696	powercfg.exe
2916	powercfg.exe
988	powercfg.exe
2740	powercfg.exe
2816	powercfg.exe
3108	powercfg.exe
2540	powercfg.exe
4884	powercfg.exe
4276	powercfg.exe
2028	powercfg.exe
4604	powercfg.exe
4692	powercfg.exe
2512	powercfg.exe
2752	powercfg.exe
884	powercfg.exe
5024	powercfg.exe
3936	powercfg.exe
1960	powercfg.exe
4356	powercfg.exe
1296	powercfg.exe
756	powercfg.exe
724	powercfg.exe
4672	powercfg.exe
3660	powercfg.exe
3404	powercfg.exe
3576	powercfg.exe
3612	powercfg.exe
2780	powercfg.exe
4868	powercfg.exe
540	powercfg.exe
3316	powercfg.exe
4336	powercfg.exe
2152	powercfg.exe
2756	powercfg.exe
3832	powercfg.exe
2320	powercfg.exe
3516	powercfg.exe
3872	powercfg.exe
636	powercfg.exe
5116	powercfg.exe
664	powercfg.exe
4480	powercfg.exe
4440	powercfg.exe
3768	powercfg.exe
4628	powercfg.exe
1556	powercfg.exe
464	powercfg.exe
4092	powercfg.exe
4864	powercfg.exe
3488	powercfg.exe
4860	powercfg.exe
4896	powercfg.exe
4812	powercfg.exe
60	powercfg.exe
3332	powercfg.exe

Launches sc.exe 20 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4460	sc.exe
5064	sc.exe
2544	sc.exe
3964	sc.exe
1508	sc.exe
4372	sc.exe
1152	sc.exe
1396	sc.exe
3352	sc.exe
1332	sc.exe
3512	sc.exe
2156	sc.exe
1772	sc.exe
2708	sc.exe
1524	sc.exe
3032	sc.exe
3076	sc.exe
3428	sc.exe
3672	sc.exe
4192	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
3912	timeout.exe
3632	timeout.exe
1064	timeout.exe
1428	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1788	reg.exe
2288	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 22853.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4448	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
1328	msedge.exe
1328	msedge.exe
1824	identity_helper.exe
1824	identity_helper.exe
4576	msedge.exe
4576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4812	powercfg.exe
Token: SeCreatePagefilePrivilege	4812	powercfg.exe
Token: SeShutdownPrivilege	2756	powercfg.exe
Token: SeCreatePagefilePrivilege	2756	powercfg.exe
Token: SeShutdownPrivilege	2028	powercfg.exe
Token: SeCreatePagefilePrivilege	2028	powercfg.exe
Token: SeShutdownPrivilege	3488	powercfg.exe
Token: SeCreatePagefilePrivilege	3488	powercfg.exe
Token: SeShutdownPrivilege	4860	powercfg.exe
Token: SeCreatePagefilePrivilege	4860	powercfg.exe
Token: SeShutdownPrivilege	3832	powercfg.exe
Token: SeCreatePagefilePrivilege	3832	powercfg.exe
Token: SeShutdownPrivilege	2872	powercfg.exe
Token: SeCreatePagefilePrivilege	2872	powercfg.exe
Token: SeShutdownPrivilege	5116	powercfg.exe
Token: SeCreatePagefilePrivilege	5116	powercfg.exe
Token: SeShutdownPrivilege	664	powercfg.exe
Token: SeCreatePagefilePrivilege	664	powercfg.exe
Token: SeShutdownPrivilege	60	powercfg.exe
Token: SeCreatePagefilePrivilege	60	powercfg.exe
Token: SeShutdownPrivilege	464	powercfg.exe
Token: SeCreatePagefilePrivilege	464	powercfg.exe
Token: SeShutdownPrivilege	2380	powercfg.exe
Token: SeCreatePagefilePrivilege	2380	powercfg.exe
Token: SeShutdownPrivilege	2816	powercfg.exe
Token: SeCreatePagefilePrivilege	2816	powercfg.exe
Token: SeShutdownPrivilege	4092	powercfg.exe
Token: SeCreatePagefilePrivilege	4092	powercfg.exe
Token: SeShutdownPrivilege	4480	powercfg.exe
Token: SeCreatePagefilePrivilege	4480	powercfg.exe
Token: SeShutdownPrivilege	3576	powercfg.exe
Token: SeCreatePagefilePrivilege	3576	powercfg.exe
Token: SeShutdownPrivilege	4604	powercfg.exe
Token: SeCreatePagefilePrivilege	4604	powercfg.exe
Token: SeShutdownPrivilege	3696	powercfg.exe
Token: SeCreatePagefilePrivilege	3696	powercfg.exe
Token: SeShutdownPrivilege	3936	powercfg.exe
Token: SeCreatePagefilePrivilege	3936	powercfg.exe
Token: SeShutdownPrivilege	2200	powercfg.exe
Token: SeCreatePagefilePrivilege	2200	powercfg.exe
Token: SeShutdownPrivilege	2916	powercfg.exe
Token: SeCreatePagefilePrivilege	2916	powercfg.exe
Token: SeShutdownPrivilege	3108	powercfg.exe
Token: SeCreatePagefilePrivilege	3108	powercfg.exe
Token: SeShutdownPrivilege	2320	powercfg.exe
Token: SeCreatePagefilePrivilege	2320	powercfg.exe
Token: SeShutdownPrivilege	2512	powercfg.exe
Token: SeCreatePagefilePrivilege	2512	powercfg.exe
Token: SeShutdownPrivilege	2752	powercfg.exe
Token: SeCreatePagefilePrivilege	2752	powercfg.exe
Token: SeShutdownPrivilege	2540	powercfg.exe
Token: SeCreatePagefilePrivilege	2540	powercfg.exe
Token: SeShutdownPrivilege	3612	powercfg.exe
Token: SeCreatePagefilePrivilege	3612	powercfg.exe
Token: SeShutdownPrivilege	4864	powercfg.exe
Token: SeCreatePagefilePrivilege	4864	powercfg.exe
Token: SeShutdownPrivilege	3332	powercfg.exe
Token: SeCreatePagefilePrivilege	3332	powercfg.exe
Token: SeShutdownPrivilege	4692	powercfg.exe
Token: SeCreatePagefilePrivilege	4692	powercfg.exe
Token: SeShutdownPrivilege	4868	powercfg.exe
Token: SeCreatePagefilePrivilege	4868	powercfg.exe
Token: SeShutdownPrivilege	4884	powercfg.exe
Token: SeCreatePagefilePrivilege	4884	powercfg.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
4448	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 3360	1328	msedge.exe	82
PID 1328 wrote to memory of 3360	1328	msedge.exe	82
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 1152	1328	msedge.exe	83
PID 1328 wrote to memory of 3672	1328	msedge.exe	84
PID 1328 wrote to memory of 3672	1328	msedge.exe	84
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85
PID 1328 wrote to memory of 3064	1328	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1231953046066434059/1286793157824090213/main.bat?ex=66ef3304&is=66ede184&hm=7babf26fea84a56a0cf2cd70610c8efe98bdfb40730dedebf56387826b5e8230&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb34c46f8,0x7ffcb34c4708,0x7ffcb34c4718
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2168,6080564502940451447,5659719070382853213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:232

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\main.bat"
1⤵
PID:892
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet001\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMax" /t REG_DWORD /d "0" /f
  2⤵
  PID:4448
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet001\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet002\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMax" /t REG_DWORD /d "0" /f
  2⤵
  PID:3336
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet002\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:1332
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMax" /t REG_DWORD /d "0" /f
  2⤵
  PID:2300
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:3628
- C:\Windows\system32\reg.exe
  Reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\Power /v CoreParkingDisabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2288
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2180
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4712
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "DistributeTimers" /t REG_DWORD /d "1" /f
  2⤵
  PID:896
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "DisableTsx" /t REG_DWORD /d "0" /f
  2⤵
  PID:2988
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "EventProcessorEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2388
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP AWAYMODE 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  PID:5024
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP ALLOWSTANDBY 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP HYBRIDSLEEP 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:664
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3912
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor IDLESCALING 1
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:60
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor THROTTLING 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:1540
- C:\Windows\system32\powercfg.exe
  powercfg /setACvalueindex scheme_current SUB_PROCESSOR SYSCOOLPOL 1
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\system32\powercfg.exe
  powercfg /setDCvalueindex scheme_current SUB_PROCESSOR SYSCOOLPOL 1
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3576
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4604
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3936
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor CPMAXCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor CPMAXCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\be337238-0d82-4146-a960-4f3749d470c7" /v "Attributes" /t REG_DWORD /d 2 /f
  2⤵
  PID:3116
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFBOOSTMODE 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PERFBOOSTMODE 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "0" /f
  2⤵
  PID:2944
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "0" /f
  2⤵
  PID:1180
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /t REG_DWORD /d 1 /f
  2⤵
  PID:1072
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d 2 /f
  2⤵
  PID:1148
- C:\Windows\system32\sc.exe
  sc config "DiagTrack" start= disabled
  2⤵
  - Launches sc.exe
  PID:3428
- C:\Windows\system32\sc.exe
  sc config "SysMain" start= disabled
  2⤵
  - Launches sc.exe
  PID:3964
- C:\Windows\system32\sc.exe
  sc config "WSearch" start= disabled
  2⤵
  - Launches sc.exe
  PID:3672
- C:\Windows\system32\sc.exe
  sc config "Fax" start= disabled
  2⤵
  - Launches sc.exe
  PID:1152
- C:\Windows\system32\sc.exe
  sc config "TabletInputService" start= disabled
  2⤵
  - Launches sc.exe
  PID:2156
- C:\Windows\system32\sc.exe
  sc stop "DiagTrack"
  2⤵
  - Launches sc.exe
  PID:1508
- C:\Windows\system32\sc.exe
  sc stop "SysMain"
  2⤵
  - Launches sc.exe
  PID:1772
- C:\Windows\system32\sc.exe
  sc stop "WSearch"
  2⤵
  - Launches sc.exe
  PID:4192
- C:\Windows\system32\sc.exe
  sc stop "Fax"
  2⤵
  - Launches sc.exe
  PID:2708
- C:\Windows\system32\sc.exe
  sc stop "TabletInputService"
  2⤵
  - Launches sc.exe
  PID:4372
- C:\Windows\system32\fsutil.exe
  fsutil behavior set DisableDeleteNotify 0
  2⤵
  PID:1792
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d 1 /f
  2⤵
  PID:4508
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsMemoryUsage" /t REG_DWORD /d 2 /f
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "ClearPageFileAtShutdown" /t REG_DWORD /d 1 /f
  2⤵
  PID:3300
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "DisablePagingExecutive" /t REG_DWORD /d 1 /f
  2⤵
  PID:4012
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /t REG_DWORD /d 1 /f
  2⤵
  PID:4940
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "SecondLevelDataCache" /t REG_DWORD /d 512 /f
  2⤵
  PID:5088
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:3392

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\main.bat
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:4448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\main.bat"
1⤵
PID:1324
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:5116
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet001\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMax" /t REG_DWORD /d "0" /f
  2⤵
  PID:3092
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet001\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet002\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMax" /t REG_DWORD /d "0" /f
  2⤵
  PID:3924
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\ControlSet002\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMax" /t REG_DWORD /d "0" /f
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:2432
- C:\Windows\system32\reg.exe
  Reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\Power /v CoreParkingDisabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:1788
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2208
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2804
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "DistributeTimers" /t REG_DWORD /d "1" /f
  2⤵
  PID:1976
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "DisableTsx" /t REG_DWORD /d "0" /f
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "EventProcessorEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2172
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP AWAYMODE 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP ALLOWSTANDBY 0
  2⤵
  - Power Settings
  PID:3660
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  PID:1960
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP HYBRIDSLEEP 0
  2⤵
  - Power Settings
  PID:756
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  PID:540
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  PID:988
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  PID:724
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1064
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor IDLESCALING 1
  2⤵
  - Power Settings
  PID:4440
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  PID:4276
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor THROTTLING 0
  2⤵
  - Power Settings
  PID:4672
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583" /v "ValueMin" /t REG_DWORD /d "0" /f
  2⤵
  PID:4272
- C:\Windows\system32\powercfg.exe
  powercfg /setACvalueindex scheme_current SUB_PROCESSOR SYSCOOLPOL 1
  2⤵
  - Power Settings
  PID:2780
- C:\Windows\system32\powercfg.exe
  powercfg /setDCvalueindex scheme_current SUB_PROCESSOR SYSCOOLPOL 1
  2⤵
  - Power Settings
  PID:3768
- C:\Windows\system32\powercfg.exe
  powercfg /setactive SCHEME_CURRENT
  2⤵
  - Power Settings
  PID:884
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  PID:3316
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PROCTHROTTLEMAX 100
  2⤵
  - Power Settings
  PID:4628
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  PID:4336
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  PID:3404
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  PID:4356
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor CPMAXCORES 100
  2⤵
  - Power Settings
  PID:3516
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor CPMAXCORES 100
  2⤵
  - Power Settings
  PID:3872
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  PID:636
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  PID:1556
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  PID:2740
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\be337238-0d82-4146-a960-4f3749d470c7" /v "Attributes" /t REG_DWORD /d 2 /f
  2⤵
  PID:2960
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFBOOSTMODE 0
  2⤵
  - Power Settings
  PID:2152
- C:\Windows\system32\powercfg.exe
  powercfg -setdcvalueindex scheme_current sub_processor PERFBOOSTMODE 0
  2⤵
  - Power Settings
  PID:4896
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  PID:1296
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "0" /f
  2⤵
  PID:3732
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "0" /f
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /t REG_DWORD /d 1 /f
  2⤵
  PID:868
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d 2 /f
  2⤵
  PID:3608
- C:\Windows\system32\sc.exe
  sc config "DiagTrack" start= disabled
  2⤵
  - Launches sc.exe
  PID:4460
- C:\Windows\system32\sc.exe
  sc config "SysMain" start= disabled
  2⤵
  - Launches sc.exe
  PID:1524
- C:\Windows\system32\sc.exe
  sc config "WSearch" start= disabled
  2⤵
  - Launches sc.exe
  PID:1396
- C:\Windows\system32\sc.exe
  sc config "Fax" start= disabled
  2⤵
  - Launches sc.exe
  PID:3032
- C:\Windows\system32\sc.exe
  sc config "TabletInputService" start= disabled
  2⤵
  - Launches sc.exe
  PID:3076
- C:\Windows\system32\sc.exe
  sc stop "DiagTrack"
  2⤵
  - Launches sc.exe
  PID:5064
- C:\Windows\system32\sc.exe
  sc stop "SysMain"
  2⤵
  - Launches sc.exe
  PID:2544
- C:\Windows\system32\sc.exe
  sc stop "WSearch"
  2⤵
  - Launches sc.exe
  PID:3352
- C:\Windows\system32\sc.exe
  sc stop "Fax"
  2⤵
  - Launches sc.exe
  PID:1332
- C:\Windows\system32\sc.exe
  sc stop "TabletInputService"
  2⤵
  - Launches sc.exe
  PID:3512
- C:\Windows\system32\fsutil.exe
  fsutil behavior set DisableDeleteNotify 0
  2⤵
  PID:1444
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d 1 /f
  2⤵
  PID:3052
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsMemoryUsage" /t REG_DWORD /d 2 /f
  2⤵
  PID:5068
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "ClearPageFileAtShutdown" /t REG_DWORD /d 1 /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "DisablePagingExecutive" /t REG_DWORD /d 1 /f
  2⤵
  PID:432
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /t REG_DWORD /d 1 /f
  2⤵
  PID:8
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "SecondLevelDataCache" /t REG_DWORD /d 512 /f
  2⤵
  PID:2188
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt $H &echo on &for %B in (1) do rem"
  2⤵
  PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
139ad2b17b6458eabacd269ab5646386

SHA1
2e87f670fd9a18d300db207ab055a2f9f3c96156

SHA256
d37e3702568ea0e48c3d973b44dcb2d31993ebe96c8bd7a64156af4223833c2c

SHA512
551726b9279f976d390fb39fe140371e831d8c29d081607d4a8e8d835d7003e23b9dfc7d5e265a7dc0249fe628b918a49281b39bdff244b0511fb86061a1a0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a300c074cf295c60a0f259dc279e24df

SHA1
3af9ca6880bfae751cc9fe6489234974e5b73cf6

SHA256
811aeb32f0e8db3ed6ab16823922f69f7f1fa1683887dfe47f117d537316147b

SHA512
4cf950059640da76e5d7cefdb1b28a4eee3a85c783b3698db5563d3aeb7201ed5e3a6700c273a15d1fa861e2850e8b1b71c53d7e7908836e109b62327d8596b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
197718c9dbc3e0372213530d5fa187a0

SHA1
af5f1fa1a7c271e94554dc6a983af089ef13c377

SHA256
38484256d2eb581832c4098d66efc40dc4ef5bf9774d51e8af4c51ed9bca0b34

SHA512
eb425066393b72d6199595c79cb5092f0220852f52691a3b9fa0e5ae1b9e5d46bacd12c28a598c8824caa31768d82216dd7da9a58ae42b2b74830574761e044e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 22853.crdownload

Filesize
72KB

MD5
9f14d8dad3856dfa4e9de47c35384059

SHA1
df9fc4c4ef86d9652495b80f8b78043692cd41db

SHA256
16ed4d228a5113fce098e69d4471b0e5829797882ac3bb5b19c61277fda25b02

SHA512
b2fb7562cc0819fe2bd0c4fbe16d10b44f112a11b7a0a7f097f4f0d61c5c1770b2ddb2ffa08fdc5b14a7603c0e2f10fa2dd445b7e23eeb55a98d8bd535f53d4d

Download Submit
C:\Users\Admin\Downloads\main.bat

Filesize
72KB

MD5
e95ae3fc44a5c7eba6148507ef0a4525

SHA1
46c88937c907435c3cf6087a63ddd798c163664e

SHA256
b45939520fbdc3afa4a7b253cc43f5739641c2b47c613ccbf76fe6e2b260cc9e

SHA512
e7b7dd55cb6b4722b849776b6ab1349601656111f7c30be6a941704bd37f1ea1a9016e364bc9460fd58d8249d84b2227a92a224be97b8719dbb7e95b8a3b9045

Download Submit