hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke[.]98[.]exe

max time kernel
144s
max time network
149s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
10-11-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9dbd133b.exe	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
4412	CryptoWall.exe
3648	CryptoWall.exe
4756	CryptoWall.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9dbd133b = "C:\\Users\\Admin\\AppData\\Roaming\\9dbd133b.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9dbd133 = "C:\\9dbd133b\\9dbd133b.exe"	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
97	raw.githubusercontent.com
98	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
103	ip-addr.es
105	ip-addr.es

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\369567ff-d2df-48fe-9357-33ab48e52c70.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241110100539.pma	setup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
2552	msedge.exe
2552	msedge.exe
1516	identity_helper.exe
1516	identity_helper.exe
2900	msedge.exe
2900	msedge.exe
1316	msedge.exe
1316	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4412	CryptoWall.exe
2512	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5800	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3436	2552	msedge.exe	81
PID 2552 wrote to memory of 3436	2552	msedge.exe	81
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 984	2552	msedge.exe	83
PID 2552 wrote to memory of 3600	2552	msedge.exe	84
PID 2552 wrote to memory of 3600	2552	msedge.exe	84
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85
PID 2552 wrote to memory of 3348	2552	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ff9bbaf46f8,0x7ff9bbaf4708,0x7ff9bbaf4718
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x24c,0x250,0x254,0x248,0x258,0x7ff7a5995460,0x7ff7a5995470,0x7ff7a5995480
    3⤵
    PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:5436
- C:\Users\Admin\Downloads\CryptoWall.exe
  "C:\Users\Admin\Downloads\CryptoWall.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:4412
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:2512
  - - C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      4⤵
      System Location Discovery: System Language Discovery
      PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7048381488073576776,6603278940076264168,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1392

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5256

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5288

C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5800

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5980

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:6036

C:\Windows\System32\SecurityHealthHost.exe
C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2400

C:\Users\Admin\Downloads\CryptoWall.exe
"C:\Users\Admin\Downloads\CryptoWall.exe"
1⤵
- Executes dropped EXE
PID:3648

C:\Users\Admin\Downloads\CryptoWall.exe
"C:\Users\Admin\Downloads\CryptoWall.exe"
1⤵
- Executes dropped EXE
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
467bc167b06cdf2998f79460b98fa8f6

SHA1
a66fc2b411b31cb853195013d4677f4a2e5b6d11

SHA256
3b19522cb9ce73332fa1c357c6138b97b928545d38d162733eba68c8c5e604bd

SHA512
0eb63e6cacbec78b434d976fa2fb6fb44b1f9bc31001857c9bcb68c041bb52df30fbc7e1353f81d336b8a716821876fcacf3b32a107b16cec217c3d5d9621286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cc10dc6ba36bad31b4268762731a6c81

SHA1
9694d2aa8b119d674c27a1cfcaaf14ade8704e63

SHA256
d0d1f405097849f8203095f0d591e113145b1ce99df0545770138d772df4997f

SHA512
0ed193fdcc3f625221293bfd6af3132a5ce7d87138cd7df5e4b89353c89e237c1ff81920a2b17b7e0047f2cc8b2a976f667c7f12b0dcc273ddc3b4c8323b1b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e2daa0a-77b8-417f-a869-cc85c9375d8a.tmp

Filesize
24KB

MD5
5c2d5c900312f44e72209416d45723cb

SHA1
68fb8909308589149399c3fb74605600833fbbc1

SHA256
56f7a77549e5fc45bd4b1f7c2db3e8b4bd1dd9234545207613a80342cee8e7d8

SHA512
07c2920cff7c1125e3a2fe66bf21d8606a1f2a3d36be2d8e136da0d2a21130242ac8324f18cedfb0040304cf804815861767c969a6923d8db851312bf9b4348b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
e779235ac1b6b9348c50b06db2070686

SHA1
b1617635351475fc7c63c070507a7da7d7b9f7ad

SHA256
2ee1c639da19a8a9a2a6af8fb22835740de2374a078b24d57cfb2e11f42261c4

SHA512
d646a2eae0f09b1730f87777d528d39ffe9725570491ffbf8817677e4b7238b37c1a49a66ba5e059d38784af0e5d5e12ecc7ed47285748915ec91d0dafa970c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bd5fe5baef025f4451ed708ab47787e5

SHA1
a5499d6449a5cf008ec7ff56efdf80525fb10b88

SHA256
5c6be2c963daf3d1f04d0fdc7455d3aa10b8ebdaca9f81a944d935fc80c41fbd

SHA512
31eec06646ba088cbd17983ed6da92a60cd15ffd1c9c07a9bffa7af0d14dae6c5b52b842e98566728d42573dcc2bdbf9bf7a7424df9ad6b399c62c73e90138d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
d22266ba3d8db30279b96944f0cec985

SHA1
44e288cdfe75a5e8299ce32e75dd9e0705cdbac9

SHA256
77873629fa695e434160c86ae9116906ff65a97666d7d35a3ed63221b627c0bf

SHA512
d463aecbdac835dace5544b4267c86c2ed7d3165ba95095db6dfc3a25655f2391fa202a81d37b4a76a36f04456ed86df137302ad0e456fd59ecdfee3c69c6c1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5875a8.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4754fbfc6343d046cb8a26b90886e0c4

SHA1
c737efcc532bc856bb6d638db2bbd812e870c96c

SHA256
84c0074db39b2a2a79d11a7bb578467db0d1d1cb35df39502207453e5650191e

SHA512
73ef1ef2c5db3020660177a488831620b323948ecd4102f3952a0365e748a273d53466708b522e93241affa023d8d47826b0b04cd9ec25723c55a458aeef3ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f609cb9ef45f3b1ba266389b933ae10

SHA1
787ce59bcef97ec368635defecd2655736660d0d

SHA256
2453574fe5f0eb47b57a759583a361f8fc84011db912213cb831d5eaf53748c9

SHA512
3c02326ab9170af58224b50440dcf85e94966939e6b241d5c7cc71694ec13f796354d9d174b47f71e7b34e6f045908262c72446b24c81f5565c448b9587e31eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb688b517dde6fd366c9bd16cbfc19ac

SHA1
e3d4ed194bb70ba3a957847740525124a6e85976

SHA256
b1c25539bdd165431c44b38c35e28c515b72b169e37c006bebf0cf9b366cfb52

SHA512
6483114948078b69c43accd2b97a17e8514181e760baf8729c70f7696760523b73898be4ac47ef377812ffb7bd88055114c97e8b3fadb2853f333a99067e5b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6baa9da148db90ec45ff7ee4a95510bf

SHA1
7885990060385abf0512c4ec1a40c702f5ce6631

SHA256
da3a23dffabb4e608dc794492c34d807137df4221a95d250b9b3c0d12a3bbde9

SHA512
7318655285d0571051eb29a4313410173e9e0c372e4bd2c8344e2d4a7798cced1f8e15b3687fadea2e1e12d2de897d6cad7cc79601fedc9ae6ceff9f281ddde1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56ba934ab4a3dee6f3c0b6da02b68217

SHA1
fbe2ba56680f22d36befc3020207c76baafc7dc8

SHA256
8caacc190b32becfd8c46501048713f5e85a1cb9e37f1c510dcaea4153198c1c

SHA512
e956f184617e7246800c338e84b127cbc201e77977a7ebec719ef067d4753f8a02adf69b244e219132befcfaa3690e69e8863335fb78c90c21a7ee1f15996519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d37de2c6eae02163d33245b7048eef6a

SHA1
907f6431e6e963bedf188168fb96c502a57038e8

SHA256
b77db629a64860e98fefb5f797d6baefd73d1d746beb36f6b638b02792ffede3

SHA512
c129f167b8297d368e811604498c95a9662c67d5c07048a9742b01ebcc7c8f526574c4ceed10f5650be1077bc98a98113de03e2c7fb59c634af98f87ea1b4d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3b964859deef3a6f470b8021df49b34d

SHA1
62023dacf1e4019c9f204297c6be7e760f71a65d

SHA256
087debdcfba4666c03a5ea699e9bb31cf22ef4e0fad7c961cb0b500e5d262fb5

SHA512
c30b7e1b28820a5815b52634b46cb210c241704e33e41304400cb3ed29e82ec547a1068fc819350b368456bcabd27034afade5add3251dc74e4174f51b6c7adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
b223d529f8439c000ef0cb488d03d7d1

SHA1
0bae90cd6e9779c33a7c487ac582096194eb0063

SHA256
d17228967a49616312580e5e3ed1f370931a6cc0303e6284cb8488a497f622d6

SHA512
18e202a166a2d6fc5a4b0fd6234393f1e9db310e59eba5949ff0c42f9f4da0fd72c777959886eb718c7cacf6410e34d8ee753ef5b2c2e81dc732d86a30c8d29a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
ad40e3dddcc47b386d472766d7c2810c

SHA1
f8ce803e880d8a304e646817897795888bafec3a

SHA256
ac3b75927e569f6c6f9f2ea7d1ba6083346daa0ff965a844ff997260b72380cc

SHA512
5b3153e0a85af99ac034b5ea5335436a78ab7c526c85d4464395272675ba076d789aa6187789182a625a633e600348b879a7d76e621bca6dc6aeb331a6d761c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f043cf36ad707ad51091005058bf549d

SHA1
80270a67e99d4cb1d5f2e9b7405f743e4e733303

SHA256
6428b09e16fd81696675ba1a62feaf42508e90794f928dfc9f5ad96bae2cae5a

SHA512
8632c1dd0d775feb31e49ca7215f9f46086eda266f45f636a0840a4496e7403715460e97985de5957a98c6619dae13e89760ef831f4f2f396a16bbb98314a6c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
26b930e57348c165bfa3462ee404820e

SHA1
d0c65d7ee1d97528ef186eafba3f8440c1d5249f

SHA256
6e79bf02a2fb59adf11d3fbb7ca87615f663acb12a8a4fa9ac5347ecb49f7843

SHA512
4137a46ba747a1bbfaa0b325cdfac53850d510b7376ea7c60f6a27972be0e9e1c5436dbeb73d1b854428e86a894588ae4a5b9f7eaa09f405ec156f4f4bccdbbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bac4.TMP

Filesize
874B

MD5
e9a7e263bf85b1c147c831e4fa7226d9

SHA1
9263c9b2da878616e80c140a98451b85791e8445

SHA256
71cfa73093215ce116abf8282f4866c72960da9c66b39f4a287b77cf9bb8247c

SHA512
1342a3ea4833d924215ecd78c518e0e97920326d4dda45e450be2f31e27554a8b6ab13ded6d8b8ffbb039f9853cf730ef6cc740707c743ce03a17929e99dcb90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2a392ae26d1058dd620cefe14e55c964

SHA1
77fc11a5ee83662a8ecb9bb23d3df1347d339f99

SHA256
4d65200e09dfc00fc432625612df02952b0aa19d2e528c3ccb37d2f19d8e72e1

SHA512
d1b00f2ed73e23832a4d82db0878d7a91f39e01ed4d2763f5b26f32c3c2316a3faa90022a6b42e3ba8f92692a070a135fe02a1750c5af5f2d0932541b7ad9524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c616d5524bfadce8a2b889a589e194a

SHA1
5cb414cfb50cbf9be9d529cef14ab2667f04fb0d

SHA256
a85d58d149ba968dfe99223c7f54e4468de10bde74f27c356b0c78dd18361e6c

SHA512
414f9eef9c1c226185f736cc24318e881fc8a95f2d7bf58e1ec511b8fb27be53c615cc06a49a3a4fd1455962a387d379765770788b172b88713211552111cc2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0277a4e2110f76a4a80591a8734475f2

SHA1
6d3bda87c1a2782e3108360f767391bb604d393b

SHA256
45ffa37d9f9adefa1a0ed55981c996716226281c632b38e3a79827e82fd4cc3b

SHA512
5d109d63d885000cebac8857a084f4f0db005ac6aa90a3cd7978a9f4759f005fdfe7071f9cf7cb4da6e14e4c9565f9f75c00f0120fab89fac4e1d73bbcd758b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f9534cb3-766c-4de9-8940-cbadec456b12.tmp

Filesize
11KB

MD5
b8cb91e0bb52cefe98d0fe646abb1c86

SHA1
0cc36ff1ffdef045cd219dc261a58aa605db67bc

SHA256
1a8aff89917b5a4b501f700170ac4b863025f9e8e393562263cdc5d7a13b2f11

SHA512
1fc2bbb85736d00816eee899703c138398f822bb0517b5596bc6a6618ea4e859a9cf05d1b9a386726c3ceff40cff6506c7ef9ac3ffa46fa343370c260f8ff934

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
137a880b78e6e462e43e62d97a5b43b6

SHA1
41a6076aa5ec464ab6dae6a8c32f3cc5ee6d45e5

SHA256
51a37156e7255d1798d06dd538054fae97d65415b043c67401c9ab7ee507013f

SHA512
436a31e432d477440b3e26323207feb73cc38e6784d306dd188907a93453a24b11979f74441df79c6630f526f1088ec653606a9d9fc8d9d2e7601b8a20922450

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e22e711621b92d21926bf6c83b057a05

SHA1
ebf34b9a08f32acda7ea0da49bb55bdc2f23c2ff

SHA256
afdad18a0971d332a514ef0fda43cb8a5c4ee4a82c078c451de3a187a34094d5

SHA512
ee85426aaed51a0f550cf18183dd54f3c7fd8bd87e76d9660a3968e2d9b3be621996f81ebd82d04ec0ea866897a3b6706afc98593d91c9fc57b966f0ef1d2e73

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 667700.crdownload

Filesize
132KB

MD5
919034c8efb9678f96b47a20fa6199f2

SHA1
747070c74d0400cffeb28fbea17b64297f14cfbd

SHA256
e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

SHA512
745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

Download Submit
memory/2512-438-0x0000000001020000-0x0000000001045000-memory.dmp

Filesize
148KB

Download
memory/2512-430-0x0000000001020000-0x0000000001045000-memory.dmp

Filesize
148KB

Download
memory/3768-434-0x0000000000940000-0x0000000000965000-memory.dmp

Filesize
148KB

Download