hxxps://drive[.]google[.]com/file/d/19QBwwskMHW0huFd_S1xlXQ2ySqK76b6p/view

Analysis

max time kernel
263s
max time network
256s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/19QBwwskMHW0huFd_S1xlXQ2ySqK76b6p/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1500	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
2892	msedge.exe
2892	msedge.exe
2888	identity_helper.exe
2888	identity_helper.exe
2416	msedge.exe
2416	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4132	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4132	7zFM.exe
Token: 35	4132	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4048	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe
3528	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2348	2892	msedge.exe	82
PID 2892 wrote to memory of 2348	2892	msedge.exe	82
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 772	2892	msedge.exe	83
PID 2892 wrote to memory of 3236	2892	msedge.exe	84
PID 2892 wrote to memory of 3236	2892	msedge.exe	84
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85
PID 2892 wrote to memory of 1116	2892	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/19QBwwskMHW0huFd_S1xlXQ2ySqK76b6p/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9108946f8,0x7ff910894708,0x7ff910894718
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10502154943530672739,1800113822525431502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4600 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3300

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\diablopack po update.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3528
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PublishRegister.php
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
70f9211cf517770f0533e387f21a600e

SHA1
eae2045e4a2cccf7f95554d3f0361b2ea4de8406

SHA256
e11d506dcf8f110431b0e167cde996a5f2c4b3b021bb9c86566011d0e78acf7b

SHA512
8d237050e805255b6dfe8958cf228fb9fae4e60ea78f2756f3465afea6946cdc39c42cb65aa63cea0028d5d8a8fb0b9787673329aead55bd7047431c5f99a460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
36591aed6170fd3bb9c5e4a98dd23106

SHA1
d92a09defca61f4c63d88f22046da2ebf3294229

SHA256
b14ce42bbe6a0cd725625d7a8870faf9b269cdcca636a2ce8ef6c343897d7507

SHA512
01a199efe1efbd09e5bbefd5f21a04b9cb44d5e930dad79e3fe19514619113713feb6f41ee0e12cd9b057270e28360e30d852029b2ed3bb27b5aa24ab8845d1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
87fce32951991fefeb3eb627ba2e1d58

SHA1
9200e60c1e8a5e6ae3ca6e5dda76cd244647b471

SHA256
4fea503626bf75c464517e68d1131185cb61b7f34e3ce7625c9da283a2eef018

SHA512
6bc330eda7cc39eadbafd141a4845f4f5806f624f957fd202745f8374a628c2210524eedad5a316199d0e324490268dc12eaa70990836d8560b5a8e5cd8e9b3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f0c3f4cd172835d140e39e5a4caf7bad

SHA1
13af8ca48ab44e0f315b7debfd0a29638b293ddc

SHA256
41049820f10d7d2ec6388d6e46edff15ec7086298ddb5b7acf24025299fbe987

SHA512
7ab4bd3667251444f8e7746201dfb1154db93982a5991c3657373482dd49452c952ae5b1371f94c0f070d8ed4ea93698c0beb249f49ef79f818b5f8751885c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5605fb618baef92fcd64c37f60a808e1

SHA1
f81f6d11e58fecc96c6ad44e8803cc50b3ede713

SHA256
dfe16606390b0bc8dfec5608f708b45c73fb831f22e627632f0b6933d9185ff0

SHA512
1f34e95f1a0a18942e83ff4dd911d5caa94870893919148671b842f4ada2ee749c9dfc67b018e3b4bec230c6630eea1baf5a078eac85ee3953e7e3cf8c429164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fabcaff2c6ebdd4d8d211e2e0715ad9c

SHA1
0e57ad716b021983289c3654b4e754dfafbeade0

SHA256
7b8441ddfaa0220b47c2a76750a763fac448dbce65c6d61ee92611364876e0ba

SHA512
f2fa38026307cc6f45c56bc552276efede26bc1e1613f46c882a3dc9747cdf137351d82c87407c42c844a2ce3baf68a807d4ec2342774184423fe1a896123937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e37d661952df3876e8946fd11be81ab9

SHA1
cf98dd30ecff3aced51fa19164b50e6ea9bd908e

SHA256
2986d1957f20644782880a6cc3b3af881718be926c837b3c80e8543445a87973

SHA512
4f668124baf7b00b0d7d3d2fb703d21122770b6785183505223446734857156563724d8488a068e56c173d6b68a10c1aac3494b0c4285e342775cc250e68971e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cf48816cf9279d8a7967cdd75f2d046e

SHA1
896d5140ec3144f47cb10be8e8ef5664a4eea482

SHA256
a950d9c894048a7bba0b222c6fddd0ffc588c70b415a64ccacc515052dd1ea18

SHA512
5890ea30c18176397b809816f8b291fb545b74362f59ff706eadb12d4c5ce12489efad29da535f4451131ac54fd6c722c6886900a56f230d43265703196b711c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9a369d0e73ffbeb483d8f7f59741830b

SHA1
fb99fa7bbec5fcd3eaa3a9789f81f1adb55e805f

SHA256
d08b19291e664762d0d2ad855030d694e18926655fc4e1d82e3acb39b02977b9

SHA512
d23539bb7ec8c2fe361011df836877fe4d866cf0c51b3cdd13ab30d9baf874170d6b45ab57b930f1767a95e8df6cad4a9db2050b9f28a669100e18e0cff33e4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0808b79f29b434d52e41fafd197603a7

SHA1
88ec191d5ddc44ee3102d55035da4b436ddb9310

SHA256
ac621d87574b0c121611882f51f770a7b8d4937a135ffc15a51867121b62d26a

SHA512
7eb984f5962f3956450e8ba568f63966709c0d1ba0e86ca15f9644765fb0a0cd55450b0a17a89eeacdbcbeff6dd62123821881e91ef1eb865857a258830bf422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f8cd8c1a9504d3880dc61703ef3200b6

SHA1
2f1d14189eb2ee6a97b87883db391c93d4886a00

SHA256
fc9919de15e32c91be8824085498d48f67bb0ec0957eb41f133fad95a5c28a99

SHA512
c5e572605c61c4e2c4011a9d5fde610ed4b51e1b4507800aa09329cc127dbec9053940bd4a80f09a97cdadb0ff8fb3a502ad46c815deb9ea6ee02a96ee15f37d

Download Submit