sodinokibi | f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20241007-es
resource tags

arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
14/01/2025, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v2.exe
Size

121KB
MD5

944ed18066724dc6ca3fb3d72e4b9bdf
SHA1

1a19c8793cd783a5bb89777f5bc09e580f97ce29
SHA256

74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
SHA512

a4d23cba68205350ae58920479cb52836f9c6dac20d1634993f3758a1e5866f40b0296226341958d1200e1fcd292b8138c41a9ed8911d7abeaa223a06bfe4ad3
SSDEEP

1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZs/WVEdz725sK:J1MZwlLk9Bm3uW/Wud2K36cn/wCY

Score

10^/10

sodinokibi credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Recovery\6e0195xp1-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6e0195xp1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BDBAAAF056CC7C1A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/BDBAAAF056CC7C1A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XynVosKHKo0LdOzf8YzaweVsTDyzC1V2OV1n3yl2q89CEZSOlqSL9EYSuM5inrb2 7LJxLX33TkFBlzAqQgdwbJI7wMHFG4aLCHljvq9V+7xsQOg6clJHz/UjUI+ougI+ IZbr0w0JrwsSO6KLoBnhmv3djsaVTXD+NR+bjsukuxLbnyG8IqUXpELQCrtxEcgq LmbaLp3Q+7PTfYXEeBP2LcGMPLhlqQO6M1Tj/jv4T9wfgHTXR+W5eMKcImBA6jQU STbLbFNZ4e9U4ED7MXVDnwGoF1tGEjaFmaZ0vm8eOMr9V7iqKuOP2QhC638ewFtL 2IEmMnS4pScJeK2IHEYgl5x3ScHffyVBK6+P9aVEUcj0sRmCT+SG0lEjXHm1TRUH 3oV04OytRiRPAdAsYAcysw8K5PUGFk4hPwUfeLJWXiFJfMvi1YsPz2WaVAkon7l3 4P4epK2XibWEfJSm5aZ02hblDdhf4oNIb2PM+Yh2GFrie74mMUFWccbiktGsUhUs vGpAZ1EPJwPU0uyyNNF/MZL7hSSyZbYC1ZaDdL0FVBNp3dNJlx7PaHAOVHXG1ioJ bQJI+VrbiiCjx69M8ZyJHpxMH8NqyV+2dTG+O25VB33QhQUSLP+ZFxm6aX5+RlgJ 67YoVgyr+L8vD8psErN/xyLgyjdil8VZZPmUnsdWAROaKcX5inV9jYbDa/d2Tz2X CWKXD0S91jhcS5iPDfsjQDBUYHhH/nn8DaXy+zT7OpJ/0J81lAjCJOqqh+Y4JAjc pFJH2ehzjpwT31oQdJhekfG5SB9SAt6E7uiOyxnSq7F3pOEdxFObW0yTR/95UkF2 Dy1jO09TAuCqjw1z7zmHGvDz/8fzQdWmUFQpfhBX0ueCs8+ozzZzVrggft73N5Xd iI2YUxjZsR9wzbkW6PmqerYAgkof7d8T3zBZBtM9uJHpfoyhyzTOkqeYK/DPkbVL ZOBPaRRQw/ewSyUyue904Hxrh92Jnku6EHxt1HNw19fTk3zA/53IJNDclXqD4RXt UFzFQw5L/OAxBF3xpjT1wjlTArfRaIdF8AUI+DisfwARkMDQUVY+vr5i8K1F5ZyE selVcQs+8CjLXtg5uFoPbgOJ/nWiZpMbQ4GE8Nebd3ImgXOGUrdONIk/oiEruhjX vlalVAHGx30DscftUZbIomTQ9SdW4GYgkhxzG3gBzMkHPFXJu4mttoal31Fx+Z0w ehN1VsyeU4zHGo+yyuCknYmhNZUQkZ8Evb9KdXvZGPoLDbpF6nvhsaQu8XOEwbil hDrWkIljGc8Q/TKmzhAV2hjO1L4lJ+12kn3fVuIwBemJofCBrA195KZADGvmMO2G J3x1hFYUGirdNKavx3Kqfm9HtbkEUwFJ3uzo3pC9ZEtRLg== ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BDBAAAF056CC7C1A

http://decoder.re/BDBAAAF056CC7C1A

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\6e0195xp1-readme.txt	v2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	v2.exe
File opened (read-only)	\??\G:	v2.exe
File opened (read-only)	\??\I:	v2.exe
File opened (read-only)	\??\M:	v2.exe
File opened (read-only)	\??\O:	v2.exe
File opened (read-only)	\??\X:	v2.exe
File opened (read-only)	\??\Y:	v2.exe
File opened (read-only)	\??\P:	v2.exe
File opened (read-only)	\??\S:	v2.exe
File opened (read-only)	\??\F:	v2.exe
File opened (read-only)	\??\H:	v2.exe
File opened (read-only)	\??\L:	v2.exe
File opened (read-only)	\??\N:	v2.exe
File opened (read-only)	\??\T:	v2.exe
File opened (read-only)	\??\W:	v2.exe
File opened (read-only)	\??\D:	v2.exe
File opened (read-only)	\??\R:	v2.exe
File opened (read-only)	\??\U:	v2.exe
File opened (read-only)	\??\A:	v2.exe
File opened (read-only)	\??\B:	v2.exe
File opened (read-only)	\??\E:	v2.exe
File opened (read-only)	\??\J:	v2.exe
File opened (read-only)	\??\K:	v2.exe
File opened (read-only)	\??\Q:	v2.exe
File opened (read-only)	\??\V:	v2.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\v79q.bmp"	v2.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\6e0195xp1-readme.txt	v2.exe
File opened for modification	\??\c:\program files\ConvertFromCompress.cfg	v2.exe
File opened for modification	\??\c:\program files\ReadOpen.html	v2.exe
File opened for modification	\??\c:\program files\ResumeRename.dib	v2.exe
File opened for modification	\??\c:\program files\UnpublishRevoke.vdx	v2.exe
File opened for modification	\??\c:\program files\WaitJoin.pot	v2.exe
File opened for modification	\??\c:\program files\WaitDebug.zip	v2.exe
File created	\??\c:\program files\6e0195xp1-readme.txt	v2.exe
File opened for modification	\??\c:\program files\ConvertFromComplete.asf	v2.exe
File opened for modification	\??\c:\program files\ImportEnter.wmf	v2.exe
File opened for modification	\??\c:\program files\RestartEnter.vb	v2.exe
File opened for modification	\??\c:\program files\SaveFormat.zip	v2.exe
File opened for modification	\??\c:\program files\SearchUnblock.odp	v2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
956	v2.exe
956	v2.exe
956	v2.exe
956	v2.exe
956	v2.exe
956	v2.exe
956	v2.exe
956	v2.exe
956	v2.exe
956	v2.exe
5380	msedge.exe
5380	msedge.exe
5836	msedge.exe
5836	msedge.exe
3460	identity_helper.exe
3460	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	v2.exe
Token: SeTakeOwnershipPrivilege	956	v2.exe
Token: SeBackupPrivilege	756	vssvc.exe
Token: SeRestorePrivilege	756	vssvc.exe
Token: SeAuditPrivilege	756	vssvc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 4632	5836	msedge.exe	102
PID 5836 wrote to memory of 4632	5836	msedge.exe	102
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5376	5836	msedge.exe	103
PID 5836 wrote to memory of 5380	5836	msedge.exe	104
PID 5836 wrote to memory of 5380	5836	msedge.exe	104
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105
PID 5836 wrote to memory of 5024	5836	msedge.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\v2.exe
"C:\Users\Admin\AppData\Local\Temp\v2.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\6e0195xp1-readme.txt
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffefc9d46f8,0x7ffefc9d4708,0x7ffefc9d4718
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1352 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12080541982819630360,3110711021273410101,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\6e0195xp1-readme.txt

Filesize
7KB

MD5
6412fc53d7ea290e6217408bb368be4a

SHA1
0364461239bd293d2249bb7ff430bfc0ed308451

SHA256
a46d066a44d05a2a9a004507aea5b51bb71282284efcd99ad7d3b0ae5b08cbab

SHA512
b06d4d4c18e06ae0ec235f06e6b6c0d2eeb89dc325b401046ab6eef01ed5b1bda2a6e60e2d17e2937d93b3a870e52c677e0254b1eaf721c0ef3f513ea718a06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85da36f5-b51e-4330-9356-c8d28bc591a0.tmp

Filesize
10KB

MD5
d407915797e98be67d0e3427681c63d9

SHA1
b3247679a611a978ac4bf45402eba428248d9aaa

SHA256
e2e70c6b02c05926d7d2b27801e491d33b60e873c8b22bad0c3f0a5e5dc11140

SHA512
7f8d7060d1fd4687a6f4dd0b7374f77458863fc13a75121772908135438f575d3ca5319cce819b6daed7d3c694a3e460215870379db2b7caccfc7c0cc588cad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6703A6B9-1654.pma.6e0195xp1

Filesize
4.0MB

MD5
f9fa7af53e28bb83ffbded08cbccf464

SHA1
2a099d2dc8a64d9c8cda43757597762117b7db4f

SHA256
9c087117a26ec9ae8e4db2c414de2c820a35f51931a98a9986917db09090eb2f

SHA512
bc0534ab21d6ec734580dc6e89df3ad9af82dc8826ed2286ca45cbab2d9140d3974d37a458d0989010566b6c2249380415db3f1eae30e3a5d6f04813edcc2163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6703C4D2-D84.pma.6e0195xp1

Filesize
4.0MB

MD5
a18b4d0e9408a849c8cf32f676fedb14

SHA1
c9f8b85f5f01c7bd146d5ec045ed70b6931662f2

SHA256
4007152a98914f0e11e515735c4db1f86e4099a77809c3f7654a20b472b6250c

SHA512
7a8f70047ace2c0c439af93016babde69a2295179f95b89630adadb8506e3194d4180123b1ee49b397a0566a841e0ed86a67a2bc5b9896e671293132aef51cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e16b51bb594ea45001b1b28149d53809

SHA1
a07c4dc59af8959a8813fa9c82dd98c50263b246

SHA256
6f4c54dcbd1802d82a3d8ad7ce979e59d8c81d524ac78b5f6410905f9eaa3528

SHA512
52799c4d82cef8d24b57a4828a83ea56e18996c784dc7df716216f678c91f6b1af4a0e0b63cfd7d506681dbcdfc3ec5d30badfc7f81c2b144da76475694fb080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8536e324296ee95f051e16f5cabfadca

SHA1
5b8f57c38407eab35da4abb9de8971aeb08de0a3

SHA256
1b6ef8cafc2456f0584c1be48ee580251f470fe17b94b3c2633c2a9907a25a1a

SHA512
2b5a6a70b85fcfa8fc529261ee6c953d9bab44073bd340f5987dbfe73107f89fe5dfcdb539c479523b82872182379edd75af0ce4776910f94a0de23bec595bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
17d10e6436781c698feb27ef9bbfa041

SHA1
daea254acf4bd1e3fc8ea571f92b21cf734edda3

SHA256
76d5fbc0eea8d5da8ec763aaa812a94f41666eaf76efb699e9105d1e180e557f

SHA512
3947d363d8fadc24a0ff95389ad5847b4421165358905e7bcbfbe6e3cdf2d4437fdba1a66691a1fd794b38e1aeffee7a81af7a7105d39197d7ba0250f427d91a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\277d7a03-f449-4192-83b7-89484b397792.tmp

Filesize
4KB

MD5
7537ce802dd6a278e91ec5ff2686942d

SHA1
60f79a4ead695efa0e8e20251fe6ab6580e89bd9

SHA256
29037db3527035205eaf7094141263c9f499adc57c817b278cf14fb51eb92b26

SHA512
983aeaecf372b6766a7b93f109cd18743ff958e286918eebba315ebaf3a3ff0339a11630be2c4f622d9c0b33f15b627d71cd6a0d592a5b2c0e64132a9f5cbd97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6d8e6837d486d22aaeeec4a7e34f9b8

SHA1
bf8873db2345ba47525e9b5cdf92637918ab865f

SHA256
9fa9e0366083919e592276ec312acc50d7a92144cd8125ae2ab6da07b2aacbbd

SHA512
b5305e98a53497643518e8a00bfe309c2c9a07a4262230da8777b2609164ad1147ba62b420c759faf6351adcb4a2d77ad2480b561d88a923fe73ab3c4f83734a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
390e42aedb3891ec9f9a4f6a7032be3d

SHA1
ed3b6832076921df4659bb86bda39327e7aa1678

SHA256
59ebd01b6ef1b2160c65b914bfa4ea26545363fb9c18bfebee10063ceaa86f89

SHA512
5b2b7c923822ac8d246ca9322f2dd7ea89dea0b039dbeb37aec39351d62f391fbb5de8033582696ecf84d842d0a65055b2970a0103d59470aaa54cd80559502d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
093116119ef2abfe1998240d20e545d0

SHA1
71a54059ee3858b2f4cf97d0a4efa4ff499a3d3c

SHA256
488810e9a99948c60a000dac434501f955a8abd2a45ffb1c4e7ef5eee90199d1

SHA512
7bc6fa5627708899fa670ff791b19ed40b7fac9b587bc5cbd0bacaa4ca2a376b1797134230c3edbbc0f5743d8b4e3cf7526c0949bf248a8315bf5273bf3fa501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe591b7d.TMP

Filesize
24KB

MD5
e74977295b693c18efbe33435db746eb

SHA1
0635a7782a64d277e4d61bc495e645ac33cb4cf2

SHA256
c72b2bace02654daff2cb480259674c9fb2f724d37cee424ff9a845b59eb6e2c

SHA512
d5a7e757d7a9d3f23a8c0eb24b913375f1f52c54e7761027154a1cc76422bd3dc440fa8e032bc690d16a3117fe4a60c7a85d2c8f53e4104850adc71d8e37c629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
4459bf26eebf0293b75c624cdf1c6b23

SHA1
2a0cf63d7d2a2a729b1b84e221955a5ab46f2e47

SHA256
2ddd13a6fc974d25f11c33a905c39ba8b6d266f7c58a93a41e5ada5975c821c7

SHA512
f9246c653ea54d90833734d359ebba743e97a7978639a8c48f64f2b026affed9281e65a44d12af2224e0493df1e3ca3dfd8fd101bd4c5170471b5dd6dbaf8f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
51139bed099fab01a68e400b9d27ebce

SHA1
4a7aaefa68823aae9e578e2cc4d40410e6de338c

SHA256
d551f165d40185209c31da1d1d97b63a8bb73667e19cebeb6b64da10e17b24a6

SHA512
e584b40122e7d13205b285f19711dbd14048185779c667ceb8176667413e4300931eb574a88a3e17fa660265570a8a6ce96cb5a7a2a0a93e490cfd9c4620762d

Download Submit