hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

30-01-2025 16:48

250130-vbellsxja1 10

30-01-2025 02:38

30-01-2025 02:32

30-01-2025 02:25

30-01-2025 02:21

30-01-2025 02:17

30-01-2025 02:13

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
30-01-2025 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

8^/10

defense_evasion discovery ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 1 IoCs

flow	pid	Process
32	2908	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1592	$uckyLocker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
32	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	$uckyLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 176159.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
1996	msedge.exe
1996	msedge.exe
440	identity_helper.exe
440	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
960	msedge.exe
960	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2412	OpenWith.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2412	OpenWith.exe
1456	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2952	1996	msedge.exe	77
PID 1996 wrote to memory of 2952	1996	msedge.exe	77
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2448	1996	msedge.exe	78
PID 1996 wrote to memory of 2908	1996	msedge.exe	79
PID 1996 wrote to memory of 2908	1996	msedge.exe	79
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80
PID 1996 wrote to memory of 4128	1996	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8fe0c3cb8,0x7ff8fe0c3cc8,0x7ff8fe0c3cd8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Users\Admin\Downloads\$uckyLocker.exe
  "C:\Users\Admin\Downloads\$uckyLocker.exe"
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,13439012138751275666,7063160219973636228,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3044

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1252

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3152

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1588

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:432

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3629245a-6143-4c6b-8f50-fe350a321548.tmp

Filesize
1KB

MD5
28a7eef0436fa725335b2626ba9664d2

SHA1
0545788ce9894328ac811964c169807954b6ac48

SHA256
609c10706dcd497aede0f075fa44d9cd716c66ae39051f4036b6bf58c122f993

SHA512
f851b54bd03028c0ce196464fedc5cb40ef064111f7294d7df4424c4b086b6ab776910bbd7a01cc1476a93ac4141f8911de86683177f252023b28112bc338116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b341a3fa97d955e925dbb4ed99a15d64

SHA1
b4874c0f8ffdaf7023e068f4892dbab545509ca3

SHA256
eaea6ed6f2863524727afaa00fc7497fb599ca38d463ab670bce985ec2f9a167

SHA512
5c6802ce29f464ef9e4fa6074316e4a3eb5e14f7404180f8404b667eb23e8f76a66c77833472415cd74346b00c9503e85b64a8209384d975eaf5a7df85711aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
75237b876e4ebf0cf587313ae92b7952

SHA1
ef712d6b1e678d091b39cd593b8d4a2a5520f139

SHA256
d7abd571a35eaba20a7c57d7ac93cbb59b8d4b417f4b67590ee1c29ff561442b

SHA512
0c96b1f590a69141018c2112e36de65fb30ab57320b4b76da3a672b23c716197fc06e0f381491975319a8ad4ae138660469d3149cfbb69be96a2cfdfcaf802b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
75be66d20c9049e715daea5a69c9b433

SHA1
ec2bdb461387405437693e5f6a80472ea2c81119

SHA256
bdd23542263c4e5fc809099347e75da11ac4d0cb0dce8a1f05e37b5c7a43e581

SHA512
3448e8a5d7ee77bc898e099108321bc1edd80c593e1caa69840d8890dbd9d0caa4bc5491002fa8f2aa7cb0f5e4a4e1ca780f89c6572eff53b724ebe7a2427a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae74ff8732dddd9e38689373732d5fcf

SHA1
d0b0f8a51013f13aa53a292d96a2d498ee05c789

SHA256
f9d7a4189d7e2b08f9c0e424c7cc5c2aec246f33baee14253c81e278a9869e96

SHA512
ef6f4af7ac17706725253bcbd849d7515ed83af93a438aa5c4f9ca4cee25beec758cbda15e0f4aea8db3faace27db573b6af3c1df05ae8308ab5549984103b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11ff88357f812e5c18557a2e19b5ee22

SHA1
d8fd8ae5df7e8482f5953038f604466495d89338

SHA256
c47002a7de05517c166ebc5075868b43386d779a44cf90b424fe96a664083412

SHA512
a149e9fd9e8cf9fe63c966aef8f96b4f321b40cb0fb8a8d1d5d7e04348bd3280e8cc331ecfff2bac8e33ba0c01a375d53d46c11e9f07138f9140e48394c946eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8dc5df3ded6bd27d4e165dd5fa109d09

SHA1
6efe6b6531c2395512f5048602634c5b9feccfa5

SHA256
44e0359ab7b7fd179c892246bf2029e94421fe20e3226191101136b96295b9a5

SHA512
5f3eb238ca8443714accf7060f426bed6faea81272bf59b2a0fd221adfc9fbabf9a6153c836e95d085ad109d32d5a70c85dc8579437438aaf88f09e14024bdd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57daef.TMP

Filesize
874B

MD5
32d51815c07207464f8be3929c83982b

SHA1
90bf985e04a96400166e53e9090211023997a850

SHA256
6cbca84c25c12ec961a7a0a2a2a459b3726c60b6825f568df8529994aeeeac22

SHA512
1201c4d013da64788b9cab80f8dbcf5122a8b131e64891a38fbabea7874645cb4628a8d81967fd2948f3c15ffc0442323bf297e633bf364bd2e4d45fe5dd7d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
62890e0c9101240bc862bd83fefb0b83

SHA1
9ac200367ed588b466a4fb06133cbcbf9563ae3f

SHA256
106810d55d7047050d9edfe2801a358b62768702a3f220d9ad070c739d7ce505

SHA512
65af38ff807592aacbf843aec83bfe22d337e76ef6e9a6266c558adde34990c2f30f2a678af5464823ae172197259bb2443f181fd8774f31b275d46bd8fa9643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ebff69fcacf1238fe6f624266f1e356

SHA1
6b670d2b7943633696dd330b3fe143b9fe4eb99e

SHA256
379716b3760130ea49d30c6aa0c48b56f5f3d5ed39706140344915d900f8ff16

SHA512
63b5f897940f361f492be6ed3ca6295b497f4a502b869d8394376c641fd750904bc6197de7b9d31677ebb49ca2522a504deec43dceb84ed62f326df95f150f1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
480fb2fed1557248ac63e66c5ab675f0

SHA1
81214f021114d81eacd619c31ec20feed8a96b9e

SHA256
ab83fc71c1f19ecd7b050f04502ea481c1028ad75b7530d2ae3e406ffeb94765

SHA512
eefab4e91b5aea300b6410e81a66d08e4e1c6b16634923ffb4ac03bc72009a636ce79fe375a6f1e411f0336aca95b846a70df5c3961e0ba3ebcd827812b93d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ad1256223e3ae1e14ee853651a880da2

SHA1
2798357295851533265d3c7c7e65a96fa92d8c12

SHA256
27f798b42c4d63abd9462b5830c52406c50ef5820b10d900b33f7782e95589b2

SHA512
66f630df5414ede3ed93e404238d5d6da614bdea8f77c40983a3c005113861cc819c8442b0949a35008082e39819632637fd23476ded53aebf3c2c067ccafb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-1-30.223.1588.1.odl

Filesize
706B

MD5
31ab55418ec7ff19f196718324563c21

SHA1
32364f9a544d171483fb312dc4060273618aa13f

SHA256
011309968ed3dd900744a42d6f1f49645c6028639da3fbb8e1a7d7858234973f

SHA512
3b9c78245d47019929cc5ad2b273d64806c8de4e2752b6f3800c3f14855b4e422d179c0920693a4b111d8e9104b86f102125a6dd094e58886f4f77243ab7b646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-1-30.223.3812.1.odl

Filesize
706B

MD5
d29a5b9b10a0b59baa0d9663b79b25f3

SHA1
8cc88b1de6fe5753b4752d74ad7eee4b34670bfd

SHA256
fe72d16a8f97a831372366244b82e4b97acdafe930b1cb5257b68b74d7dcf905

SHA512
2b3c097c5cfd8193a64f3948875d31909aeffecf0da8dfe538683f0956e7b89c12d8985febb005220d10e78f27bed96d35e4cff806cb0a80f16b9bd13c11eb50

Download Submit
C:\Users\Admin\Downloads\$uckyLocker.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 176159.crdownload

Filesize
414KB

MD5
c850f942ccf6e45230169cc4bd9eb5c8

SHA1
51c647e2b150e781bd1910cac4061a2cee1daf89

SHA256
86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

SHA512
2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

Download Submit
memory/1592-245-0x00000000054A0000-0x0000000005A46000-memory.dmp

Filesize
5.6MB

Download
memory/1592-246-0x0000000004F90000-0x0000000005022000-memory.dmp

Filesize
584KB

Download
memory/1592-247-0x0000000004F20000-0x0000000004F2A000-memory.dmp

Filesize
40KB

Download
memory/1592-244-0x0000000000540000-0x00000000005AE000-memory.dmp

Filesize
440KB

Download