hxxps://github[.]com/topics/malware-collection

Resubmissions

04/03/2025, 12:34

250304-pr6r5szybv 10

04/03/2025, 12:24

250304-plgaas1k18 10

Analysis

max time kernel
367s
max time network
368s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
04/03/2025, 12:24

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/topics/malware-collection

Score

10^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
2560	Ransomware.7ev3n.exe
4148	system.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
52	camo.githubusercontent.com
57	raw.githubusercontent.com
1	camo.githubusercontent.com
36	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ransomware.7ev3n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31165717"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2205556625"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "6"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786730451-600132509-465537259-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MalwareCollection-master.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Locky.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Locky (1).zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Ransomware.WannaCrypt0r.v1.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3860	SCHTASKS.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2564	WINWORD.EXE
2564	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
112	msedge.exe
112	msedge.exe
2060	msedge.exe
2060	msedge.exe
4048	identity_helper.exe
4048	identity_helper.exe
4892	msedge.exe
4892	msedge.exe
3740	msedge.exe
3740	msedge.exe
4636	msedge.exe
4636	msedge.exe
5084	msedge.exe
5084	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	4384	7zG.exe
Token: 35	4384	7zG.exe
Token: SeSecurityPrivilege	4384	7zG.exe
Token: SeSecurityPrivilege	4384	7zG.exe
Token: SeRestorePrivilege	4312	7zG.exe
Token: 35	4312	7zG.exe
Token: SeSecurityPrivilege	4312	7zG.exe
Token: SeSecurityPrivilege	4312	7zG.exe
Token: SeShutdownPrivilege	3076	shutdown.exe
Token: SeRemoteShutdownPrivilege	3076	shutdown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4176	MiniSearchHost.exe
5116	OpenWith.exe
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
5144	PickerHost.exe
2564	WINWORD.EXE
2564	WINWORD.EXE
2564	WINWORD.EXE
5704	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4880	2060	msedge.exe	80
PID 2060 wrote to memory of 4880	2060	msedge.exe	80
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 564	2060	msedge.exe	81
PID 2060 wrote to memory of 112	2060	msedge.exe	82
PID 2060 wrote to memory of 112	2060	msedge.exe	82
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83
PID 2060 wrote to memory of 3736	2060	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/topics/malware-collection
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd10c23cb8,0x7ffd10c23cc8,0x7ffd10c23cd8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1252 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,15266424998582386579,13269562365115259490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3720

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4176

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareCollection-master\MalwareCollection-master\Ransomware\Ransomware.7ev3n\" -spe -an -ai#7zMap22809:216:7zEvent32089
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MalwareCollection-master\MalwareCollection-master\Ransomware\Ransomware.7ev3n\" -spe -an -ai#7zMap20390:216:7zEvent28168
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Users\Admin\Downloads\MalwareCollection-master\MalwareCollection-master\Ransomware\Ransomware.7ev3n\Ransomware.7ev3n.exe
"C:\Users\Admin\Downloads\MalwareCollection-master\MalwareCollection-master\Ransomware\Ransomware.7ev3n\Ransomware.7ev3n.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560
- C:\Users\Admin\AppData\Local\system.exe
  "C:\Users\Admin\AppData\Local\system.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\SysWOW64\SCHTASKS.exe
    C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3860
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Modifies WinLogon for persistence
      System Location Discovery: System Language Discovery
      PID:788
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3876
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1740
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:2812
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:1136
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2084
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:4948
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3560
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2116
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "crypted" /t REG_SZ /d 1 /f /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown -r -t 10 -f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1700
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -r -t 10 -f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "about:tabs"
  2⤵
  PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd10c23cb8,0x7ffd10c23cc8,0x7ffd10c23cd8
    3⤵
    PID:2508

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\StartSet.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5144

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa390d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:6096

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:6112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
e0aa8c7ae9860aed722e424eac7f1b2f

SHA1
ecedaf3fb01a87fc7a17ff2fdc6470be592c00e4

SHA256
15071d99cdc1aa9678f3a757decd827ae602ea3ce49219e19b12e8c24e4259cb

SHA512
8f511f072ce3f2065c141bbfd05308f96f8f1f4f8b893119bc3c0e1bd6647d9326d74849c3b9036603023e5084ae2cec3cef45fbc2c0c9b87fb69172f4ab681a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
1dd2cc9d84193a6016bed2a764d490ec

SHA1
0f16a43b57a638a25800e912968b5437e4d6ea27

SHA256
2cabb2f5a037f3386d94a080bfabc87f16c2e93859dea19bc1b0c7cbe3a10020

SHA512
dbc4be972c83c740aae55f3b9e7a854fa06979b690043da7c8376dbfe2884ff1a7d34264eb5e6a93fb1d129ae1f6f0db5c55ae49e1c7d587ab873ad99eeafe5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aceef780c08301cd5b23ae05d0987aca

SHA1
d7dacb2528c70e3340a836da7666fcffd6f2a17b

SHA256
257d92d753dd7de9a01fb0c77c63f8c3ed01ea6d7c14d8c5e1fb2db50e0077aa

SHA512
95943d8b8db3450627559344429cb82c09fa2a61b35721f400a26378bafdb1d3243d52c7eecd3c2c355373de7f48d0bf290987e7064d80b9fa689f17475ae729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e826770e88318fe8f2db3f380cc22916

SHA1
d4ebc1b80456022971bcbe046fbc95b821592eca

SHA256
39b58b21a085a32ab8c05a900f7865051b785bc0cf2b499a1cc8e26adc34165a

SHA512
c8f2f24e216db852c957bea9d5d3961b15d7274b02e72534ae496bbae0149c682155a6a24a0b74bdbda62374050e71e897d8010aeefd4c13d1290327b30708b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
21KB

MD5
ce1a6abc2931a0fde3c0f2146a1c6f8f

SHA1
ff1b14c531daa5de8af6e168f2b0b78ed9511fec

SHA256
28b7bddba37aa5470a5268b0248d64b382c8825969c6243931670171a545f26c

SHA512
1cab5b9c2e676e844af6e7d68e0024528a4aed02935b1a7af1679d749a8acfb57b1ec9011d2c6f686c5bb184d1a9e8a06953bc8102e803eb391a252205e14dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
21KB

MD5
8e01662903be9168b6c368070e422741

SHA1
52d65becbc262c5599e90c3b50d5a0d0ce5de848

SHA256
ed502facbeb0931f103750cd14ac1eeef4d255ae7e84d95579f710a0564e017a

SHA512
42b810c5f1264f7f7937e4301ebd69d3fd05cd8a6f87883b054df28e7430966c033bab6eaee261a09fb8908d724ca2ff79ca10d9a51bd67bd26814f68bcbdb76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
37KB

MD5
a565ccff6135e8e99abe4ad671f4d3d6

SHA1
f79a78a29fbcc81bfae7ce0a46004af6ed392225

SHA256
a17516d251532620c2fd884c19b136eb3f5510d1bf8b5f51e1b3a90930eb1a63

SHA512
e1768c90e74c37425abc324b1901471636ac011d7d1a6dc8e56098d2284c7bf463143116bb95389f591917b68f8375cfb1ce61ba3c1de36a5794051e89a692d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
16KB

MD5
58795165fd616e7533d2fee408040605

SHA1
577e9fb5de2152fec8f871064351a45c5333f10e

SHA256
e6f9e1b930326284938dc4e85d6fdb37e394f98e269405b9d0caa96b214de26e

SHA512
b97d15c2c5ceee748a724f60568438edf1e9d1d3857e5ca233921ec92686295a3f48d2c908ff5572f970b7203ea386cf30c69afe9b5e2f10825879cd0d06f5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\44d5079ad5841b25_0

Filesize
7KB

MD5
a1e2dcb9fa011b60403e914fecb27e29

SHA1
e69c66706472c74d50a03d989a86e1746d4eb8c8

SHA256
b4b7391610bbc48a8229a2f8675b5435cbc7f0cb3718204a585a540c61e4fef8

SHA512
1c1cc7012151755ef9278106ecc0c08e68ad16370731f3bd8d9db379f3f7bbabf1ff6b9e216f1c6a8fee4f671fc5e3b1baf33ea36f7e72a6505aab62aded7e80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c57bb41f698b58763b7b50a012dd593f

SHA1
638e8d5e2f72dcad07aa421720e6e195b24e5e54

SHA256
3eb13efb4bb58c5ce345525854b962b5023adf5484e2b1f367fe5307daa290cd

SHA512
bc0efdecb75967918d8d2495d8da652c89ccfa4dde57bed04a73a050d90d1ca121a6a6f7774feb4330b43de02c4b41d1a12654e78f72ff8a74a4c8fb03751bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2929c240ec92a11dd94060405e119273

SHA1
5a12e84f45f084b4ed989d18d7dfe914f879d660

SHA256
01420f9b4618e4e98de73625e1a167aa6dd87f454592ac3ac1b53c5a198408ec

SHA512
5e1e13284b7bf1424241e8dae1c156df0c3a5cba2b7bde549f0da3089a904802efc1cde45454c6c8f9526d76df3af3e75f6e2812ceac807ea2bf9c3e0581b3fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
580B

MD5
d2c6bda3819f5b6d72d643a39fbd16ce

SHA1
3120dcf2209775e471b1512c387fd515add2cc15

SHA256
c9e49be792a471e285e8e195024ba26cd6d0acc4115cbe24804414993570901a

SHA512
aa144839b5bcd9f26188e687ee047373801d909d459059e8b2d5e564f02fb9dcd3f323990c01d796a5f987156d6825ec06249f32aa59e7ebb20d4d51e84517be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
740B

MD5
3812ca523a3842263b6750f43e695dfc

SHA1
445a7ffc7694dd4d6c47fe99ef1446f22850ae7a

SHA256
85723673d9cc959577d07d6914723bf9777615ce802170f48c17e00bc293bf12

SHA512
ed3b7cef2ccb4875cf7fcba89c9fea8d39a7285a99a0e9fe72dd42b407f38a0263c98a5a273ec78beb8cdcfaab1929794f5d03435c39d4c0dbe2ce347b022f98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d63153421149e4d28fc113180698b3a

SHA1
7522abb71eb1c71e8f64d661068fae27c8a09882

SHA256
feb0dd1e0e4ca71f2c58e1ea215e39590dcc89ec1386c22de48898fd3c73483c

SHA512
a34acb3fa7359559b2830a4da2e59d15e41dc6cd8e438794b418e093ae28331710fc89ad93cad927ccb69c810fb0d60ebc98cdbefc892b2f2c56d11abf818585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d21af185b8fed4da0c294856a204b8e0

SHA1
ab762af8bde8665c46adc1589d3486c2e65fb6de

SHA256
2c768dab58482dce4fdd330cbf09a8ab864cdae4cfcee95808a2e69e14c84f96

SHA512
a1b84f59eb07f5d5014ab6d72d90aeffed8911167d1b7b07bd2ac30b8b9c913b5972a225ae08c7d00ce6c65b0a025e76851f032ba4b4959b4116969cfbdf0123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ceb22de8ff5066e649894bedaf25f5a

SHA1
96fd45c04c5df629b3a0f0238bb947445e471271

SHA256
725d825e9bac33be25d01c952a19daf5c5c57cf48847f45ad162f493448a9501

SHA512
359529587e424f49443e477ce9c9a98c7616ed1e5e090df859a37a0ab6e6f19c678fe59457583a6b85841b5e6b32ce172ddb28b545a3303502acbc75d9afa4b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abb4f17d5b8cba0b55aa2a5ea64e39e1

SHA1
258c3878451538c20daa6cadeecfc42e38e8e6e9

SHA256
dec042e31bf6c89278d2cd3c06093457eebb989cc20b7d71d7da34b66ab2a0a2

SHA512
08c1e6e43045706d41408fc32505efa2f331cfbe617b71cadadc3a4fea2f13bdb6a981e3fefc07422345516298c54252b689c4bebef43c28f5a12809aae8d4bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f33925b7022c554b565fa26319a5869d

SHA1
01f700f73fb63b10e77dab15b0dd42123d05165c

SHA256
cdbcbfc58090f0c5bca87d0971642f803429e8e148afde7dd3a9bf205696189e

SHA512
5e2d0a5563fc703c57e5a8d7b6850000c7e662a9e98365660de24e1da8ec7b5bbea0dacfd3dbffc8ce56b9435630d4bd7adf497ecbdf3c7eba11db268831ed6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc622df545707fdcdcdab8401bec2aeb

SHA1
cc36159c413d8e1aae4770a2f41477773c1b3e84

SHA256
8da75255b596c6343ca1ba8cae55f82fd0602a37e031f3e992c53fb393e771a6

SHA512
a1fcb47e87d7b4014727ac83e62f4a93660dc22451bba512a6315e8dd6d6636148560143be713d4bc43a1200a256f0df52bad592d10f8218d446a3853c8b8773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75cb482237c30057df7feb930fd8cb90

SHA1
c6f30b00a86c6723e91b2fe5745debfb29dad333

SHA256
6aed73d1ca4dcda1a52f15386775330a94e5e4650b4ab4d7e5f23c72daead19f

SHA512
9e07b2884795915758ebc38bcd0f83798a4eda64d0a97b36fb66b2267512fbb0312562254293de806cfde1a4bd54355782a8455a64b1046e3c5d420546024008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3dfc8baa567e030a60f7d8846cf49586

SHA1
d43fac5abcebc5e11e8eb09e4da7ef57bed42e47

SHA256
d742963068190fb5102ef51dacd9964fc429cc2e79d279510bcfaa6ca1aa5c7d

SHA512
7fe987ca89a22d387db7842a16e85060220df97863e2f8566e4321595d3033b929f21be15a75ff9acf08957265651e6e050baca8ebef272ec6fe165c19872369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
111f86573db6b0c0d57e3a2b2533aecb

SHA1
8b6a75ba0630070d9908dd3692247a0d46023a19

SHA256
37beecca675dca038a467232fd36698a860214d70635f7487e2dc3a9b9d8bf67

SHA512
a137cf54b4f88c4776e3549be7f420b6b9888967cc376ee47cd6d5d0e5735fa2d0284774b1bad9bf92f0bfc547ba7758692c90d92838cd7c55ff30db9baaa103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fd4534d5d847dced89d887208c33dcf0

SHA1
b3483da983e722a5284d34b5fed78d05d73e014e

SHA256
4d0d22f8bc89e3ad1f072c9f99dd9221f7d22713a885b3953f03da5f582db042

SHA512
ac45c9f3031028e1cbb5dc8fdf2bb23affdbcecccf76f46ad9fbc16dbbcfdff577f0cccfe8716f884082986766adc5efd21c7b62802769ddb3fd3318f542a024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
878c18ce7f785e6c033c2e72fc48dd94

SHA1
1a52f2a1fb6fa306a98d733430cdb141c4679786

SHA256
565476da1796edb1a99e0d4c14e4ae1f2f3df403f649a8de361ab809ec688d10

SHA512
1060f9ba631983ef56a0b4ed8e872e512863e9fca9cf624337d2bfbfe29e10dde0f10eca82986c72c3add460e0f8a82d5ec5c5ed07e7e8a9479d06feab3f68da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
91497bce565923046e67a4657a431ef1

SHA1
dedc582ec4e0fad8d9972436c9ba3e0196b82c5c

SHA256
c4d4ff3fb6a51feef9876ab53c7b5d91cc450accb69b40f31e035cbf5203a095

SHA512
04f1ffb6f29d389fc222e8ad6a06168e6af1e4988aabfae05ef02e510a957d38d23ff8e90107dab6c1378f3cec1c14bc5fb1ebf7dfbe77b3c601b11d8205921b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
75b45e205d3c9c90f161a0a958dad326

SHA1
ba21e75fb6c8b03e192547ff9647d556d69a37b1

SHA256
9b8d21385239c0675503765a0a812ae59accf9756a5e88f7a4a191f804dbe5df

SHA512
cbe0764411a9c8bdde067a67969ec5c8cc144a5a577f2a2df4a3b1ed7c587762d54a2337079b26a5144aa77da38bcf18921725ad9bd56cce78b244d4b9e858b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff7fa014ff4f08c5b0c19d5b2484e1a7

SHA1
c6f9199237277927cbbf5e0d90f9fe64e0004b3e

SHA256
63da651adb181a2cf706a28aa0df5bb01781ea00794b810bea25d32073f2014a

SHA512
ba766805ffb1b2db0a40253461c6adf0e40371932ba1fa3d4d3a19a1300d3847e58782ac1ba441791ae656387506516cc97d1aa31b182ffe7093b9df463e9ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
39e561c96d1a55c316cd951b265fbf70

SHA1
9089bec3185233b11aa3aa22120180b0029850c8

SHA256
a1e534d6d52d0750ef6a73e67b48c420a92ddec69638c5417e6302833e391c03

SHA512
a118ca1e21ae534e266303d19233d13bcb64c8107c7faf17cea27bb38dbd4555515316b18f06c26cbe1826b2211ea77b5794045fcd5e57167f277182c7180bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2941e7da96fe0d5c4a96d3d1a0078030

SHA1
5c6e1d95ea0543a365c80c38894d8a656a7487ab

SHA256
e8a41b593f8d94b0883b7f598ca74eb1607dcaad33ce94ce20f56fa2ee258bee

SHA512
b22534e3c5772602dc9e51049c6af64890e4c70e9cc3125107f0b55bd63649775812dce0a6c09371d0aba11fd2faaf49004f4ac70a5a71f58eeab8dd99e091bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b34a4c54c137fb3bcff72be047d3d047

SHA1
03fc95298e078fda36903038d2f19e5664eea64b

SHA256
8f160db4475d129cd08ddc5b38c8d57bb56555a3c5c3fce24ce8810388157214

SHA512
898f708b14dacdd72f936ff758ba52b04efef21d4bb1bf43acb0bcfad3906e8da0c8c14598b906b2aefd0b6ac2619d04618c31f3205a9a2e3d3e68e55a214f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6bbada5f35fe33e1dc2b90e9a4b85ef0

SHA1
c7dfb82a9dc7c68eacbe71df83cfbb67e34ab22e

SHA256
3a40061ae8992aa0d6765a98c10934d201a38b4c7aa071062672bec94794c4c0

SHA512
da0a125def090e6aced89d960405f7883a37366b09f30404f0f7ef2bd680963daee1859152fa51678e041f194ab967a6d034ec638ceb09c93c35fc0b8bb3fa86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581cba.TMP

Filesize
706B

MD5
615c5942ada2dd88a582090c263799d5

SHA1
54cc3034becff762fd51cac83c26bd2a12d62f8d

SHA256
288e6ef559f6ce99e7e04f11444944222d826768fd45df7661c021ac746eb977

SHA512
b42ce650032fd2c4d9514c992f734140a3cc5da99478c6e91d78d91f842e1453b48a77b354d26920de12f1f5493d5e92473911d88f48bf6298e05b691df3c35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
20979b83f79b50e6f6ed4a1047c71635

SHA1
1bcd06b93ec1d63a93a46710d15e1e3ed035d8c7

SHA256
68d0801fb5171850ea3d6dd1971929f0a73a592909bedb8f5dda6b814a09fc2e

SHA512
0a064ee1b9ef57dc97ff6e7b4cc13638d2e5a4d98d66366ea3d752eed6d6182c4d1543a74d1ca89a42dbce084545cfa6b53146090b5a99410b469631c548a648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cd77ef1921096bf4f8718d73cdd26b7a

SHA1
103e16502dae54c7d0c6059f9cd71b905b2e7c6c

SHA256
754d453a9c68bb7675582595d7b4509ad4839937702ec54483c752d5f0712c1c

SHA512
f5d34e762859a10c828e0b65e20378c2c1dfd44495d8b46dfbda129753a33b1586c76c7fd49155ae8efb483a794516cc5f4a82b8eb081ebafc74a29b83e2da3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
930393bd018da6d68e582e7f15105e0b

SHA1
e09da0e21b62c315d44177784b92eef82dc38143

SHA256
57d72b546e56d5d141c3772f85938d8311e9e313faea17a7a7f0b09ad2a8cd14

SHA512
f521075c29f229ec0fc5dfc4f6fd380fccb057bd4cb6210ef1660c3a888864c59035540c11206a4f76db98d41ef4aeb5bf406a04e5221b46c35e3fc276729e4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2452eb4ddfc7f605e9f31367558ddf13

SHA1
d3981d61aed3229575e7d1cbe88c2e97d6cf1891

SHA256
c5ce4ae4329b10b09ebb0edb34415c98dcdd61445c5860f8bdf62e24c1da7a70

SHA512
df87bf38dbafc46c41325bf5d9e8dd7619906d6f32f1edd7c20df0f86e36b268b6590d81c81a856dc569212870c7e594f28a46b9913a5259b65b82c69d5eaf0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0e36b300d4d513ddfb767faa7c8783fa

SHA1
abd41d2b4be985d51ef982f15dc46860ca70c401

SHA256
cfdedb00c313a025a0c5fbf7b526a62340395e407d7bf1a1655fb7772b2059ae

SHA512
5afc7a1ac9457fdb5160cb2a250eaf00999e761ab1b963bff02ad2a2f27687b42b1eec0134265fd9a3f316bd4ca90ced41f64ce0c2cb9a9d2f9558b5283beb81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
81593f66a671ccbc9d8394588ef074fd

SHA1
24da79d9c383051b3ea0a330f8085ee6598aef69

SHA256
c8029b16869e75e1d3eea24130c436ed4d9c8506b45aa559570f7481a4ff3dca

SHA512
c211e4d7318c2c9fb1531f69e708cff656249bbf5db990279765e8b04bb69b4cc16910572717067793463c2248ae83a7fe055d0e507c2b2507755556dccab638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c9e1935879275c641a40bf222588c225

SHA1
caa82c4476dc76a4db0207e01ed7eb14a5a99e89

SHA256
ec9a8785f4c13c6149635bfb3148d70087b7c6c82a1a6096a0412324a2acb5a2

SHA512
3fa1729207489dddc288603a30169a1ee69da9fa87e9bb7a9a49ca146c1e4be262c6526923bb92501f51ffdcaf6f8f15c5013bce7fb181d17b76769f0f964d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5f628d69e3ea3ac385b00b98c9ffe4d5

SHA1
61e51aeb2551a534bc82854b4eb481e8d243c73e

SHA256
aa0481f670e3dc1ad5efcde58b9997a3842bbbcee5efabe96a41f644390db006

SHA512
10b1168d8fa306aa17f40b41828b8fc16653818c1d20c37c9a81fd350cc9cfab2020b0dea2482b482eda4e3b3b5629bf3e3c58292f69a00858ae9db5bd6e6610

Download Submit
C:\Users\Admin\AppData\Local\del.bat

Filesize
145B

MD5
c83d6599c33dd9a8889e9e268306ee75

SHA1
e3e3a652069a8b6c06ad951919904dcf35bcd158

SHA256
f5448148f529d7e64acddb25174f56ab6b121156d8c69b61a070ec689a34ca69

SHA512
888c13bb8c7b2b01aa7ac6add6e4329eba2b97143129b2d3408dd87e3a9fe15ba92a884a79693ec9a4277359eef0897cb53431ab383503ccef5f87b85957bf56

Download Submit
C:\Users\Admin\AppData\Local\system.exe

Filesize
315KB

MD5
612d1127cad3cd8276c41d181e1cad49

SHA1
c2d6d3d48adb16e3689c245cf94bc997fdfbb703

SHA256
71a4d79edfb2a1171a9a3cb805abda08df34460425d1c6a582f01eccf73026ee

SHA512
2f65d40b57aac121ad3519941c654dc5f2cf9c63a02f512a124129f8f13562d549cadc8483e87757d85d02bcace38d7c7d97fde89af8949615571de3d35ffd31

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
329B

MD5
bd50e5b4caaf9ff54e28a1c21c1afb60

SHA1
4ebbc7eed2fdfe18b6d510874252ebca5d22ecdc

SHA256
e1cb64f1f80c76dfc747187b9723a35c33e14e410a7e674c2db15920d99fbc7f

SHA512
913edb49abcf971587a4c164412405828814b441456264123758b7405a6922d0cec988ac68dbdd02f62e5cc3c8ab95429b70ffdff554af3afeda1bd6517b81bb

Download Submit
C:\Users\Admin\Downloads\MalwareCollection-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\MalwareCollection-master\MalwareCollection-master\Ransomware\Ransomware.7ev3n\Ransomware.7ev3n.exe

Filesize
315KB

MD5
9f8bc96c96d43ecb69f883388d228754

SHA1
61ed25a706afa2f6684bb4d64f69c5fb29d20953

SHA256
7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5

SHA512
550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6

Download Submit
C:\Users\Admin\Downloads\Ransomware.Locky.zip

Filesize
119KB

MD5
ad63ad0a3eaab505fa7bc8c254bc6560

SHA1
a9b529cd3c9c844eb847c23eee48ec87a0fa4383

SHA256
fa575b6b210a84c6bb2efdca58f4279c66d59fb04afdb1fe1a02993ccda0a460

SHA512
cde5a69aae26f479e37bc2456d4d9bcb25e091854b7f87c67832a8a34cf11a9c5cbc7c1e5e00a3a64d5268fbe6dea662b2beb0322a81a13190af3216e81fafbc

Download Submit
C:\Users\Admin\Downloads\Ransomware.Locky.zip

Filesize
118KB

MD5
e3fea234f1f009000cc0b4e4c5155d21

SHA1
cd411b66e0d9dce9fbcf10372b53ccfe3bc9b66f

SHA256
072f9dd14596aa211bb2282a2512936b0af7cd71c9b44abff86d8c652f843e67

SHA512
989ba42691687c438f6cc1073d4a2712996b492ee65ab3810aea4fbe2ff8ae9d10c8bccb161912af19627af3593b1d633a66fbe985da3878e1cec1ad5c9b5636

Download Submit
C:\Users\Admin\Downloads\Ransomware.Locky.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCrypt0r.v1.zip

Filesize
191KB

MD5
cbbb1c8ee4e6b1be52d28a1ff52846ba

SHA1
a731026f4d6f873b2d25e25508700790f8f723d5

SHA256
0eadf2b854c7263c078fbf2330a2e8d0a73f923a68029663eb4708b69da20a5f

SHA512
571d6bd084bfaa2fae5c7c20ab7288fd3b33a4c87e08075f6126a679df9cd6521dc86cfbffe91eee521e7710dfa51d8559b344d2720ed6596cdedcb0e9835cc1

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCrypt0r.v1.zip

Filesize
191KB

MD5
04d2762c440097c67cef47fcba96ce3c

SHA1
6ecf78935809ea1699a9dd075b489ef27bd00c02

SHA256
593a4b3fb31a25c433f4c04fe6a9bdacfc30771ac41e3f394b81b0a13f6e5df8

SHA512
c00118b7fb2ef8c386c49cb95fc0e0e9d39d90eb9b1cdd10145ce2bc5d99bb6361daf90b9b5e5de42464583c9ee864b29de5d87aaeb8f82f610342fc6fd13bfd

Download Submit
memory/2564-1185-0x00007FFCF1990000-0x00007FFCF19A0000-memory.dmp

Filesize
64KB

Download
memory/2564-1193-0x00007FFCEEDF0000-0x00007FFCEEE00000-memory.dmp

Filesize
64KB

Download
memory/2564-1190-0x00007FFCEEDF0000-0x00007FFCEEE00000-memory.dmp

Filesize
64KB

Download
memory/2564-1187-0x00007FFCF1990000-0x00007FFCF19A0000-memory.dmp

Filesize
64KB

Download
memory/2564-1186-0x00007FFCF1990000-0x00007FFCF19A0000-memory.dmp

Filesize
64KB

Download
memory/2564-1184-0x00007FFCF1990000-0x00007FFCF19A0000-memory.dmp

Filesize
64KB

Download
memory/2564-1183-0x00007FFCF1990000-0x00007FFCF19A0000-memory.dmp

Filesize
64KB

Download
memory/2564-1302-0x00007FFCF1990000-0x00007FFCF19A0000-memory.dmp

Filesize
64KB

Download
memory/2564-1301-0x00007FFCF1990000-0x00007FFCF19A0000-memory.dmp

Filesize
64KB

Download
memory/2564-1299-0x00007FFCF1990000-0x00007FFCF19A0000-memory.dmp

Filesize
64KB

Download
memory/2564-1300-0x00007FFCF1990000-0x00007FFCF19A0000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads