locky | 9d7016dccdb05939eaac3ca2452cf5ef9d22a8e3a0e8e60b555b41506f95c36e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2025, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe
Size 255KB
Sample251027-plergady9c
SHA256 9d7016dccdb05939eaac3ca2452cf5ef9d22a8e3a0e8e60b555b41506f95c36e
MD5 49af0845db502e6965aa54ae5d35dd9d
SHA1 4d0c139579bd6c52cb1c987c4dc3b07edaee4aa5
SHA512 fe189d182f87de7a9608d9768c2b28f083328494860771f6791538b54a8acaaefebdca75eeba06cb69309da3cca69ea9f93ca03870c9a29b3df67e2c6bfc920e
SSDEEP 3072:Rwp4q7T9LhD9l2Q6MfLoYivy/KtMpsd+4ldKlQJ9ZfR5JUS3+moKYe5DecRA5jfE:I4S9LhZl2Q6MzoXSsXmBS3Jl1FAj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery locky locky_osiris ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris
Locky family
locky
Locky_osiris family
locky_osiris
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp"	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Control Panel\Desktop\WallpaperStyle = "0"	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1872826379-1646062183-4110371642-1000\Control Panel\Desktop\TileWallpaper = "0"	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134060416323908601"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1872826379-1646062183-4110371642-1000\{02868DB6-C483-457A-AC24-E74D70863ECD}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4604	3892	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe	111
PID 3892 wrote to memory of 4604	3892	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe	111
PID 3892 wrote to memory of 1488	3892	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe	112
PID 3892 wrote to memory of 1488	3892	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe	112
PID 3892 wrote to memory of 1488	3892	2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe	112
PID 4604 wrote to memory of 1924	4604	msedge.exe	114
PID 4604 wrote to memory of 1924	4604	msedge.exe	114
PID 4604 wrote to memory of 3196	4604	msedge.exe	115
PID 4604 wrote to memory of 3196	4604	msedge.exe	115
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 3008	4604	msedge.exe	116
PID 4604 wrote to memory of 4296	4604	msedge.exe	117
PID 4604 wrote to memory of 4296	4604	msedge.exe	117
PID 4604 wrote to memory of 4296	4604	msedge.exe	117
PID 4604 wrote to memory of 4296	4604	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\DesktopOSIRIS.htm
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ffb5b44f208,0x7ffb5b44f214,0x7ffb5b44f220
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1408,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2120,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1928,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3520,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3552,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4160,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4168,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3728,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4944,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3720,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5764,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5908,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6164,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5944,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6000,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6616,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6664,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6676,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5936,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5104,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4164,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5596,i,12501704914501704890,8260995107048523737,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\2017-01-30-Afraidgate-Rig-V-payload-Locky-radE7F02.tmp.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4f2f5423bfc3024d882981864e788b7c94c891870bf832b9a6cfe5ef96710b46
MD5 119e9c504f7d4a4cf1b26b57bfa4c7a9
SHA1 ae9cde5466806693f2d5fdf455906c26f14bb8cb
SHA512 6bafe8f1c5de8345c75b9816ac3ff4f549b24dbf15ad5a88ca9c293c6e2c2549c5baf5013df9642089f5fc579a21d6a8625fc1ea26115e16fe751d00a15f9878
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7W:fwUQC5VwBIiElEd2K57P7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 31c5ba900f1206921883f9ab017ea2691e5ce16da000cde41ebda20d9beb851f
MD5 584778223fd998cb8d9cfeedea99618d
SHA1 58333fbf25878f03b5a676a0af816b339d8e7bd0
SHA512 9b779890682ee14eb372235bbbd841f2e946df9431191c147bb11353ac458621b4e003ff3d3e483c0f936f95f67247756cf5b25d0f4ca2316c60a24f77b657f6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b84d1464357a5079fa2176fcd1e039f96dc5b496be68fd95e6b3e7f897c5ff4a
MD5 0bed30cbfbb03fbc088d2569653cda9f
SHA1 ddac9aec4632b5d4a16cdf7062e816f4d290a3ab
SHA512 95620be5ea7c6fab9b9996328049f9fd7a6ab9bf4cb6e7d9a8fb5b69e5d3ce9f7dcecfd60cfdee283eab8dcef53d2201399ec4ba14de3e441370b265ab79d702
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 838b33485e4d791aab3d2fff7e00ef5c8d88ca28dad3baea2cd7c53e0ac22372
MD5 d223d712e03e18702928938287d15e08
SHA1 9b8765711cef7ffe4f3cf22f476bc02e2f2ce80e
SHA512 01e80631ca5d85b3bd81632d9b0c3d39be577a25241d8810d18a56c1b114e6cb0ba57709276d2181b04b562bb44c73c4006d5bc5246ec95a88735fb86f14f436
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe596f6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596f6a.TMP
Size 3KB
SHA256 24694724eda37cabe66299ba52cd9b4be448e256086bf0dd26c3c160c35b26e7
MD5 a3275ca681b4ec65a4a4d0f53100960a
SHA1 48732f071dcdc585242e3f45ab6c19d4447b310f
SHA512 431b0869d6db445c12eb4c61c04aeeb2081df0bf118729ab42ad9be33b307e420a9362ab43f7b72607fae41ba8a658af286c8ad6e74a8ef7860647e98363a949
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d18fc1f99d28a263e9e8718b0d0b611b4783f4c7fbf420ef53950f9265f7394c
MD5 0f39d918a507edf75681f792fe4162fa
SHA1 056cd78633a8c5ce801bca97a018862b999a7c74
SHA512 ab622e8758a291ce4b4892fec42d509f8e3d05ac4a127d581927be2db91705e56a86879e9a1b172386118933c0422707bd5e0d6dfae8ccd11f34e98f366b206d
SSDEEP 192:sVmRmyMh/K1Ml8Mg3scjqiPsjnsWRIZ8prRHY+WNrYMd++zcIgdJ:sVmGI3sceirWdlHSrgCAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ae0ac482f758709ebff996dbdcb5cee65df8374a8462c2f45311c48ac80fd9bb
MD5 b3b0f62aaa421e240c3cd3a8dc1d4284
SHA1 40587b0a310967c190475c6594c740c272218242
SHA512 a05b31024b528184fd59c5552a4aeed5cbd65638419c3333a5b881342b9420190ca0cab0404daea88d68869fe14bea37156cfe1cbd526f487a279d0c9f69af30
SSDEEP 768:L8RrXyz7pLuLbA+WFGyWK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBaupLliouUYrom:L8RrXylEbA+WFGyWKu1jaKaupLg3Ujm
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 0187375f77a5466a71550caf42826a4dc3c2cc8ceefe98bbbf96917d86b431f0
MD5 babc906aa04d378b3c95cbf1a78f1103
SHA1 33d13cd674486186fcd921c42cf579c1b87f3b3e
SHA512 51f282636cc391bd3622179fe00979ef9a7c427b7ae29f299597381a8b76c5fffed67150b61c25f3f0fcf22590fd6cb21eecafbe9066ad3b0c6869561744dfbf
SSDEEP 48:NJKESylQKHhyd1yBVXvf2NvsVV2Knjjm80T0RdKQqylqKdNERw0r:NJK7OQKBa/KrdKTuqK2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4dd6b76507e7074a1e2d29ba71fe5b0c3536aec214b87d2f6e7c7accffb32643
MD5 39d6d827d9cbe0d2c404ad3e424d9fd8
SHA1 40921a5987493cd953c0d077422b1f6fd79403cc
SHA512 ea455d9fb6133dcc1bb645798463786c80f73d0c011be97dba546542ba17bc03d979ce1a0b52505dacedee972686f2ce452e1d7aea1cea106d6d423788288706
SSDEEP 384:nVB1J0w7I5gRzuYgFL2I/V6Zi/sNbJDTV+5TT8HRE1g8ruBIOKsr:VBLv7I5wCPFdV6Zi/yOQRE7rYzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 84c6df2d5600ebdcc36261ebda7c0472b7f38551091ff0d827de98a12cd0aef9
MD5 78be15829678c9dcd698453ddb910c71
SHA1 be286b4c0b838b45fc84b4e8d45520ff53f1d5e4
SHA512 2137638bf6f11bd3391733050cd3e49617583cc16cf21b3f254d9310312aa9bcf667be115032ec8f93578562ebb53cbb0c0ed96fddc5d9c71e748224ffdfc1ea
SSDEEP 96:PqONkCyUfQHNGX5ih/cIVURLl8Rotop5CLJTDCRB/PhvVmx0CjfTtxt14RP+dgJE:SONbypXWiRUyEnwnATT8RugJ2gMkUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c70f752e1ddfd3b0ebb2de1bda5e554cabbab075888e2e14372c5ab47fe5802b
MD5 6d7e176f58161b3501da6431af65fa36
SHA1 40ba9bff1258751724a8a0b217950f0385f78edb
SHA512 67f347403512a228f092997ca35d52901d54a904141d0985d93f59d6157f5f9d5dafc5494f5e99732af21321996d0c73e7ed21ea4610ccf3c59cb4bdd5352ec4
SSDEEP 96:PqONkCyUfQHNYX5ih/cIVURLl8Rotop5CLFHDCRBIPhvVmx0CjfTtxt14RPrlvNG:SONbyplWiRUyojw6ATT8R5Lca2ydUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9e9ee8312ff712654d7cd96298629e0a492ce87b9fc9d6a78ae91c04ac562570
MD5 e67ded1a16ea4d95e2cf06457cb4d8d9
SHA1 763bb8b3cf9cfa4da9307a24ed9d36ab635b0c4e
SHA512 e39f53ec9ad3db4129e73abe87430d96efdf87a394fb5be18384f6322846b3729e43ee39c9ad12adec23506c3d6445d970d584b9a535e32230328afe26a8241f
MD5 SHA1 SHA512

Submit Download

56d92135-851d-410f-bf75-c54b20b1a68c.tmp

Path C:\Users\Admin\AppData\Local\Temp\56d92135-851d-410f-bf75-c54b20b1a68c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd3ccda5-8673-40f9-a0e6-9e0672a0387f.tmp

Path C:\Users\Admin\AppData\Local\Temp\dd3ccda5-8673-40f9-a0e6-9e0672a0387f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f1dd2c60-4767-420e-a6f9-79dbca547ad7.tmp

Path C:\Users\Admin\AppData\Local\Temp\f1dd2c60-4767-420e-a6f9-79dbca547ad7.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSIRIS-f0f9.htm

Path C:\Users\Admin\Desktop\OSIRIS-f0f9.htm
Size 7KB
SHA256 f1927108709129c806f7196ad4b75f8de576bc716411c7e619c9676ad54ffbdd
MD5 dca6c59c8c548d71b813522efd3658d3
SHA1 f19876e1b3d514dd28dc7cbc8b3cc443737ea0af
SHA512 35d15adb35e291fd547e06c12fa1536cd9c3878867eb58dc16bb983e09cd33c2d7944322a8faa9dc8571427b2681f45e27d8c9f7341443cc38018a1b80c57214
SSDEEP 96:5ostG1t/rD/O74JZAlEsNKLk+R9c8uENartg+6yRgjlJ3U0KzLuSt/LwL+JNtLyB:yiLkJkt1Hm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3892-0-0x00000000004D0000-0x00000000004D1000-memory.dmp

Download

memory/3892-354-0x0000000002200000-0x0000000002227000-memory.dmp

Download

memory/3892-348-0x0000000002200000-0x0000000002227000-memory.dmp

Download

memory/3892-18-0x0000000002200000-0x0000000002227000-memory.dmp

Download

memory/3892-20-0x0000000002200000-0x0000000002227000-memory.dmp

Download

memory/3892-19-0x0000000002200000-0x0000000002227000-memory.dmp

Download

memory/3892-8-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3892-6-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/3892-7-0x0000000002200000-0x0000000002227000-memory.dmp

Download

memory/3892-5-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/3892-4-0x0000000002200000-0x0000000002227000-memory.dmp

Download

memory/3892-2-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3892-3-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3892-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads