hxxp://we[.]tl/t-dIsTXRtNmc

Resubmissions

17/10/2022, 08:54

221017-ktx6kabbg8 8

17/10/2022, 08:29

17/10/2022, 08:08

17/10/2022, 05:56

16/10/2022, 16:18

Analysis

max time kernel
2700s
max time network
2673s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2022, 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://we.tl/t-dIsTXRtNmc

Score

8^/10

persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
4252	slam ransomware builder installer.exe
868	start.exe
2900	slam.exe
2832	MSBuild.exe
3448	MSBuild.exe
4784	TEST.exe
4100	TEST1.exe

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\OpenJoin.raw.BBII	TEST.exe
File created	C:\Users\Admin\Pictures\OutGroup.raw.BBII	TEST.exe
File created	C:\Users\Admin\Pictures\SaveStop.tif.BBII	TEST.exe
File created	C:\Users\Admin\Pictures\UnlockRestore.tiff.BBII	TEST.exe
File created	C:\Users\Admin\Pictures\SaveUnpublish.tiff	TEST1.exe
File created	C:\Users\Admin\Pictures\UnlockRestore.tiff	TEST1.exe
File created	C:\Users\Admin\Pictures\ResizeGet.tif.BBII	TEST.exe
File created	C:\Users\Admin\Pictures\SaveUnpublish.tiff.BBII	TEST.exe
File created	C:\Users\Admin\Pictures\UninstallPush.raw.BBII	TEST.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	slam ransomware builder installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	start.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	slam.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	TEST.exe

Loads dropped DLL 6 IoCs

pid	Process
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2832	MSBuild.exe
2832	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops desktop.ini file(s) 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\3D Objects\desktop.ini	TEST1.exe
File created	C:\Users\Admin\Music\desktop.ini	TEST1.exe
File created	C:\Users\Admin\Videos\desktop.ini	TEST1.exe
File created	C:\Users\Admin\Documents\desktop.ini	TEST1.exe
File created	C:\Users\Admin\Pictures\desktop.ini	TEST1.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	TEST1.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	TEST1.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	TEST1.exe
File created	C:\Users\Admin\Desktop\desktop.ini	TEST1.exe
File created	C:\Users\Admin\Downloads\desktop.ini	TEST1.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221016181947.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1f664880-11ce-49c4-98c3-378e53a88175.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 43 IoCs

evasion

pid	Process
1980	taskkill.exe
616	taskkill.exe
3820	taskkill.exe
1212	taskkill.exe
4200	taskkill.exe
1080	taskkill.exe
3960	taskkill.exe
928	taskkill.exe
1268	taskkill.exe
4432	taskkill.exe
3360	taskkill.exe
3852	taskkill.exe
3580	taskkill.exe
3048	taskkill.exe
1860	taskkill.exe
2196	taskkill.exe
4284	taskkill.exe
4600	taskkill.exe
3096	taskkill.exe
4900	taskkill.exe
3392	taskkill.exe
4388	taskkill.exe
4004	taskkill.exe
4564	taskkill.exe
2268	taskkill.exe
3032	taskkill.exe
216	taskkill.exe
3904	taskkill.exe
1980	taskkill.exe
3988	taskkill.exe
1924	taskkill.exe
1864	taskkill.exe
3968	taskkill.exe
4916	taskkill.exe
2888	taskkill.exe
2696	taskkill.exe
1916	taskkill.exe
3608	taskkill.exe
1004	taskkill.exe
3364	taskkill.exe
4168	taskkill.exe
3048	taskkill.exe
1524	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{092545B5-4D7F-11ED-B696-72E5C3FA065D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 78003100000000005055b4941000534c414d5f527e310000600009000400efbe5055b6925055b4942e000000da3102000000090000000000000000000000000000005a0d140173006c0061006d005f00720061006e0073006f006d0077006100720065005f006200750069006c00640065007200000018000000	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	slam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	TEST.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "3"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	slam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	slam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	slam.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 748506.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
2032	NOTEPAD.EXE
2592	NOTEPAD.EXE
5116	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1520	msedge.exe
1520	msedge.exe
3740	identity_helper.exe
3740	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe
4252	slam ransomware builder installer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	slam ransomware builder installer.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	4784	TEST.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	4168	taskkill.exe
Token: SeDebugPrivilege	3032	taskkill.exe
Token: SeDebugPrivilege	4600	taskkill.exe
Token: SeDebugPrivilege	1860	taskkill.exe
Token: SeDebugPrivilege	216	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	3360	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeDebugPrivilege	3852	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	3096	taskkill.exe
Token: SeDebugPrivilege	3988	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	3608	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	928	taskkill.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	1268	taskkill.exe
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	1212	taskkill.exe
Token: SeDebugPrivilege	3392	taskkill.exe
Token: SeDebugPrivilege	4200	taskkill.exe
Token: SeDebugPrivilege	3968	taskkill.exe
Token: SeDebugPrivilege	616	taskkill.exe
Token: SeDebugPrivilege	1080	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	1924	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeDebugPrivilege	4916	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	3904	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	4100	TEST1.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4544	iexplore.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
2032	NOTEPAD.EXE
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
4784	TEST.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4544	iexplore.exe
4544	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe
2900	slam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3060	4544	iexplore.exe	84
PID 4544 wrote to memory of 3060	4544	iexplore.exe	84
PID 4544 wrote to memory of 3060	4544	iexplore.exe	84
PID 1520 wrote to memory of 3632	1520	msedge.exe	91
PID 1520 wrote to memory of 3632	1520	msedge.exe	91
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 2188	1520	msedge.exe	94
PID 1520 wrote to memory of 1780	1520	msedge.exe	95
PID 1520 wrote to memory of 1780	1520	msedge.exe	95
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98
PID 1520 wrote to memory of 4232	1520	msedge.exe	98

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://we.tl/t-dIsTXRtNmc
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4544 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe1d0546f8,0x7ffe1d054708,0x7ffe1d054718
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff663bd5460,0x7ff663bd5470,0x7ff663bd5480
    3⤵
    PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1820 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7256 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7124 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7252 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,17061031586741853292,534022133238301588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4896

C:\Users\Admin\Downloads\slam ransomware builder installer.exe
"C:\Users\Admin\Downloads\slam ransomware builder installer.exe"
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\Desktop & del /Q /F slam_ransomware_builder.url & taskkill /F /IM slam.exe & exit
  2⤵
  PID:1976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM slam.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\Desktop & del /Q /F slam_ransomware_builder.url & exit
  2⤵
  PID:3344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start C:\slam_ransomware_builder\start.exe & exit
  2⤵
  PID:4896
- - C:\slam_ransomware_builder\start.exe
    C:\slam_ransomware_builder\start.exe
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    PID:868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EC9D.tmp\start.bat" C:\slam_ransomware_builder\start.exe"
      4⤵
      PID:4316
    - - C:\slam_ransomware_builder\slam.exe
        
        slam.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2900
      - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\slam_ransomware_builder\README.txt
        6⤵
        Opens file in notepad (likely ransom note)
        Suspicious use of FindShellTrayWindow
        
        PID:2032
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        6⤵
        
        PID:4360
        
        C:\slam_ransomware_builder\MSBuild.exe
        
        MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2832
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmpde5938257c774c13a5a1367128eb2db9.rsp"
        8⤵
        
        PID:2224
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3896.tmp" "c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\CSCE12AEA9D1A64FC2B970FFA28D466694.TMP"
        9⤵
        
        PID:4336
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        6⤵
        
        PID:3920
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        7⤵
        
        PID:4172
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BE2.tmp" "c:\slam_ransomware_builder\CSC62CA73E3E9C24730A4EA10F1D139F9F3.TMP"
        8⤵
        
        PID:3948
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c MSBuild.exe uac\ConsoleApp2.sln & mkdir %appdata%\buildfin
        6⤵
        
        PID:2700
        
        C:\slam_ransomware_builder\MSBuild.exe
        
        MSBuild.exe uac\ConsoleApp2.sln
        7⤵
        Executes dropped EXE
        
        PID:3448
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmp0f0f7865021e4a75999d101492c8bddc.rsp"
        8⤵
        
        PID:1896
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES444E.tmp" "c:\slam_ransomware_builder\uac\ConsoleApp2\obj\Debug\CSC1D2319395FA74ADAA7E4FC2BC2A65BA7.TMP"
        9⤵
        
        PID:3992
      - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\slam_ransomware_builder\README.txt
        6⤵
        Opens file in notepad (likely ransom note)
        
        PID:5116

C:\slam_ransomware_builder\TEST.exe
"C:\slam_ransomware_builder\TEST.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM BackupExecAgentBrowser* & taskkill /F /IM BackupExecDiveciMediaService* & taskkill /F /IM BackupExecJobEngine* & taskkill /F /IM BackupExecManagementService* & taskkill /F /IM vss* & taskkill /F /IM sql* & taskkill /F /IM svc$* & taskkill /F /IM memtas* & taskkill /F /IM sophos* & taskkill /F /IM veeam* & taskkill /F /IM backup* & taskkill /F /IM GxVss* & taskkill /F /IM GxBlr* & taskkill /F /IM GxFWD* & taskkill /F /IM GxCVD* & taskkill /F /IM GxCIMgr* & taskkill /F /IM DefWatch* & taskkill /F /IM ccEvtMgr* & taskkill /F /IM SavRoam* & taskkill /F /IM RTVscan* & taskkill /F /IM QBFCService* & taskkill /F /IM Intuit.QuickBooks.FCS* & taskkill /F /IM YooBackup* & taskkill /F /IM YooIT* & taskkill /F /IM zhudongfangyu* & taskkill /F /IM sophos* & taskkill /F /IM stc_raw_agent* & taskkill /F /IM VSNAPVSS* & taskkill /F /IM QBCFMonitorService* & taskkill /F /IM VeeamTransportSvc* & taskkill /F /IM VeeamDeploymentService* & taskkill /F /IM VeeamNFSSvc* & taskkill /F /IM veeam* & taskkill /F /IM PDVFSService* & taskkill /F /IM BackupExecVSSProvider* & taskkill /F /IM BackupExecAgentAccelerator* & taskkill /F /IM BackupExecRPCService* & taskkill /F /IM AcrSch2Svc* & taskkill /F /IM AcronisAgent* & taskkill /F /IM CASAD2DWebSvc* & taskkill /F /IM CAARCUpdateSvc* & taskkill /F /IM TeamViewer*
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentBrowser*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecDiveciMediaService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecJobEngine*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecManagementService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM svc$*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM memtas*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM backup*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxVss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxBlr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxFWD*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3096
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCVD*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCIMgr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM DefWatch*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ccEvtMgr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM SavRoam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM RTVscan*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBFCService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Intuit.QuickBooks.FCS*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooBackup*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooIT*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM zhudongfangyu*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM stc_raw_agent*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VSNAPVSS*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBCFMonitorService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamTransportSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamDeploymentService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamNFSSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PDVFSService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecVSSProvider*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentAccelerator*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecRPCService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcrSch2Svc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcronisAgent*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CASAD2DWebSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CAARCUpdateSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM TeamViewer*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2592

C:\slam_ransomware_builder\TEST1.exe
"C:\slam_ransomware_builder\TEST1.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:4100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
a0cf91191b2ced1da3735e8ecb6d0eda

SHA1
6bac79309b36de267eaeccdf648338221c4f08eb

SHA256
3c7da3216b3ee21da17d40689e9db95b793c0786b23afae8af0c1238179dcd20

SHA512
363488109a67ff1e8ca0410ff170913bc9fbf4bccfa231c84c06f058d5ce4bacdd47074dc5ea030859f5349a9b10d1498584df51e7f12b72d9ee44b17c56de3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\612EB2BBFFA412DE310C8385EAA972AE

Filesize
503B

MD5
dfe1ae8d80ebac310e8e4c5666fd130a

SHA1
93e89515d275915ef5b4139991ffcb2a3c6be85f

SHA256
c770b3488c9ca9eb25eb889885ce63fb6b474b3bf86e86db3d6f2038860d89ca

SHA512
71ab9fc7c0ccd948c8c4705a380b3dd8154e70d53865eba39709a0dd642268f3b02c284bc6f027b7c756212f9e9577b5653ef7eaaf2633141127cf09f59580b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
14d3e72147f0f6f99aaef009711edbe2

SHA1
e0f551cd79b4ba39ae8da9b26219567a683579a3

SHA256
fa75d51f4ffdde230249aca4fce9c0606161f4789b9d22a07f19c2d8443e6de5

SHA512
27f6a38f0005d0e180ee78fa55f60c7f303fb1df432e3f753c266990382a3f38d4fe93cc0b4f3a84f6e2a1ed6fbad64840b08582c830c6163bbfc5606ae143a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
1KB

MD5
d35cb93ad78a7e29785d4eb5fc25ab0e

SHA1
d1c0a3b38708b84a4198989ec13f086bfb79bb56

SHA256
7a16d6bd9ec044e74c7327462bd175518d199fe8fd2fe7d69ded48b6c707366c

SHA512
2148ec93a665e1a899ae1ee79b01968195e4c62378afd7feb519fe53944e9f18e466e89841cb9ee33231ad3f47ff933584732222fbe97bb928e497e7a7139cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_FD4F3AB5065583C0DC5D6551E486247B

Filesize
471B

MD5
cac383b34ceef336aa06639c8652ee6a

SHA1
a8d44d367824651dc5626fd2b85ad6b7dd591872

SHA256
b8596f7df514d0284ed6cbee8e291983c28372342e413225645df908dfd266d2

SHA512
c4ab8f8fb897be2165ae34750ed392a13dafa320d73bfed45052d8c8081611d5af42fd20aa54cdb717e3fe964331cf511f19e9ecfe72eec17dfacaeaaf493995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_A250FA44615D767A3F3B7AFA283419C9

Filesize
280B

MD5
5fada94ec59c5b97b9510ed352eae4fe

SHA1
50c92953754d931fd10d4789a2d3a651f042551e

SHA256
71356493f95aaee7069bb3b06b02e9709a630276e702b9d0b418f9cc3817a367

SHA512
4d1679a7a85fb96fd342a7a4d34f97621ae8c6214a84d8115fb9c97eff4decf59a7c4b9b192c3ad61dad7b2f2f65019495e3f61a4f2a24094ffcef3bbeb882a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
1KB

MD5
ffa607aaa747f1a963555210d4805f40

SHA1
e559ff0c38fe9b13309a78eb4882635fe114b06b

SHA256
35ccfc49462f1c7f6fbb7fc6850db794ceb085a501c5f4df07353e03a6a1de1c

SHA512
b6b0ab4ecb316177b82101632889044bcc19ff237e9ea149c86f7cc805450e9de6a636c563a4898913988f523f191a342061f0a9309705ccb8d3d51068f5e5a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
cffb3bb22aad98d90d0869f156630add

SHA1
7be59bbb4a70a606da964bd3af2d96e1f5b68c3d

SHA256
3d7dafcc27fe8333df20bd4398ea56b592eceea8e126298fba1ad86caacb9ea6

SHA512
401c6dab268fdecfea5fa5f5a4d9c562cc1944f32098ef152d211376846f24176606454ba3e79516aa8b02bbb1b8bbd7757510d32f530942c455a5ee6e31f23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_C89A7CE86B947A5BDDEC66331470004A

Filesize
471B

MD5
5f309b801fdcff49c832652cf9f67fed

SHA1
f0b6a27d0995fd7fd40f23ee385f8fe1fd752c13

SHA256
53663428a1b73aeee2fc68815b072ad9ced52bfd3726416aaab332c29eb3aab6

SHA512
b458da021b8506ecd4c8766ca0a6f8d881317832c4d573a2d9cb1c9386dc549c8ff13cf0942fa6661574e093b92d63a6af018731f7fd4806106641b800c1caae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
67f8ba91f461c86e4ddf10b1eb208520

SHA1
303b34b505d7e05d4532f08c5bead3f751e553ae

SHA256
c9f6d0e9c4ae3f07488dc8452c0ed71f53166660b953dd18ce13fca83b5f7dd9

SHA512
164ef4d6b43c5d1a3d8808a4619f540a825e860110c530737a2fa7b7e71c18e7f0b4332c3af2e491da843c2651b4c91ca5685a398f8fe25576c64dc1f03454b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
59cabd79c6a00fae0825220eace8dfcf

SHA1
4edb895a5dae33ba24d48283dd20505db97e5c67

SHA256
1929ada4b91ec69c483992a8cacc00d9e2ffa836517f7f90a99daea0669d4880

SHA512
66bfbe20fd4d37ebb5d7835d69883835d51dc08569ea1253b10191f613f450ccb17111116d78e92931b68a2c2c381ec9ec93a2336b3322f96502bb5d070d912a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\612EB2BBFFA412DE310C8385EAA972AE

Filesize
552B

MD5
c945601888f4ed09d6960ce92766c913

SHA1
2f87a0d4d58328d1c60a6549bdcc2d0d19adbdbe

SHA256
a3676d88f25019175818a7c329543cc3249d6ba74d743c9f18e80e372208ca8e

SHA512
49c30807af87fe78a43279d677a31c7bc09960d4a7cbf4fbe612f0a31e0512250ddd303b35b3b7d8e3c48168059d31a95cb0ff12437a70711e1b0c50a5d7cc87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
438B

MD5
5eefea67cc2bd5c761472164529e5cc1

SHA1
a0484fbb242491533c1b019afbcd8c44df82a47b

SHA256
2aab42836ba38b4d3e20870a51afe80f4ee0cf35c7b7c9dc15811e74c621dac9

SHA512
825d67d4fede2f739a9a0c647977d618c06a54ade2a5d5b5a85e708237f7478fcd3ba089a8f0518c43470f8b959f259cb53fa710a48c29323c2f085b687ce514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
442B

MD5
20ecbc08db829c5f1f39af1b4ebf95c3

SHA1
db764002406e101de64ff86a7fa0715dddba528f

SHA256
bd11bee270f1cb3002aa8c82c709174126063d4adac42b8809c3e3120f5f1c9b

SHA512
346a6e163a5ff020fa316964433b506bc0fff6fedb3bfbf8b903cf8550f585ff2b68efc315a865859f85c05006721b8370f98c212276b747223dbffa463be79c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D6243C18F0F8F9AEC6638DD210F1984_FD4F3AB5065583C0DC5D6551E486247B

Filesize
444B

MD5
ff92113d433a01ec22e7148578d88b9b

SHA1
f9053b462a2399e33519bd63bec3e276f9044eb3

SHA256
49d860939a8c0e66f1924a9663c3bd41c77484d760bdcf3515ec3e922df4bf99

SHA512
a0eb7f16888a7644d2a23741535203fc8919a563026b1ce57d6414b043fb7a361764d82b582ce0469be8b3ac481d7d5db93c3a6b472ab774ad77eb3890115ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_A250FA44615D767A3F3B7AFA283419C9

Filesize
430B

MD5
c7998f93075fdf97fc3047655cdc490d

SHA1
db0fd29beaa3734069459bf06126b2932424c0a0

SHA256
90121f371b92bddeb7378fd9b12732aee627b6163bfe19bffb05f2332c124551

SHA512
ada086ebecde7aa32849cd39f3503c5282e41c561f5972b7cf51d53ffd9c56645c1223ae32479f8e7a32407c120efe48cac759f9ec9747e83e408ee09cf93c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
f62d00e9d8d64fe4ff2519074359e503

SHA1
85f774eadbd94ca20420279a2ea26616e7a760f0

SHA256
95cea07db2a180971ccd55eba2a8e2504d0e189d32fda8f554c3c4e2bf7a3af4

SHA512
734d3bd2d11ed90a752e3338ea04db7fdb07ae89c7e52d793f219fdf8b15d643c5b354bce5c902865f1522c72fa98800f550b6d850a58ed74ea2472eb0109572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
b87e906ed1be7718eca9e198709a608a

SHA1
c16afd6d4dff678ca2237688d36b73e2312e4874

SHA256
25be6b0539128059c91b893be5f012b78f3f159390a52ee0c5e48d9636eff6ca

SHA512
20b82e7606c084156c41bad8189071d7687e7009c0a73f1620a799e68551c847a0811239f897d7b5fbbdfaa5f59c1053346cae321e29a7f7795a295751a757ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
6c78e0f193f7d0cbd58430d7fc4aa36a

SHA1
95a5a628b9e0ea0b787a4831e2918b7884dbc2ff

SHA256
ec52f4e5c94611107b55ef6f67659eed1d0079012c10d62240e28c9b9946c592

SHA512
22118ee7016831910721bda2065e34ad9c6a9fbbc44e7c980e035d56a8464ae06e7ec5e42caf0e4528afda1ea4d6175f13e6e31ccf2a0f9c74a1032f439a7103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_C89A7CE86B947A5BDDEC66331470004A

Filesize
406B

MD5
bb963101431ef5282ac96abe8c6c48c3

SHA1
dc9e16476c343c8df14abe2d58608bebd191aeac

SHA256
de552a7e797aa569bc6bb8e0f0b2a6f6ede3715da56545a6f7c9f027128f264e

SHA512
246a6e53465355e2178153b933efaf23295471912c1eea46b32df6a7e14555be52072b26ad14286f36b71c41c77f3f76d515995d382eabd6ef22e19a7c93aca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\EC9D.tmp\start.bat

Filesize
96B

MD5
2615bf9ed6d2e854c0602ef8fdd787df

SHA1
4e0682a961ee43b9ddce5b3c03c83945d7d0cc40

SHA256
a33ee4de5292cb00e1833b85a5dc530240bb5f23ee64a56ae7fa23ae4aabc493

SHA512
24ec09d91c3d8d93c7dd595dad8eefd00de24759e039bc4dfc6967291ee54ef2a65b693b02143352a8a7c0e83b372d77389059811927b18f52472ead1332fb8c

Download Submit
C:\Users\Admin\Downloads\slam ransomware builder installer.exe

Filesize
39.2MB

MD5
b31a1d7c6d732d78205b619daa8df3f0

SHA1
27ff179cd5a9ed7a562f62d40c492bc6963b23a0

SHA256
b3e9812eb077d65b30adc9b4f86bae472b22d66f8f3c95b2d49756177bbfd4fb

SHA512
76d0110eecdb0dbc8185c008f85d040885ae705b09d56f833c7254bb20f3f5a77adf2345d485c9370c5353ac0c8d2385dc90705db300f6dccec4568542847900

Download Submit
C:\Users\Admin\Downloads\slam ransomware builder installer.exe

Filesize
39.2MB

MD5
b31a1d7c6d732d78205b619daa8df3f0

SHA1
27ff179cd5a9ed7a562f62d40c492bc6963b23a0

SHA256
b3e9812eb077d65b30adc9b4f86bae472b22d66f8f3c95b2d49756177bbfd4fb

SHA512
76d0110eecdb0dbc8185c008f85d040885ae705b09d56f833c7254bb20f3f5a77adf2345d485c9370c5353ac0c8d2385dc90705db300f6dccec4568542847900

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\1.ico

Filesize
66KB

MD5
889e8ff9455bb4837f91ff644dcf2b82

SHA1
6bc850368a6444885e59d368ab5774cedb6792e2

SHA256
56ee941f7f4fcf1e050be3544ad73cfe7a061f288a3af4960632b0fcced94d51

SHA512
771af6b48883b408d45c952380ede6ab466efb776360af6bda5c0530332876d62b127803e4e4cef7e68dc64f829603cb939dbdc2d8cafe3d08dc954b796f2fa4

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Properties\AssemblyInfo.cs

Filesize
569B

MD5
6ae5c2395170e2d6d29d4f1e95e676e6

SHA1
533905ab44c6c68b58212f62202549646e23f2f6

SHA256
c12e04bcf0c4bd14dcbb50cc96416c77080ffc4bac7fb784d462ee6d6d163d6f

SHA512
492b0f4e8d4783194438f6be9d432bc008b7d72a31dbaf9aca5714e276ee13f8310408f379f165ec4ac63eb59404899c772f471a48a785ad8fd79c1cd9bfc80e

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Resources\wallpaper.jpg.SLAM

Filesize
122KB

MD5
f83cd0592ef46ff26c4b81f3ebbeec1c

SHA1
9a99d054675e7fa659188e1057a271b4b59c6e78

SHA256
2c070169ac950517fd5e828e309fb0e27ad24cfc94dfbc2c3de5f6a9adbc8d7b

SHA512
6c3576a275fb7da04c982682999ebaed346af757e88f2b5d12cc1ecaf3bb9639a458a2e207f69d5fa04dd03272e831d1c07e0a7c46beb28c2a51ef93425b2df9

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\slam ransomware builder.exe

Filesize
1.6MB

MD5
838ae3dbeff52602990b920a75ec58f3

SHA1
9f5e1638eb907f9baa63878fa8862898342554f4

SHA256
36e8d88612cfa55958f118871c346fa4ea42c19cbc90ecdea4885104089439a4

SHA512
414897ea9c51e2ae9c596cb1ef61bcfcea2c33eb08530dc6f9bec19a7ef9fbf73cbe9326cd3bae3a3590504d751af654d6b163ed315d598dce5310ca067c3266

Download Submit
C:\slam_ransomware_builder\slam.exe

Filesize
1.6MB

MD5
838ae3dbeff52602990b920a75ec58f3

SHA1
9f5e1638eb907f9baa63878fa8862898342554f4

SHA256
36e8d88612cfa55958f118871c346fa4ea42c19cbc90ecdea4885104089439a4

SHA512
414897ea9c51e2ae9c596cb1ef61bcfcea2c33eb08530dc6f9bec19a7ef9fbf73cbe9326cd3bae3a3590504d751af654d6b163ed315d598dce5310ca067c3266

Download Submit
C:\slam_ransomware_builder\start.exe

Filesize
46KB

MD5
f7b1a64333ab633f980b702723fb7cba

SHA1
e7e04a69a84c5a9e7d0901eb00face35457a0df1

SHA256
e7bde6768de9a7a1b1028d7fa52548f8c074b7355820b7a1cb2d4c2c082512d2

SHA512
666d09200f0bc1762903fcfb748335d1fec27cf2cd9723a91d2ad870468b94236ad7c15ed453446accc415f0be5d40f006d57695204fd7fa30c676a8e6d2ecad

Download Submit
C:\slam_ransomware_builder\start.exe

Filesize
46KB

MD5
f7b1a64333ab633f980b702723fb7cba

SHA1
e7e04a69a84c5a9e7d0901eb00face35457a0df1

SHA256
e7bde6768de9a7a1b1028d7fa52548f8c074b7355820b7a1cb2d4c2c082512d2

SHA512
666d09200f0bc1762903fcfb748335d1fec27cf2cd9723a91d2ad870468b94236ad7c15ed453446accc415f0be5d40f006d57695204fd7fa30c676a8e6d2ecad

Download Submit
C:\slam_ransomware_builder\uac\ConsoleApp2\1.ico

Filesize
66KB

MD5
889e8ff9455bb4837f91ff644dcf2b82

SHA1
6bc850368a6444885e59d368ab5774cedb6792e2

SHA256
56ee941f7f4fcf1e050be3544ad73cfe7a061f288a3af4960632b0fcced94d51

SHA512
771af6b48883b408d45c952380ede6ab466efb776360af6bda5c0530332876d62b127803e4e4cef7e68dc64f829603cb939dbdc2d8cafe3d08dc954b796f2fa4

Download Submit
C:\slam_ransomware_builder\uac\ConsoleApp2\Properties\AssemblyInfo.cs

Filesize
556B

MD5
a08e9477bcf35558054417f16a5f5617

SHA1
5853ada9553643a039b1b56324f0c95226179c44

SHA256
7ef40c0cf01ec60f42ace3924716f5ccef0f5eea84bd8f9006016ddbfcdf36d2

SHA512
2f7950f9462fb26dfbd133311f2c0403929eef6c75abe416d55ca8e88dceaef15021e294c3ea683d221ae22ba7acac33c63d80d441adf28fa8ffd67a577b11b2

Download Submit
C:\slam_ransomware_builder\wallpaper.jpg.SLAM

Filesize
122KB

MD5
f83cd0592ef46ff26c4b81f3ebbeec1c

SHA1
9a99d054675e7fa659188e1057a271b4b59c6e78

SHA256
2c070169ac950517fd5e828e309fb0e27ad24cfc94dfbc2c3de5f6a9adbc8d7b

SHA512
6c3576a275fb7da04c982682999ebaed346af757e88f2b5d12cc1ecaf3bb9639a458a2e207f69d5fa04dd03272e831d1c07e0a7c46beb28c2a51ef93425b2df9

Download Submit
memory/2832-256-0x00000000053A0000-0x00000000053C8000-memory.dmp

Filesize
160KB

Download
memory/2832-252-0x0000000006000000-0x000000000656C000-memory.dmp

Filesize
5.4MB

Download
memory/2832-255-0x0000000005F50000-0x00000000062B6000-memory.dmp

Filesize
3.4MB

Download
memory/2832-249-0x0000000004C70000-0x0000000004CA0000-memory.dmp

Filesize
192KB

Download
memory/2832-257-0x0000000005390000-0x00000000053A2000-memory.dmp

Filesize
72KB

Download
memory/2832-248-0x0000000004DD0000-0x0000000004F2A000-memory.dmp

Filesize
1.4MB

Download
memory/2832-254-0x00000000061E0000-0x00000000067DE000-memory.dmp

Filesize
6.0MB

Download
memory/2832-247-0x0000000004B50000-0x0000000004B6A000-memory.dmp

Filesize
104KB

Download
memory/2832-246-0x0000000000390000-0x00000000003D0000-memory.dmp

Filesize
256KB

Download
memory/2832-251-0x0000000005840000-0x0000000005884000-memory.dmp

Filesize
272KB

Download
memory/2832-258-0x0000000005BE0000-0x0000000005C56000-memory.dmp

Filesize
472KB

Download
memory/2832-260-0x000000000640C000-0x000000000660E000-memory.dmp

Filesize
2.0MB

Download
memory/2832-262-0x00000000053A0000-0x00000000053D0000-memory.dmp

Filesize
192KB

Download
memory/2832-253-0x0000000005B50000-0x0000000005C00000-memory.dmp

Filesize
704KB

Download
memory/2832-263-0x0000000005E70000-0x00000000060F6000-memory.dmp

Filesize
2.5MB

Download
memory/2832-250-0x0000000005900000-0x0000000005A22000-memory.dmp

Filesize
1.1MB

Download
memory/2832-264-0x0000000005D60000-0x0000000005EDC000-memory.dmp

Filesize
1.5MB

Download
memory/2900-239-0x0000000000F00000-0x0000000000F7C000-memory.dmp

Filesize
496KB

Download
memory/2900-243-0x0000000009620000-0x0000000009678000-memory.dmp

Filesize
352KB

Download
memory/2900-226-0x0000000006EF0000-0x0000000006F56000-memory.dmp

Filesize
408KB

Download
memory/2900-225-0x0000000008920000-0x00000000089BC000-memory.dmp

Filesize
624KB

Download
memory/2900-224-0x00000000006D0000-0x0000000000870000-memory.dmp

Filesize
1.6MB

Download
memory/3448-274-0x0000000006961000-0x0000000006AAB000-memory.dmp

Filesize
1.3MB

Download
memory/4100-295-0x00007FFE07D40000-0x00007FFE08801000-memory.dmp

Filesize
10.8MB

Download
memory/4100-294-0x0000000000D10000-0x0000000000D1A000-memory.dmp

Filesize
40KB

Download
memory/4100-296-0x00007FFE07D40000-0x00007FFE08801000-memory.dmp

Filesize
10.8MB

Download
memory/4252-205-0x0000000007FC0000-0x0000000008564000-memory.dmp

Filesize
5.6MB

Download
memory/4252-204-0x0000000000800000-0x0000000002F44000-memory.dmp

Filesize
39.3MB

Download
memory/4252-206-0x0000000007910000-0x00000000079A2000-memory.dmp

Filesize
584KB

Download
memory/4252-207-0x0000000007900000-0x000000000790A000-memory.dmp

Filesize
40KB

Download
memory/4252-208-0x000000000BC90000-0x000000000BC9A000-memory.dmp

Filesize
40KB

Download
memory/4252-211-0x000000000C610000-0x000000000C622000-memory.dmp

Filesize
72KB

Download
memory/4784-279-0x0000000000260000-0x000000000034A000-memory.dmp

Filesize
936KB

Download