hxxp://we[.]tl/t-7si6bGYMbk

Resubmissions

18/10/2022, 01:25

221018-btf3lsebgp 1

18/10/2022, 01:23

17/10/2022, 09:00

17/10/2022, 09:00

17/10/2022, 08:48

17/10/2022, 08:37

Analysis

max time kernel
556s
max time network
546s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2022, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://we.tl/t-7si6bGYMbk

Score

8^/10

persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
6104	slam ransomware builder installer.exe
4620	start.exe
3280	slam.exe
6080	MSBuild.exe
5400	test.exe
3404	test1.exe
3800	test.exe
3432	test1.exe
1476	test.exe
4276	test1.exe
1276	MSBuild.exe
5212	test.exe

Modifies extensions of user files 34 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\RenameUndo.crw.xpPqVE	test.exe
File created	C:\Users\Admin\Pictures\DismountPush.tiff.bZ	test.exe
File created	C:\Users\Admin\Pictures\ResizeExit.crw.lgK1	test.exe
File created	C:\Users\Admin\Pictures\ExitStop.crw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\ExitStop.crw.xpPqVE	test.exe
File created	C:\Users\Admin\Pictures\ReceiveExpand.tif.bZ	test.exe
File created	C:\Users\Admin\Pictures\MountSkip.crw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\DismountPush.tiff.lgK1	test.exe
File created	C:\Users\Admin\Pictures\NewJoin.tiff.lgK1	test.exe
File created	C:\Users\Admin\Pictures\RenameUndo.crw.lgK1	test.exe
File created	C:\Users\Admin\Pictures\ReceiveExpand.tif.SLAM	test.exe
File created	C:\Users\Admin\Pictures\ReceiveExpand.tif.xpPqVE	test.exe
File created	C:\Users\Admin\Pictures\NewJoin.tiff.bZ	test.exe
File created	C:\Users\Admin\Pictures\DismountPush.tiff	test1.exe
File created	C:\Users\Admin\Pictures\ReceiveExpand.tif.lgK1	test.exe
File created	C:\Users\Admin\Pictures\DismountPush.tiff.SLAM	test.exe
File created	C:\Users\Admin\Pictures\RenameUndo.crw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\ExitStop.crw.lgK1	test.exe
File created	C:\Users\Admin\Pictures\NewJoin.tiff	test1.exe
File created	C:\Users\Admin\Pictures\NewJoin.tiff.SLAM	test.exe
File created	C:\Users\Admin\Pictures\ResizeExit.crw.SLAM	test.exe
File created	C:\Users\Admin\Pictures\ResizeExit.crw.xpPqVE	test.exe
File created	C:\Users\Admin\Pictures\ExitStop.crw.bZ	test.exe
File created	C:\Users\Admin\Pictures\DismountPush.tiff	test1.exe
File created	C:\Users\Admin\Pictures\DismountPush.tiff	test1.exe
File created	C:\Users\Admin\Pictures\NewJoin.tiff	test1.exe
File created	C:\Users\Admin\Pictures\RenameUndo.crw.bZ	test.exe
File created	C:\Users\Admin\Pictures\NewJoin.tiff	test1.exe
File created	C:\Users\Admin\Pictures\MountSkip.crw.lgK1	test.exe
File created	C:\Users\Admin\Pictures\DismountPush.tiff.xpPqVE	test.exe
File created	C:\Users\Admin\Pictures\MountSkip.crw.xpPqVE	test.exe
File created	C:\Users\Admin\Pictures\NewJoin.tiff.xpPqVE	test.exe
File created	C:\Users\Admin\Pictures\MountSkip.crw.bZ	test.exe
File created	C:\Users\Admin\Pictures\ResizeExit.crw.bZ	test.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	slam ransomware builder installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	start.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	test.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	test.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	test.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	test.exe

Loads dropped DLL 8 IoCs

pid	Process
3280	slam.exe
3280	slam.exe
6080	MSBuild.exe
6080	MSBuild.exe
3280	slam.exe
3280	slam.exe
1276	MSBuild.exe
1276	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops desktop.ini file(s) 30 IoCs

description	ioc	Process
File created	C:\Users\Admin\Pictures\desktop.ini	test1.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	test1.exe
File created	C:\Users\Admin\Downloads\desktop.ini	test1.exe
File created	C:\Users\Admin\Documents\desktop.ini	test1.exe
File created	C:\Users\Admin\Desktop\desktop.ini	test1.exe
File created	C:\Users\Admin\Videos\desktop.ini	test1.exe
File created	C:\Users\Admin\Videos\desktop.ini	test1.exe
File created	C:\Users\Admin\3D Objects\desktop.ini	test1.exe
File created	C:\Users\Admin\Music\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\desktop.ini	test1.exe
File created	C:\Users\Admin\Desktop\desktop.ini	test1.exe
File created	C:\Users\Admin\Documents\desktop.ini	test1.exe
File created	C:\Users\Admin\3D Objects\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\desktop.ini	test1.exe
File created	C:\Users\Admin\Music\desktop.ini	test1.exe
File created	C:\Users\Admin\Downloads\desktop.ini	test1.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	test1.exe
File created	C:\Users\Admin\Downloads\desktop.ini	test1.exe
File created	C:\Users\Admin\Desktop\desktop.ini	test1.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	test1.exe
File created	C:\Users\Admin\Documents\desktop.ini	test1.exe
File created	C:\Users\Admin\3D Objects\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	test1.exe
File created	C:\Users\Admin\Music\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	test1.exe
File created	C:\Users\Admin\Videos\desktop.ini	test1.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8ce2fa89-2171-4349-aea6-8b58f54292a8.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221017103815.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 38 IoCs

evasion

pid	Process
2060	taskkill.exe
5060	taskkill.exe
4268	taskkill.exe
6112	taskkill.exe
2408	taskkill.exe
5028	taskkill.exe
5228	taskkill.exe
1452	taskkill.exe
3620	taskkill.exe
3184	taskkill.exe
3548	taskkill.exe
1224	taskkill.exe
4388	taskkill.exe
5352	taskkill.exe
1580	taskkill.exe
1552	taskkill.exe
5256	taskkill.exe
5432	taskkill.exe
1568	taskkill.exe
4056	taskkill.exe
3436	taskkill.exe
4004	taskkill.exe
1848	taskkill.exe
3600	taskkill.exe
1044	taskkill.exe
960	taskkill.exe
4308	taskkill.exe
4000	taskkill.exe
5024	taskkill.exe
1504	taskkill.exe
5632	taskkill.exe
4168	taskkill.exe
5868	taskkill.exe
6028	taskkill.exe
5148	taskkill.exe
4492	taskkill.exe
4140	taskkill.exe
3148	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000614ff57170bda5a41e7a46da0b483f7e5203b56aa4313242692f01ce1340a43e000000000e80000000020000200000006fd54614a978f7d04cf69ab4b0a6894127cc171d6c958e8f6969c55e9f7e793820000000f79feeb07307fc3449ccf421a6b79345003de2132a6b190638d9388500f9710f400000006681a87d4c6f75d4818ced9ac735399a86b84065883e33e818e0d42cc391d98443427df32c86ffd018227e6eb080545a7c6126cf8e99a0bde5078f8db7c1212c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702ce2a014e2d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2499544017"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990868"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2499563787"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60abf0a014e2d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372768048"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30990868"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000002000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C054F387-4E07-11ED-89AC-C2DBB15B3A76} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2518133319"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990868"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a100000000002000000000010660000000100002000000054897188c278c5154aafeb98c61774dbcc4ef65f3c49dace82fe1033af84e043000000000e8000000002000020000000a6f44a4c1bca5970c46d137657b15ef8dca3cbf168a17eaebf5a1368ceb25c7a20000000cf465e7884d5903cca6216d3f377f6d5baa21f7a5a6268cc56341544001afeb840000000dea979219e8e919b192698f4d3d4c462d3e7b544b3e967f161788e09cdffcc3d98e0039e04fec067a712049e1eec6fcefb2436a40ae65a1447e33f4b1d9d1598	iexplore.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	test.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	slam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	slam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000005155fb541000534c414d5f527e310000600009000400efbe5155ef545155fb542e000000552e020000000f0000000000000000000000000000003443ab0073006c0061006d005f00720061006e0073006f006d0077006100720065005f006200750069006c00640065007200000018000000	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	slam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	test.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	slam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	test.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	slam.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 405565.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 4 IoCs

ransomware

pid	Process
4568	NOTEPAD.EXE
4448	NOTEPAD.EXE
4260	NOTEPAD.EXE
4556	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
2668	msedge.exe
2668	msedge.exe
5248	identity_helper.exe
5248	identity_helper.exe
4632	msedge.exe
4632	msedge.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe
6104	slam ransomware builder installer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	6104	slam ransomware builder installer.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	5400	test.exe
Token: SeDebugPrivilege	3404	test1.exe
Token: SeDebugPrivilege	3800	test.exe
Token: SeDebugPrivilege	3432	test1.exe
Token: SeDebugPrivilege	1476	test.exe
Token: SeDebugPrivilege	4276	test1.exe
Token: SeDebugPrivilege	5212	test.exe
Token: SeDebugPrivilege	2408	taskkill.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeDebugPrivilege	3548	taskkill.exe
Token: SeDebugPrivilege	1848	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	4140	taskkill.exe
Token: SeDebugPrivilege	5432	taskkill.exe
Token: SeDebugPrivilege	4168	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	5228	taskkill.exe
Token: SeDebugPrivilege	3600	taskkill.exe
Token: SeDebugPrivilege	5868	taskkill.exe
Token: SeDebugPrivilege	2060	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	6028	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	5148	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	3436	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	5352	taskkill.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	1452	taskkill.exe
Token: SeDebugPrivilege	6112	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	5024	taskkill.exe
Token: SeDebugPrivilege	1580	taskkill.exe
Token: SeDebugPrivilege	3184	taskkill.exe
Token: SeDebugPrivilege	3620	taskkill.exe
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeDebugPrivilege	3148	taskkill.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4840	iexplore.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
5400	test.exe
3800	test.exe
1476	test.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
5400	test.exe
3800	test.exe
1476	test.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4840	iexplore.exe
4840	iexplore.exe
4924	IEXPLORE.EXE
4924	IEXPLORE.EXE
3280	slam.exe
3280	slam.exe
3280	slam.exe
3280	slam.exe
3280	slam.exe
3280	slam.exe
3280	slam.exe
3280	slam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4924	4840	iexplore.exe	83
PID 4840 wrote to memory of 4924	4840	iexplore.exe	83
PID 4840 wrote to memory of 4924	4840	iexplore.exe	83
PID 2668 wrote to memory of 4740	2668	msedge.exe	91
PID 2668 wrote to memory of 4740	2668	msedge.exe	91
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 4380	2668	msedge.exe	94
PID 2668 wrote to memory of 1692	2668	msedge.exe	95
PID 2668 wrote to memory of 1692	2668	msedge.exe	95
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97
PID 2668 wrote to memory of 3880	2668	msedge.exe	97

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://we.tl/t-7si6bGYMbk
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4840 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa1fd46f8,0x7ffaa1fd4708,0x7ffaa1fd4718
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff630825460,0x7ff630825470,0x7ff630825480
    3⤵
    PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7272 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Users\Admin\Downloads\slam ransomware builder installer.exe
  "C:\Users\Admin\Downloads\slam ransomware builder installer.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\Desktop & del /Q /F slam_ransomware_builder.url & taskkill /F /IM slam.exe & exit
    3⤵
    PID:996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM slam.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\Desktop & del /Q /F slam_ransomware_builder.url & exit
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start C:\slam_ransomware_builder\start.exe & exit
    3⤵
    PID:4912
  - - C:\slam_ransomware_builder\start.exe
      C:\slam_ransomware_builder\start.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:4620
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F5F9.tmp\start.bat" C:\slam_ransomware_builder\start.exe"
        5⤵
        
        PID:4676
      - C:\slam_ransomware_builder\slam.exe
        
        slam.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3280
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        7⤵
        
        PID:5856
        
        C:\slam_ransomware_builder\MSBuild.exe
        
        MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6080
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmp45dc9a873bd443e6bf5ed50c83fa2c52.rsp"
        9⤵
        
        PID:2308
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES407F.tmp" "c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\CSC836BD4FABFD14F7EAEC2C2E8F5BD40A1.TMP"
        10⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        7⤵
        
        PID:5412
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        8⤵
        
        PID:4976
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4467.tmp" "c:\slam_ransomware_builder\CSCEBBF3D5DF366446B855B9E33F211C684.TMP"
        9⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        7⤵
        
        PID:4916
        
        C:\slam_ransomware_builder\MSBuild.exe
        
        MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1276
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmp20fc884b31104893a1ecccf04d633df4.rsp"
        9⤵
        
        PID:5496
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60BB.tmp" "c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\CSC646A87BB1A0D4D4E89B3CD79B52C7C40.TMP"
        10⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        7⤵
        
        PID:3500
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        8⤵
        
        PID:3472
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES632C.tmp" "c:\slam_ransomware_builder\CSCF90D7ACBD5F742B19D92F2F42DA5F84.TMP"
        9⤵
        
        PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7472 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7564 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2000 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=176 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3152 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2104,11339628018193370389,10540675312971013152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3744

C:\slam_ransomware_builder\test.exe
"C:\slam_ransomware_builder\test.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5400
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4568

C:\slam_ransomware_builder\test1.exe
"C:\slam_ransomware_builder\test1.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\slam_ransomware_builder\test.exe
"C:\slam_ransomware_builder\test.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3800
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4448

C:\slam_ransomware_builder\test1.exe
"C:\slam_ransomware_builder\test1.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\slam_ransomware_builder\test.exe
"C:\slam_ransomware_builder\test.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1476
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4260

C:\slam_ransomware_builder\test1.exe
"C:\slam_ransomware_builder\test1.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\slam_ransomware_builder\test.exe
"C:\slam_ransomware_builder\test.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:5212
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM BackupExecAgentBrowser* & taskkill /F /IM BackupExecDiveciMediaService* & taskkill /F /IM BackupExecJobEngine* & taskkill /F /IM BackupExecManagementService* & taskkill /F /IM vss* & taskkill /F /IM sql* & taskkill /F /IM svc$* & taskkill /F /IM memtas* & taskkill /F /IM sophos* & taskkill /F /IM veeam* & taskkill /F /IM backup* & taskkill /F /IM GxVss* & taskkill /F /IM GxBlr* & taskkill /F /IM GxFWD* & taskkill /F /IM GxCVD* & taskkill /F /IM GxCIMgr* & taskkill /F /IM DefWatch* & taskkill /F /IM ccEvtMgr* & taskkill /F /IM SavRoam* & taskkill /F /IM RTVscan* & taskkill /F /IM QBFCService* & taskkill /F /IM Intuit.QuickBooks.FCS* & taskkill /F /IM YooBackup* & taskkill /F /IM YooIT* & taskkill /F /IM zhudongfangyu* & taskkill /F /IM sophos* & taskkill /F /IM stc_raw_agent* & taskkill /F /IM VSNAPVSS* & taskkill /F /IM QBCFMonitorService* & taskkill /F /IM VeeamTransportSvc* & taskkill /F /IM VeeamDeploymentService* & taskkill /F /IM VeeamNFSSvc* & taskkill /F /IM veeam* & taskkill /F /IM PDVFSService* & taskkill /F /IM BackupExecVSSProvider* & taskkill /F /IM BackupExecAgentAccelerator* & taskkill /F /IM BackupExecRPCService* & taskkill /F /IM AcrSch2Svc* & taskkill /F /IM AcronisAgent* & taskkill /F /IM CASAD2DWebSvc* & taskkill /F /IM CAARCUpdateSvc* & taskkill /F /IM TeamViewer*
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentBrowser*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecDiveciMediaService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecJobEngine*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecManagementService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM svc$*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM memtas*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM backup*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxVss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxBlr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxFWD*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCVD*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCIMgr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM DefWatch*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ccEvtMgr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM SavRoam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM RTVscan*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBFCService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Intuit.QuickBooks.FCS*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooBackup*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooIT*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM zhudongfangyu*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM stc_raw_agent*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VSNAPVSS*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBCFMonitorService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamTransportSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamDeploymentService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamNFSSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PDVFSService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecVSSProvider*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentAccelerator*
    3⤵
    - Kills process with taskkill
    PID:5632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecRPCService*
    3⤵
    - Kills process with taskkill
    PID:5256
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
ec8ff3b1ded0246437b1472c69dd1811

SHA1
d813e874c2524e3a7da6c466c67854ad16800326

SHA256
e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

SHA512
e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
3bc1443386ca1911f35759eba2cf52d1

SHA1
7b4dbb3d168eb9e88adc9a4899657768c7322d8a

SHA256
3f172427dcb8fb168768a5a0831c48e97724b0984f03b7fb4d2c38d112368846

SHA512
04d4bf07487ad54cba1f0dd9e2462cc4da67b7ca20a3d75f8518469bae11556f2ce7238bcd75d09715e434bc789fd0c88fe61a1d615f98a88f5d5e623c9f8cd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\612EB2BBFFA412DE310C8385EAA972AE

Filesize
503B

MD5
358d9db3d84f18ed8c5ff78507f95745

SHA1
9ee4ac2081c34cc66bd0f3ff2e852592cfd1d34e

SHA256
db855bf96f52b779fd59e96709519d70f54b15f595bfdbe1c7fd8b79be122946

SHA512
d5a76e162fe0736ecde8f8d696a78adea1236c321e299b1e2cb94e162304b5d5b8c78e202597aec5ef8a1b2833736a66b24c25c7ace8b1bb3d86c07c50fe4001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
a1fa0003a52ebb324daef7beffac914a

SHA1
05a4f39bebde05937dfefcddb4eaf3c6934a3216

SHA256
00fd170b5c3ca6ff33acc4ca1ae96f14000aca8692f038d639793eeb4881cfb2

SHA512
470ba58cf873bb1b0e34c7f8f7f73a80c842807e5d1bb2520fbe2dbf6f5bde0f7c911af9c4c062be16c128e2a24bcc4bf81244f5ec7fbfc4287a30136848536f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
1KB

MD5
d35cb93ad78a7e29785d4eb5fc25ab0e

SHA1
d1c0a3b38708b84a4198989ec13f086bfb79bb56

SHA256
7a16d6bd9ec044e74c7327462bd175518d199fe8fd2fe7d69ded48b6c707366c

SHA512
2148ec93a665e1a899ae1ee79b01968195e4c62378afd7feb519fe53944e9f18e466e89841cb9ee33231ad3f47ff933584732222fbe97bb928e497e7a7139cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D6243C18F0F8F9AEC6638DD210F1984_FD4F3AB5065583C0DC5D6551E486247B

Filesize
471B

MD5
9d0d86b3c55d84e4eeb79db7eb51dbe9

SHA1
becc572560f027b77a2e8d7c68c5a2f26b3df24c

SHA256
2257c1309e27d56b6a389438958c2c220f4611eca403946273af43adda90d25e

SHA512
2183c044adfa85a0124b587eb59968881cf0c4b01a462077e3bbe36d8cd13d3ee4d708be617d770783def8d3a4dad04128e0426a6c3fb3fd9bb16cd2cfd10783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F

Filesize
7KB

MD5
fd7cc523eb62af42936754247645337d

SHA1
d47cfe0b55e8279c218ad6cd91f029c89949783d

SHA256
0d882d0a2469f4d01f5eb86d7cf45299f235ee7e4188fe66c736db9a20bcf442

SHA512
9d9378e4d3c07da83f120254d19d261042bab9ba1537d5e5f6e4581113152fc6b66c27ef85dfab7b55381fe341f7c4d92945e590958d5b735cff8ddc92a10ce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_A250FA44615D767A3F3B7AFA283419C9

Filesize
279B

MD5
41bf6f5bc023a1b62dddbf3a03cdc87a

SHA1
83cabb42c754e9c1538e5ebf6c56696d73f237f8

SHA256
5de11a60d23b08916fd76f7242b24555ac6ea0c7b9bfca28fa568925da789152

SHA512
68c8925beb701dc497553045585221edcbbab07ee7cd4cc794d1096737cf415d44ecb3b07332e084cf7204ee0807cff81e04290bde6e2035f64919adb6ff1685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
1KB

MD5
d59a05ba9c5285f503985b3b3cb8c7b9

SHA1
b0e1468c2510508f4c4f258b7af5b2d389d02b1c

SHA256
0166287ab72cc9f6e35c7c0d5488a8bb5fcf150052ac087f1720d00f56bbc085

SHA512
ca1c1b6acb5ffd191109a57c8537f61baef343bd87298dab440e91a7cd6e7a3ba3322dcf5b79247ae9c47780c8331889a68734d8a1e31282ed887d661dd4ae4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
cffb3bb22aad98d90d0869f156630add

SHA1
7be59bbb4a70a606da964bd3af2d96e1f5b68c3d

SHA256
3d7dafcc27fe8333df20bd4398ea56b592eceea8e126298fba1ad86caacb9ea6

SHA512
401c6dab268fdecfea5fa5f5a4d9c562cc1944f32098ef152d211376846f24176606454ba3e79516aa8b02bbb1b8bbd7757510d32f530942c455a5ee6e31f23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_C89A7CE86B947A5BDDEC66331470004A

Filesize
471B

MD5
605901c6e42550516f2f8f55bdb77e58

SHA1
d766e9a80c7c8b461f5e68fc383ca892c1e23307

SHA256
39c2931465cffbe0f394c2dd1bed1833da893915af6c0dcb5a63939369909cf5

SHA512
9fb19fc02c33d3a73bef90bd1b24db4c8ed479cea771adafcd473f931a3fbd34677323424711da15fa7a99c721b4e4538fa2b4001b0dd397f338c9a94b728480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
48808c5fea227721477e670a0c67b431

SHA1
1570162160ac7c3abfa001fbc2bbc6f1c986c2f9

SHA256
107bdead340abe6408d9df44e672b81939be6b67354c13a9e564980917ae5159

SHA512
7ba183d2df7c2ef188c0b40dfe1dc7234388358789b0292ccdcc037a65bd0e1ebac9872f568de9ce8451e9e0a52ab754e636dcdcea988a6490ed4fe47d81eec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b4dc41e9250cc2c98553236ad1422c21

SHA1
7b6e443f213d1f90cd8df1c3a1950c3bb41abce1

SHA256
f6d5bff01643a988dd017c22b31aba1252051451e7836322365d6d911f3c1e1a

SHA512
d79ce4c336040d39026ad2ec5fbdb141fe21bdb0968eff2010f890d961428210f7544b646a05d9b4c8416c464f61852374030e0eddd00fc3a5ec68e12ff4a47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\612EB2BBFFA412DE310C8385EAA972AE

Filesize
552B

MD5
078afbbf73724e399c620ff93c47724f

SHA1
c864487380bf7623aeddcc38f547fb4a9462edb3

SHA256
ba19f5718a0a38d39b2a848f499978f67c26ec0fb95c1a9cde60168326246294

SHA512
ad0d2d68afbc1aa0d225110ea87b94d3b212b28849409f0aaee4ee63db3a01703987bb2a1b1224d625346a02491cef297af2301c9f01bd8c8c284f1cd4882407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
d16cf36407b39ea6cb8121c1779014a7

SHA1
fe6bbde474cd19936cb4e54a759ec4fb20401410

SHA256
fa4b8945b0c1ffcac28e7a270360b113dba298c2bf320227fec96f6535efb5a3

SHA512
581c36cf99c26b931c3259450abffe5332cbd5dc461df1f92d7ab78ea88b04c55a340fb5b769932eb57718eebe6ff4d67a9773335c581a493f21272632578670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
442B

MD5
82fa07cb23ceb9fa4dfc95b727dff4fc

SHA1
b38b2e6c0d309170ff61d3b716a69d55bb82465c

SHA256
838847333427cb8719d1f8da063fcf74b583b94f560ec310a1b317aa96560c8b

SHA512
4eec405d4faad28a62ea37c9ac46da5df589b30053678c7cf1743b591a506c921f3299e1108b098311ebc5650dc18755f7653f77adafae3efd31285fe2c9a5ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D6243C18F0F8F9AEC6638DD210F1984_FD4F3AB5065583C0DC5D6551E486247B

Filesize
444B

MD5
b1ed9be4443f5c1a0012871208524d08

SHA1
17975b6f02154edae0d0d16d8cf237f797ef04cf

SHA256
5dbf6578e0a84d3c9a1dd9fa000ac30686323ae0c306e89f6f54a06360e39b8c

SHA512
ddecb256622843b07fc64eb1b3c4834c6ebbf27e3f919d966a0e30cdc1a2e96e0bc091ba7b7062949ccce71019db5665a86f8f088513a6ef3481dc56079be9a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F

Filesize
226B

MD5
3ee8cae00cbf9fc29a99a66c417732ec

SHA1
5c89b1b43bbbdadba0aeb3d28f71c5f07736f092

SHA256
12c6c1195f7b789ae219387f82ef53fd6d7aec207e4baeb8185e9c0d57604cb4

SHA512
105f53b9fa908b12563b233515968f0bf54e69fea1ca95f11f50d201f42c863ce67f5f684c98beffc91cda27581a7380cb8333e4b3a7f2b404acb1830dd8dfe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_A250FA44615D767A3F3B7AFA283419C9

Filesize
430B

MD5
d7565da44af9dc9a5a4ce7c01054208f

SHA1
4ab8787335194e32a19b7b153538ca6a92e1f9af

SHA256
d655c49e3d71de0fc58997e00aa719e9bac63a64e0d11bab521f049d5dc6f65c

SHA512
b386c50e7ed12f9f583792a3267355550395fe781e5d023b221cd6ce0659205f63db80426fb69c6525dc23c7542d1ddbd9468c9715c402716c4b32410b349844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
8111717393d1b0e7795fda8ca4122e21

SHA1
4d42ad94871cbf35145261d2ce9c92ce90d864c4

SHA256
4e2862e998361f7a7c33163307370f37d4ed77584bb2f395b540295d10227343

SHA512
ac1dab715f8124827169259f406e2541f9504cbac72acd76d5481c5dbf900e7d08679cc0c2ce99c74da3bc7294a2739c9d8ec580d5751447c5494f26e3a86194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
abd0bc2e30f069274686cd48cf073d73

SHA1
abb9e4a620900ff32b7c11be9806bb4f3d0faa15

SHA256
e37bd751c48cd961ed045be47f8901eef6b9e8d34fd6131be7b691c43aea521c

SHA512
3e03de40d45f5c54ff382e2475a54aec68ea3c169703b890b9148a9b8c8b4ae0918613c045a73e73160aad10201b0071832ea9b5d49fd6abe9c4715fd2034252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
1883a8c0601ba0d36028813e8a23c2dd

SHA1
1b103ee78464a0bdc09f058178f6d7fc2ef7ea11

SHA256
4e3e17524e782d61df8df940e0d8e88aca4d4fee6885685a74eeae257ab92d6d

SHA512
71e4466fe2c33bf17c9cbad813962ce4911a1a3d81f2cfd25a5d62e3e2ddbf6125ee64c9d0787eff317e816318981e2e0b85154295a2f17e66a66db8d77a6567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_C89A7CE86B947A5BDDEC66331470004A

Filesize
406B

MD5
158dea97075c5c809b070b2cb071b597

SHA1
013030cb526413808bd111250bcf77974d15a7fb

SHA256
738353c057f7773a2801df81922fbc16afd2da246f24cdc16cd2cdbe374ce578

SHA512
9685ae62971186672da84a3cd58ec69bd60c253cce3f484fdd4f6e8b870f420e27cb561294d729bfefa25352952575be8ecb18520493ab9f3292651ffa986b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ru1r3yf\imagestore.dat

Filesize
41KB

MD5
c015d39c0e3b215f28b4bbf38bb4cf7b

SHA1
5bbcc9f6a54de3e9b0aa0cc45855d524354d4eb0

SHA256
3f1e832798c2ef4606e34cb65118f56226b316bcd72037ab58dea5fa1397ee87

SHA512
8dbf872d7b58542424e5a0dda01e5cc2d0eb517388585b3a1766ea774360281e23b4545a045abb9daa3eda9ff95bdd0cf407724582228c05f077aefd697b9747

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp\start.bat

Filesize
96B

MD5
2615bf9ed6d2e854c0602ef8fdd787df

SHA1
4e0682a961ee43b9ddce5b3c03c83945d7d0cc40

SHA256
a33ee4de5292cb00e1833b85a5dc530240bb5f23ee64a56ae7fa23ae4aabc493

SHA512
24ec09d91c3d8d93c7dd595dad8eefd00de24759e039bc4dfc6967291ee54ef2a65b693b02143352a8a7c0e83b372d77389059811927b18f52472ead1332fb8c

Download Submit
C:\Users\Admin\Downloads\slam ransomware builder installer.exe

Filesize
39.2MB

MD5
b31a1d7c6d732d78205b619daa8df3f0

SHA1
27ff179cd5a9ed7a562f62d40c492bc6963b23a0

SHA256
b3e9812eb077d65b30adc9b4f86bae472b22d66f8f3c95b2d49756177bbfd4fb

SHA512
76d0110eecdb0dbc8185c008f85d040885ae705b09d56f833c7254bb20f3f5a77adf2345d485c9370c5353ac0c8d2385dc90705db300f6dccec4568542847900

Download Submit
C:\Users\Admin\Downloads\slam ransomware builder installer.exe

Filesize
39.2MB

MD5
b31a1d7c6d732d78205b619daa8df3f0

SHA1
27ff179cd5a9ed7a562f62d40c492bc6963b23a0

SHA256
b3e9812eb077d65b30adc9b4f86bae472b22d66f8f3c95b2d49756177bbfd4fb

SHA512
76d0110eecdb0dbc8185c008f85d040885ae705b09d56f833c7254bb20f3f5a77adf2345d485c9370c5353ac0c8d2385dc90705db300f6dccec4568542847900

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\1.ico

Filesize
66KB

MD5
889e8ff9455bb4837f91ff644dcf2b82

SHA1
6bc850368a6444885e59d368ab5774cedb6792e2

SHA256
56ee941f7f4fcf1e050be3544ad73cfe7a061f288a3af4960632b0fcced94d51

SHA512
771af6b48883b408d45c952380ede6ab466efb776360af6bda5c0530332876d62b127803e4e4cef7e68dc64f829603cb939dbdc2d8cafe3d08dc954b796f2fa4

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Properties\AssemblyInfo.cs

Filesize
569B

MD5
6ae5c2395170e2d6d29d4f1e95e676e6

SHA1
533905ab44c6c68b58212f62202549646e23f2f6

SHA256
c12e04bcf0c4bd14dcbb50cc96416c77080ffc4bac7fb784d462ee6d6d163d6f

SHA512
492b0f4e8d4783194438f6be9d432bc008b7d72a31dbaf9aca5714e276ee13f8310408f379f165ec4ac63eb59404899c772f471a48a785ad8fd79c1cd9bfc80e

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Resources\wallpaper.jpg.SLAM

Filesize
122KB

MD5
f83cd0592ef46ff26c4b81f3ebbeec1c

SHA1
9a99d054675e7fa659188e1057a271b4b59c6e78

SHA256
2c070169ac950517fd5e828e309fb0e27ad24cfc94dfbc2c3de5f6a9adbc8d7b

SHA512
6c3576a275fb7da04c982682999ebaed346af757e88f2b5d12cc1ecaf3bb9639a458a2e207f69d5fa04dd03272e831d1c07e0a7c46beb28c2a51ef93425b2df9

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\slam ransomware builder.exe

Filesize
1.6MB

MD5
838ae3dbeff52602990b920a75ec58f3

SHA1
9f5e1638eb907f9baa63878fa8862898342554f4

SHA256
36e8d88612cfa55958f118871c346fa4ea42c19cbc90ecdea4885104089439a4

SHA512
414897ea9c51e2ae9c596cb1ef61bcfcea2c33eb08530dc6f9bec19a7ef9fbf73cbe9326cd3bae3a3590504d751af654d6b163ed315d598dce5310ca067c3266

Download Submit
C:\slam_ransomware_builder\slam.exe

Filesize
1.6MB

MD5
838ae3dbeff52602990b920a75ec58f3

SHA1
9f5e1638eb907f9baa63878fa8862898342554f4

SHA256
36e8d88612cfa55958f118871c346fa4ea42c19cbc90ecdea4885104089439a4

SHA512
414897ea9c51e2ae9c596cb1ef61bcfcea2c33eb08530dc6f9bec19a7ef9fbf73cbe9326cd3bae3a3590504d751af654d6b163ed315d598dce5310ca067c3266

Download Submit
C:\slam_ransomware_builder\start.exe

Filesize
46KB

MD5
f7b1a64333ab633f980b702723fb7cba

SHA1
e7e04a69a84c5a9e7d0901eb00face35457a0df1

SHA256
e7bde6768de9a7a1b1028d7fa52548f8c074b7355820b7a1cb2d4c2c082512d2

SHA512
666d09200f0bc1762903fcfb748335d1fec27cf2cd9723a91d2ad870468b94236ad7c15ed453446accc415f0be5d40f006d57695204fd7fa30c676a8e6d2ecad

Download Submit
C:\slam_ransomware_builder\start.exe

Filesize
46KB

MD5
f7b1a64333ab633f980b702723fb7cba

SHA1
e7e04a69a84c5a9e7d0901eb00face35457a0df1

SHA256
e7bde6768de9a7a1b1028d7fa52548f8c074b7355820b7a1cb2d4c2c082512d2

SHA512
666d09200f0bc1762903fcfb748335d1fec27cf2cd9723a91d2ad870468b94236ad7c15ed453446accc415f0be5d40f006d57695204fd7fa30c676a8e6d2ecad

Download Submit
C:\slam_ransomware_builder\uac\ConsoleApp2\1.ico

Filesize
66KB

MD5
889e8ff9455bb4837f91ff644dcf2b82

SHA1
6bc850368a6444885e59d368ab5774cedb6792e2

SHA256
56ee941f7f4fcf1e050be3544ad73cfe7a061f288a3af4960632b0fcced94d51

SHA512
771af6b48883b408d45c952380ede6ab466efb776360af6bda5c0530332876d62b127803e4e4cef7e68dc64f829603cb939dbdc2d8cafe3d08dc954b796f2fa4

Download Submit
C:\slam_ransomware_builder\uac\ConsoleApp2\Properties\AssemblyInfo.cs

Filesize
556B

MD5
a08e9477bcf35558054417f16a5f5617

SHA1
5853ada9553643a039b1b56324f0c95226179c44

SHA256
7ef40c0cf01ec60f42ace3924716f5ccef0f5eea84bd8f9006016ddbfcdf36d2

SHA512
2f7950f9462fb26dfbd133311f2c0403929eef6c75abe416d55ca8e88dceaef15021e294c3ea683d221ae22ba7acac33c63d80d441adf28fa8ffd67a577b11b2

Download Submit
C:\slam_ransomware_builder\wallpaper.jpg.SLAM

Filesize
122KB

MD5
f83cd0592ef46ff26c4b81f3ebbeec1c

SHA1
9a99d054675e7fa659188e1057a271b4b59c6e78

SHA256
2c070169ac950517fd5e828e309fb0e27ad24cfc94dfbc2c3de5f6a9adbc8d7b

SHA512
6c3576a275fb7da04c982682999ebaed346af757e88f2b5d12cc1ecaf3bb9639a458a2e207f69d5fa04dd03272e831d1c07e0a7c46beb28c2a51ef93425b2df9

Download Submit
memory/3280-225-0x0000000000EF0000-0x0000000001090000-memory.dmp

Filesize
1.6MB

Download
memory/3280-289-0x00000000018A0000-0x00000000018F8000-memory.dmp

Filesize
352KB

Download
memory/3280-226-0x0000000009140000-0x00000000091DC000-memory.dmp

Filesize
624KB

Download
memory/3280-238-0x000000000A040000-0x000000000A0BC000-memory.dmp

Filesize
496KB

Download
memory/3280-227-0x0000000009A90000-0x0000000009AF6000-memory.dmp

Filesize
408KB

Download
memory/3404-281-0x00007FFA8EDE0000-0x00007FFA8F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3404-280-0x0000000000D60000-0x0000000000D6A000-memory.dmp

Filesize
40KB

Download
memory/3404-282-0x00007FFA8EDE0000-0x00007FFA8F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-284-0x00007FFA8EDE0000-0x00007FFA8F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-285-0x00007FFA8EDE0000-0x00007FFA8F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/4276-288-0x00007FFA8EDE0000-0x00007FFA8F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/4276-287-0x00007FFA8EDE0000-0x00007FFA8F8A1000-memory.dmp

Filesize
10.8MB

Download
memory/5212-300-0x00000000003B0000-0x000000000049A000-memory.dmp

Filesize
936KB

Download
memory/5400-276-0x0000000000370000-0x000000000045A000-memory.dmp

Filesize
936KB

Download
memory/6080-246-0x00000000062F0000-0x0000000006334000-memory.dmp

Filesize
272KB

Download
memory/6080-251-0x0000000005E50000-0x0000000005E78000-memory.dmp

Filesize
160KB

Download
memory/6080-241-0x0000000000E40000-0x0000000000E80000-memory.dmp

Filesize
256KB

Download
memory/6080-242-0x00000000030B0000-0x00000000030CA000-memory.dmp

Filesize
104KB

Download
memory/6080-243-0x00000000058B0000-0x0000000005A0A000-memory.dmp

Filesize
1.4MB

Download
memory/6080-244-0x0000000005700000-0x0000000005730000-memory.dmp

Filesize
192KB

Download
memory/6080-249-0x0000000006C90000-0x000000000728E000-memory.dmp

Filesize
6.0MB

Download
memory/6080-245-0x00000000063B0000-0x00000000064D2000-memory.dmp

Filesize
1.1MB

Download
memory/6080-250-0x0000000006A00000-0x0000000006D66000-memory.dmp

Filesize
3.4MB

Download
memory/6080-257-0x0000000005E50000-0x0000000005E80000-memory.dmp

Filesize
192KB

Download
memory/6080-252-0x0000000005E40000-0x0000000005E52000-memory.dmp

Filesize
72KB

Download
memory/6080-253-0x0000000006690000-0x0000000006706000-memory.dmp

Filesize
472KB

Download
memory/6080-255-0x0000000006EBC000-0x00000000070BE000-memory.dmp

Filesize
2.0MB

Download
memory/6080-248-0x0000000006600000-0x00000000066B0000-memory.dmp

Filesize
704KB

Download
memory/6080-247-0x0000000006AB0000-0x000000000701C000-memory.dmp

Filesize
5.4MB

Download
memory/6080-259-0x0000000006810000-0x000000000698C000-memory.dmp

Filesize
1.5MB

Download
memory/6080-258-0x0000000006920000-0x0000000006BA6000-memory.dmp

Filesize
2.5MB

Download
memory/6104-207-0x0000000000550000-0x0000000002C94000-memory.dmp

Filesize
39.3MB

Download
memory/6104-208-0x0000000007C70000-0x0000000008214000-memory.dmp

Filesize
5.6MB

Download
memory/6104-209-0x00000000076C0000-0x0000000007752000-memory.dmp

Filesize
584KB

Download
memory/6104-210-0x0000000007640000-0x000000000764A000-memory.dmp

Filesize
40KB

Download
memory/6104-211-0x0000000009840000-0x000000000984A000-memory.dmp

Filesize
40KB

Download
memory/6104-214-0x000000000BFD0000-0x000000000BFE2000-memory.dmp

Filesize
72KB

Download