chaos | 0198b7c285a13c98123bbcf85d1b072bcc00f225f6d30867f4ab3be1ea927da8

Analysis

max time kernel
902s
max time network
457s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07/03/2024, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

niggasense.exe
Size

1.8MB
MD5

c0e5b07cbf2d02c54f39ce6aad676dc7
SHA1

4100b839d867b252ffa991f91fb9e403b8e41256
SHA256

0198b7c285a13c98123bbcf85d1b072bcc00f225f6d30867f4ab3be1ea927da8
SHA512

7e87ca707772bcfd2121f350a001c36a5eda420e39f4612ef2d36f0b00734837bf5435421a1f005bf88ce4c6f83c79f10c46e8f7d9a793b9f970f88b8a64d87f
SSDEEP

24576:+tjkC9sS0W1PJY7BaSjwI1nTmtO2WC780/TaSX88:w0MSNnWXWC71TaSX

Score

10^/10

chaos ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\read_it.txt

Family

chaos

Ransom Note

----> Chaos is multi language ransomware. Translate your note to any language <---- All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 4 IoCs

resource	yara_rule
behavioral1/memory/2108-501-0x0000000000B60000-0x0000000000BEE000-memory.dmp	family_chaos
behavioral1/files/0x000200000002a81f-511.dat	family_chaos
behavioral1/files/0x000100000002a84b-521.dat	family_chaos
behavioral1/memory/2276-523-0x0000000000B60000-0x0000000000B6C000-memory.dmp	family_chaos

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2276	fs.exe
1020	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4181651180-3163410697-3990547336-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Chaos Ransomware Builder v4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Chaos Ransomware Builder v4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Chaos Ransomware Builder v4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Chaos Ransomware Builder v4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Chaos Ransomware Builder v4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = ffffffff	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Chaos Ransomware Builder v4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Chaos Ransomware Builder v4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Chaos Ransomware Builder v4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 780031000000000067586402100052414e534f4d7e310000600009000400efbe67586402675864022e000000d24f0200000005000000000000000000000000000000074e2500520061006e0073006f006d0077006100720065002d004200750069006c006400650072002d006d00610069006e00000018000000	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Chaos Ransomware Builder v4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Chaos Ransomware Builder v4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Chaos Ransomware Builder v4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Chaos Ransomware Builder v4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Chaos Ransomware Builder v4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\NodeSlot = "4"	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Chaos Ransomware Builder v4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Chaos Ransomware Builder v4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Chaos Ransomware Builder v4.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	Chaos Ransomware Builder v4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Chaos Ransomware Builder v4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Chaos Ransomware Builder v4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Chaos Ransomware Builder v4.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ransomware-Builder-main.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4628	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1020	svchost.exe
1860	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
2864	msedge.exe
2864	msedge.exe
2676	msedge.exe
2676	msedge.exe
4964	identity_helper.exe
4964	identity_helper.exe
4948	msedge.exe
4948	msedge.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2108	Chaos Ransomware Builder v4.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
2276	fs.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe
1020	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	Chaos Ransomware Builder v4.exe
Token: SeDebugPrivilege	2276	fs.exe
Token: SeDebugPrivilege	1020	svchost.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	Chaos Ransomware Builder v4.exe
3884	OpenWith.exe
1860	POWERPNT.EXE
1860	POWERPNT.EXE
1860	POWERPNT.EXE
1860	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 3492	1244	msedge.exe	85
PID 1244 wrote to memory of 3492	1244	msedge.exe	85
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 5088	1244	msedge.exe	86
PID 1244 wrote to memory of 2864	1244	msedge.exe	87
PID 1244 wrote to memory of 2864	1244	msedge.exe	87
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88
PID 1244 wrote to memory of 1056	1244	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\niggasense.exe
"C:\Users\Admin\AppData\Local\Temp\niggasense.exe"
1⤵
PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff901f13cb8,0x7ff901f13cc8,0x7ff901f13cd8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15126845687026210323,17999030191042998197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3912

C:\Users\Admin\Desktop\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe
"C:\Users\Admin\Desktop\Ransomware-Builder-main\Chaos Ransomware Builder v4.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1d3lxxcg\1d3lxxcg.cmdline"
  2⤵
  PID:2488
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES64AC.tmp" "c:\Users\Admin\Desktop\Ransomware-Builder-main\CSCB9D2E545A2BF4A258BE3D87FB5286A84.TMP"
    3⤵
    PID:2172

C:\Users\Admin\Desktop\Ransomware-Builder-main\fs.exe
"C:\Users\Admin\Desktop\Ransomware-Builder-main\fs.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1020
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3884

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\StartEdit.pot"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3b1e59e67b947d63336fe9c8a1a5cebc

SHA1
5dc7146555c05d8eb1c9680b1b5c98537dd19b91

SHA256
7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

SHA512
2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e10a8550dceecf34b33a98b85d5fa0b

SHA1
357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

SHA256
5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

SHA512
fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\84a097df-a5a3-419e-af33-a45597779871.tmp

Filesize
479B

MD5
9f7237638674cfbdc15d8b68b3edf940

SHA1
30dd3d95be086065684d3bebc2ac389f5a720c86

SHA256
45ec2aec67d7a7d1253f5ee7a7c1d344e2fd1717b3b706b372c02d8c745c0ab5

SHA512
6f5cdd7064d87b9f80646506c67562704efc20558b959330e54035565510677d75d31cdaf7189e5df117d7ef9554a0cf211c158a76dfce194accddf6fedd572a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6f807131d47a85196a4d827eb495fc41

SHA1
d1fe84606ea3acf4162b28c37766b7bd6a4f2b5a

SHA256
d924d98eced3c687363004095d30037b018434c3d576b663bdb23f5ef92d0499

SHA512
13a80ba37490d9d2d1daa9359bd6cebd603d9a0e27395f90ee2da26b11330cb865f921afb3e08431648b2a5337f0079815cef80b98737e05455c0bd651230027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
643B

MD5
45b400975e2892447aa8ea60218a129d

SHA1
1e3f40e4c1c3b14cc563b2d1e20ae29fa3b41d1f

SHA256
24677fe2fce7f0acb54cdf5a182d1e899e6db398a743d1ca95483adade51a6c3

SHA512
d3b864ceb028754c6e21897bcf42e1188158780e7413d44a641f024f6791d042bd655b92130b0f9c4945c8950bf09f34169873fbdeeeb2970c81e0a886c8c062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e2836506d2adb348a7ce15dc6cb9fd06

SHA1
2d66d16af9d0427d93367734a6ac80d5f76fa124

SHA256
71b95f5e4c4cb0facfb55f8008dff598f9cd3a0068d9855a98dc60e32b5a4949

SHA512
038decd74114394efaec9eac3b5d7200cf1ceb2e13f76037645c291dd0883a2f1afa6127183e45060fba5cc78ef994fa1489c1f55505897557f15d0b0f5f7fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef9b05d0e179e98f7c3d0680c7a7353e

SHA1
b9b35a88760e8d4a6733f3f9db5971094e759ff8

SHA256
4b3ce7552201deb012543c670bf0a280331895621b798d957f4693da93e3798e

SHA512
d7b497c7bad170d441015f5475b5e7013e9dadcda32936e07a71ff6de5337e1e24d2b1896cdd1c3bb57722615df987795cd244332eda1e8cee2760472b85fff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
908054e87b0f1092ab2d13375214113f

SHA1
68b98986f5a8296f27af3b128a1ba4d8587b35c1

SHA256
70d60c6a7e0528eaea650efdf028f6e40fc2941e3f621f7bdac5f737966c4278

SHA512
03f61e4761d6f79c9d4d7a74a25a360bdd603adbf039cf1c7e931c8d2ef0452aa4bd1dac4c2abccb8cc0f86d0f12c8f47e8e10b59b9d49e08811966964ce700e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d500336c8217ce7ae53420ff4a5e76d9

SHA1
a31dc0074aea67fb90903c8bf09d3a0496475d3f

SHA256
d8451a6ba635998b0de51f09f93bc925564d37af140b04ef62720d927dca3f31

SHA512
fa9d2911d50a5b9b298192f9c3bb233b6b80fbfd989f1b9f4ef06dca59ba99b81e740b128a270ab35ecbae6e56cfaabab182886ebe5fdb8aa79b2500066600f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b0709f7cb512b6644d3e44d97b26583

SHA1
0e6225f48628ed15fa358a460bb20cba48f060f6

SHA256
fbb7fca5e5a61d5f073996a50470af3f14f9e88399d33d72bed201574f07c420

SHA512
0ac3266bcf572aea44571146e927c16bd6bcfbf027e334eb2ee78791e403c549e370947549df404ced9fa638a39702dbb6dfce16c5ae2ccd4ef0fd287d3b82dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20dca3aa039995bca7ef88946dc91218

SHA1
9cea58bdb1b4a76c1d3d7a2d2daf0bb002c7ec81

SHA256
bad749b4ed40f72a04b3fc9e36de4e07065e8fbab538800d8cc6665c9885a4dd

SHA512
1fed6053520d6ebea8b40e2a7af0dcaa86a03937929b1488f96e32315fdc36ed50359b529d028aef01903acb52fa2d04616d1a4b2829d8e4f3055bc5ac7b317b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a742078bd928fd590ee8d28d6ddb8887

SHA1
ca42b49f5a8fdf3d589300c4260d7814214bc599

SHA256
244264d1f6c47e0599ffffd2b35759507d13b8b35132706d0002cd7f08083a56

SHA512
5c807fc188b826b345121fb3d445e7840fc6236fcb7e8363c390b58ba8b7f5547803c717422ed567bda0bfd0fd4f61589c161d1b0bc39d5851352147e0831f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
0cdcf4013fb97e0619fc6ce37f40519a

SHA1
e5702b75e10a0dbad9f6c02fb796dbdfedde52c1

SHA256
8a68b8146fbc246a5b30b00201eac62a2e0595dfaf6ae703d541e3394978cbf6

SHA512
a8d42f95945edd30d66ef609d6c02ca2219da2b342f1d91e0e6154fea06c271b3f9eb0699a1963beba7cfecab90442efc8f817b80feea59a13db50d5d88b476f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5880d3.TMP

Filesize
706B

MD5
2b65ee4f3f60b6d2cff9b79bf8a70830

SHA1
0fae86af43fad1df7dba2a45d1ae79f49aad53ac

SHA256
e1ab0e43fd645ff7df247825f84afd914974aae5dd87291c338becd0043ad2f1

SHA512
220bd79ca540c7fb47f740c4504a6d95aca8762eb06b4df5b40d761b79ef51b75fddb04ad3b9f1ae039cec97962eaa19928037fb023112d0594fe04d360e6f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b1d5a3ee1315a27811f9ff6f90de4892

SHA1
77ccc357022450fa4208477774a9097fe73620be

SHA256
39b401cd2bbd5aa7b34aa1cb5e761155a642702039ce2d1aeac281c16267a718

SHA512
3695a350e8f47b4c882b44e31a6d3166062fd587e115e90f6cd55b57807612247c1432dba92fc46acdc3d4004bf676282dc1db4a7b21e85f83e9bc67d5bab587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
39d92ee26566ac92fa6e60fcd1386def

SHA1
4124d394cedb576659617d2cc2ca7c3f6236f3a0

SHA256
372f19ce9e3146f5500bf5aabd1546cdf01f68d33b33943149c6ba4a0bfa3a3a

SHA512
764df41652daf0d3005137c9855240f94fe0c2e2762bbf0914f2961826c7cbff0f2fc2afbbbbef12e81fd47be9c38cdaa24b94084b4a9787b48a5702ecc3e268

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES64AC.tmp

Filesize
1KB

MD5
ad854c77a1ea94cd6775ebbd4d051c6e

SHA1
db6a9debde112e136aed65d5b8730693874f2644

SHA256
f34cccbef1715aaed3625b6457c94e6a509b091ec1a2ddbe940828e2b67ba150

SHA512
ffa8154efca9e395b0365801af252171d062c755302ba9399aabaddb19bb45a0bebb16fab995df46074dff8def92ba117d36ac207f90990aad0b4c9fdf6ab89f

Download Submit
C:\Users\Admin\Desktop\Ransomware-Builder-main\fs.exe

Filesize
22KB

MD5
b04bbdaed08b37920cef7f97195bb038

SHA1
840402606abe5b771a9c1640c42efafc5da1345e

SHA256
426db58169f3d43ef76b001702eaaebeb13711c9bef7a893aaa7f50752a01f55

SHA512
c9ea46c3237a1283b2b738b39a9b2d339558d187753a8d3b55e18f17f88e47853df2c4868d592e156b3061d43b4ce9097a48bf650daf1b8628313476b83c2ef6

Download Submit
C:\Users\Admin\Desktop\read_it.txt

Filesize
964B

MD5
4217b8b83ce3c3f70029a056546f8fd0

SHA1
487cdb5733d073a0427418888e8f7070fe782a03

SHA256
7d767e907be373c680d1f7884d779588eb643bebb3f27bf3b5ed4864aa4d8121

SHA512
2a58c99fa52f99c276e27eb98aef2ce1205f16d1e37b7e87eb69e9ecda22b578195a43f1a7f70fead6ba70421abf2f85c917551c191536eaf1f3011d3d24f740

Download Submit
C:\Users\Admin\Downloads\Ransomware-Builder-main.zip

Filesize
131KB

MD5
2f859950b215f4eee1e00bbe39207212

SHA1
31593e690a1e02c5a19f24d65b2ab0022c136a0e

SHA256
4b19ad3ef396d68d4ad5457be25ca636d22e1bd848d3e4a5211b71da58f016b6

SHA512
4948afdce16b45abed05df9d093ce7286637beedf7fd5d1f1915638914ad1437321128b125653849c27161d1994acaa8a648207a326af922f7a4d59740d94d48

Download Submit
C:\Users\Admin\Downloads\Ransomware-Builder-main.zip:Zone.Identifier

Filesize
175B

MD5
59e0140d9d1dd514bdc67ec562847fef

SHA1
5365897a057b4b2e3c03b88e135b1da029144f26

SHA256
d40f73bbe69c5b21a4438838346ffece1740f3069abec8eb32dacffe8dfe4d97

SHA512
863871c9212a33247c09b776fb4f5013f0e42c1cff57040b3594b73b227cb2072e1c6e2479f52a6100a6f849ea5e20cbb38edd6607e4baf75705b89b6a45a07d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1d3lxxcg\1d3lxxcg.0.cs

Filesize
30KB

MD5
76e03563ee3ab915bce443d213332ee7

SHA1
145d7da3c060b50eec81085a8fd05fcc3d849e78

SHA256
4c83fba26f2af551ca9044aca13e24ee109228b0c06563ebe75e36a0d294c607

SHA512
d40bb7d1d1427557198332d7ccd82182179a5cf2d61d0674f16d1b80104d6a1b111473f32965bbdb48f9e98ac386be5bf0bff7a0f80121bed58e6a482731bc1f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1d3lxxcg\1d3lxxcg.cmdline

Filesize
352B

MD5
4712ee09e58ad1d90fd4f5216196469a

SHA1
1ea44a71c8d8b20f037b543f19e273fdc2960c11

SHA256
d1fc933b14a450ba2f95cdbf5b87b388dbc87ada96887bb91e9b3112bfcef11d

SHA512
87b5572621cce48b14abc972c9d2f3c6a22f747c474416a1323df51b93346023ad1c124fb9ae817d06a8794f7fec097044371be5979593dc38195353cee787fc

Download Submit
\??\c:\Users\Admin\Desktop\Ransomware-Builder-main\CSCB9D2E545A2BF4A258BE3D87FB5286A84.TMP

Filesize
1KB

MD5
744ee222e1c7dbb223cbf841887fd626

SHA1
b0fceaa1afc066c544b35a88ae1cc1d85ab1c2e4

SHA256
b221e1bbb0a6836ee9e6b49af68ccfbe122782d9437303a9b3f2f5439be10d25

SHA512
a646787fea151412efb35772a025f712cd03039166c7be4135f7c6f9ba035151725e0d6b90d6d0528570b6b1f7f995f81949431429bd354e49a5c7d818d788c8

Download Submit
memory/1020-538-0x00007FF8FEAA0000-0x00007FF8FF562000-memory.dmp

Filesize
10.8MB

Download
memory/1020-592-0x00007FF8FEAA0000-0x00007FF8FF562000-memory.dmp

Filesize
10.8MB

Download
memory/1544-0-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/1544-29-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/1860-604-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-602-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-636-0x00007FF9227A0000-0x00007FF92285D000-memory.dmp

Filesize
756KB

Download
memory/1860-635-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-634-0x00007FF8E3050000-0x00007FF8E3060000-memory.dmp

Filesize
64KB

Download
memory/1860-633-0x00007FF8E3050000-0x00007FF8E3060000-memory.dmp

Filesize
64KB

Download
memory/1860-632-0x00007FF8E3050000-0x00007FF8E3060000-memory.dmp

Filesize
64KB

Download
memory/1860-631-0x00007FF8E3050000-0x00007FF8E3060000-memory.dmp

Filesize
64KB

Download
memory/1860-615-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-613-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-593-0x00007FF8E3050000-0x00007FF8E3060000-memory.dmp

Filesize
64KB

Download
memory/1860-594-0x00007FF8E3050000-0x00007FF8E3060000-memory.dmp

Filesize
64KB

Download
memory/1860-596-0x00007FF8E3050000-0x00007FF8E3060000-memory.dmp

Filesize
64KB

Download
memory/1860-597-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-595-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-599-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-598-0x00007FF8E3050000-0x00007FF8E3060000-memory.dmp

Filesize
64KB

Download
memory/1860-600-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-601-0x00007FF8E3050000-0x00007FF8E3060000-memory.dmp

Filesize
64KB

Download
memory/1860-614-0x00007FF9227A0000-0x00007FF92285D000-memory.dmp

Filesize
756KB

Download
memory/1860-603-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-612-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-606-0x00007FF8E0570000-0x00007FF8E0580000-memory.dmp

Filesize
64KB

Download
memory/1860-607-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-608-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-609-0x00007FF8E0570000-0x00007FF8E0580000-memory.dmp

Filesize
64KB

Download
memory/1860-610-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-605-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/1860-611-0x00007FF922FC0000-0x00007FF9231C9000-memory.dmp

Filesize
2.0MB

Download
memory/2108-501-0x0000000000B60000-0x0000000000BEE000-memory.dmp

Filesize
568KB

Download
memory/2108-506-0x00007FF8FEAA0000-0x00007FF8FF562000-memory.dmp

Filesize
10.8MB

Download
memory/2108-503-0x0000000002E80000-0x0000000002E90000-memory.dmp

Filesize
64KB

Download
memory/2108-502-0x00007FF8FEAA0000-0x00007FF8FF562000-memory.dmp

Filesize
10.8MB

Download
memory/2108-504-0x0000000002E80000-0x0000000002E90000-memory.dmp

Filesize
64KB

Download
memory/2108-505-0x0000000002E80000-0x0000000002E90000-memory.dmp

Filesize
64KB

Download
memory/2108-520-0x00007FF8FEAA0000-0x00007FF8FF562000-memory.dmp

Filesize
10.8MB

Download
memory/2276-537-0x00007FF8FEAA0000-0x00007FF8FF562000-memory.dmp

Filesize
10.8MB

Download
memory/2276-523-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Filesize
48KB

Download
memory/2276-524-0x00007FF8FEAA0000-0x00007FF8FF562000-memory.dmp

Filesize
10.8MB

Download