badrabbit | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

max time kernel
252s
max time network
311s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 17:11

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware

Score

10^/10

badrabbit cryptolocker dharma gandcrab mimikatz troldesh backdoor discovery evasion persistence ransomware trojan upx

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-557049126-2506969350-2798870634-1000\IQJYNXQ-MANUAL.txt

Family

gandcrab

Ransom Note

---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .IQJYNXQ The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/edf09d4b6206e09 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAI9KSvcJiWYL/Z71xF07Of5jv7Y1ycyBr7l9Dw958A25C3TNDU7F74Gu0aZjsNEkHxWCF+xzv4qGiKl8OZ/7BSXJaS6rzoxmmpy3CcDPLBDvs1TzSlA7jMNbSNvT/KW233iOpbiC/xHMv4VWxDHloYs782ZHgWtDJ9Bcfz/0DSUPlNHGQ0gIeJ08mjSAbi3V21kEm7xBYM5PaQoTEoLBH3i6mc7PlYLGt2+NtUzl8lv4VuPCEYDDxMTSN7IXu00A7o5au1eqif2jbFya8cFE10kZvyQXCkeL/O6D2vvlIprSD9WrvBZlZ9lYN873WUDobNg97rY75071IAx5eyy4iW769AZafxqBHHtFhFv1VizC7gYQHHvhB6QtuC2D99nQ45C8uMtiV3mwQkp87EXzDjJ7gQP98leedKG1SJHGeYubzjYzabkSTk2DlrLWxRlJa5BaQeFL1kW/Zu2ftrrSv/225buKVNqowAR5qsalV0hqEIcdEBBzFLZpNcjh2Wr9OgqECk7rwsVL+TVWhaTlcLw+kMMy+bR/+BlI+niSqZXYn8YT0Bwb2aHcf06nqcUUvXb8giLn+FzpCysuol7NTAvZ4akKt91BHiXmTH0EsjJMxLIwuJIhtMNatIYNoFb/KbVd/t8r8acx5OFgLbz56AfSQuc8JE6io6HVCVtoPYkV2MvMxdUK+lqw+AarzoD8wJuDX3JCsxsRoIN9h4iyw64uKa1ArcCD5JGH0Q1u2Cjtp4gX7rwt8CQEQTf/Ytll1PVU+Fagm1QydiYyBQwR4zm579Rf0HE/BLXTERkNrJXL6K/fsd/vjhYIGUdOUt8238NAxI4RAADjpmL3FWULq9cIR/Si6CgsWusGXRrr0EjoCFsrHZTeWvTBW5yLnz6VLO6gsl+K/zqbglNwq75dx8QAWiiLTFe8KbZEKFA862ox8lhdZWnXrE42QB2Saddc+9txaY7FZlCchShruuW/AwP8mIalCBCkVGKqARVccg593bHhfg4VvA2Wu/yB5pyg0D1T3kw3E7+P8w4YCDiKndPnUHHG0On9tY3u7dBfGjvRA9MKFYwXDBTyxJHBJV+3ia01ghPwnx6NB9FZUZ6dol6pe7JGuoeo31gjb0mfnRpcK6O2hbGFGbTc/aZk+wAcMvBStNvNoT9Fn1IHsGVpRhL/AnQ2hEQPmmVR1Rc1Y5MO60i1ebVGTH8eYdw5iUWxAAki/5swqnC49mJMZe+8vG9N6WMtPZWuqvDb6wmwniSfYMrVWPj58AGNaax1cdPr+mAc//pm08iRxhwLVEFFkmc1qSHjjLfRDTcu0f/nljrXeFiskMHXQguoiiUJUuFvMl+QpzhRb0u4YWMNIkB5EhGyx2buL5PePlTTB2Z3VgIeNe2th1HDtdCZG6Ms4X3/6RG2IOb+a5rU1WhLaLiNLuCIvt4uZ5nnL7JwmAXW2nWpzzFyNdzsLv663ZxGx3tKTV6oxSwzMvLvdEdc6Uy+Nps+alTK/aiKE2bGnct5f1r5ZeZZUEa+Oi8O0qMq7Xagk4HELnjvyxIp7QgPKy8Hevme+nNDq+Sztzf0of+InsH+kmJ4OcjdU4eFef6UB8X+DV1kkrkKJadfi5ZvyqbxCasjhxcPJw7SAX3vet4cq5rsVGKckOzhTYZGizeUcvXntzqgRyLj1dc+NWSGbLgMF1+zeFUpsyRQt3UeNsQ2yIAhw41sm0AadT9WIcVF2wCFJh9NqD18ypp+2VbiGBg8QrwF+WZlYIrQoTD2HM7KasuekYCx5KUHbdy1jlqpdoE0yLo2TUhDtT1e8dcaTLeuapOW9bmmvqEhNILs0kXUsTtma+qX0SqPGxhv3SuShx4sfbZsjggbhbxim5J6lxT4tB70HHB4fW0Vu/Y76sBWtw7K09/h0ZiG/RiRfIo/l7hlrS7pCiA+62jbBVYIfVZZo8c0hX3pAlInlaTrX/oUM40RDSXjWr120mHUTxSV5EEDY8bTAVKFmJTSQMUX1EC6/7WCIwr17SYi0CpE2dOLVuc4IGgae7/Yo23L76HQYBhquSZQkn7ROG3oVuCvVoUjAL6zPCdb8Jvy+cRlUXf2uAI8DTgM1v7QK2XwSVicOhd2UlCZSWuK28iY2bttPTKs8A+Y5Yj8MierjGjMoln9CQbdmMfGq42PCs3Sc1pua2u7o0WduMIuL9xQrJhsE6ydjlorwuotZihs9YQPS56WUFb4vwbZ6+UMzn9sfqn2hAnu6i8MioE= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmD79MjJOJDbAuiVteDPRX3IKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJKNBZBnJqrsY3R7S3NbGemdKRjkeAP9/yqfNlLL3jT6O6r1xW4eZxTzPJ1fbDL0900Pf6S0az7KAooTbFrZ2EPDix5ShBudHoMloO6iOVzOm2qBpvYLwDrtMyoC8C1fKlWTmR7qZ4D+w6gSWwQUzSb+QfwNw4LR2j3Li9wF7i8TPbKPugg42XWKf+7AkXvCaiiYFEEv9EtCM4ANvhx9QWIEz1UEGNybGMOp0F1gg/+uQVe3kEm3TdCrDrBNcRPB6VJMopLqYb8gmQcDmVvbCVEY+sVLSKnN6aP0Iub5o0+FHLc3/SgKIMDArFyYH6qAJw1UaCxMHGs3USmw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/edf09d4b6206e09

Extracted

Path

C:\g1rFryAhrVg2xrt\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>JhnMGdMG0os+1xx226F4s3P3g03ES3NkArneYVRzrVZDQWtc9I1AmtcQmBB2scSYlDNP6/Zwic26VKcT1C7C/78VFIOZVJyH78/qHXysh0N857lhQNvFnPPs9Dh/1L5wAk4RvLS25mLpmNjj+KlQQO6SHXcv31o3CCKtrSUCj1bjbjaii8DElfu4iPs5u81rLx579ZdcFMUUw0UlRpDY4jYX9G9CEVIDFI303EdycmdPfb3yYx/I4u+J2nN+lxSgQp6JOeZRUk6DpdzMEljoflCwkv9pjEqQ0ugVqO+65I1zL2pPUpiddQibF5L6BKvwVgd7T5nqICQZV4eeQYmdkw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\Annabelle.exe"	Annabelle.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Annabelle.exe

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Annabelle.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (438) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/files/0x00090000000233ac-916.dat	mimikatz

Contacts a large (1140) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Disables RegEdit via registry modification 4 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Krotten.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5768	netsh.exe
1168	netsh.exe
6220	NetSh.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydocs.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rasman.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellstyle.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdsk.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usbui.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemexplorer.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cabinet.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdsk.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cabinet.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpg4dmod.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\url.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rasman.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemexplorer.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllhost.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksuser.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\url.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DBGHELP.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DCIMAN32.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webcheck.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpg4dmod.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	Annabelle.exe

Sets service image path in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\sckzapxbnzqyvnjs\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\sckzapxbnzqyvnjs.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mgiipqfuqnzmfnuf\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\mgiipqfuqnzmfnuf.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gjedbqtfewwnvemoe\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\gjedbqtfewwnvemoe.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cekmvdinlpkxkkmt\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\cekmvdinlpkxkkmt.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssqlaq\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\mssqlaq.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mssql\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\mssql.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\thwskdtkuszmoe\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\thwskdtkuszmoe.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\yheognbofuvjmqck\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\yheognbofuvjmqck.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\yqtdiokxywgiifcr\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\yqtdiokxywgiifcr.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qgrqyinywzozssspp\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\qgrqyinywzozssspp.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\obtzgnuzimmjyvge\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\obtzgnuzimmjyvge.sys"	mssql.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jxoftaiazvimjib\ImagePath = "\\??\\C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\ac\\jxoftaiazvimjib.sys"	mssql.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\139b50ea.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe	DeriaLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe

Executes dropped EXE 8 IoCs

pid	Process
2496	system.exe
4952	FC0A.tmp
2124	{34184A33-0407-212E-3320-09040709E2C2}.exe
3640	{34184A33-0407-212E-3320-09040709E2C2}.exe
5780	nc123.exe
2320	mssql.exe
12400	mssql2.exe
3820	SearchHost.exe

Loads dropped DLL 1 IoCs

pid	Process
1516	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/12484-6197-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/12484-27749-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\system.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*39b50ea = "C:\\Users\\Admin\\AppData\\Roaming\\139b50ea.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\Web\\rundll32.exe"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\139b50e = "C:\\139b50ea\\139b50ea.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*39b50e = "C:\\139b50ea\\139b50ea.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\WINDOWS\\Cursors\\avp.exe"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	NoMoreRansom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\Downloads\\Da2dalus The-MALWARE-Repo master Ransomware\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\139b50ea = "C:\\Users\\Admin\\AppData\\Roaming\\139b50ea.exe"	explorer.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-557049126-2506969350-2798870634-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-557049126-2506969350-2798870634-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	Cerber5.exe
File opened (read-only)	\??\u:	Cerber5.exe
File opened (read-only)	\??\N:	GandCrab.exe
File opened (read-only)	\??\b:	Cerber5.exe
File opened (read-only)	\??\j:	Cerber5.exe
File opened (read-only)	\??\k:	Cerber5.exe
File opened (read-only)	\??\E:	GandCrab.exe
File opened (read-only)	\??\G:	GandCrab.exe
File opened (read-only)	\??\I:	GandCrab.exe
File opened (read-only)	\??\X:	GandCrab.exe
File opened (read-only)	\??\o:	Cerber5.exe
File opened (read-only)	\??\p:	Cerber5.exe
File opened (read-only)	\??\q:	Cerber5.exe
File opened (read-only)	\??\w:	Cerber5.exe
File opened (read-only)	\??\x:	Cerber5.exe
File opened (read-only)	\??\e:	Cerber5.exe
File opened (read-only)	\??\h:	Cerber5.exe
File opened (read-only)	\??\L:	GandCrab.exe
File opened (read-only)	\??\O:	GandCrab.exe
File opened (read-only)	\??\g:	Cerber5.exe
File opened (read-only)	\??\A:	GandCrab.exe
File opened (read-only)	\??\H:	GandCrab.exe
File opened (read-only)	\??\M:	GandCrab.exe
File opened (read-only)	\??\R:	GandCrab.exe
File opened (read-only)	\??\V:	GandCrab.exe
File opened (read-only)	\??\Z:	GandCrab.exe
File opened (read-only)	\??\m:	Cerber5.exe
File opened (read-only)	\??\v:	Cerber5.exe
File opened (read-only)	\??\z:	Cerber5.exe
File opened (read-only)	\??\P:	GandCrab.exe
File opened (read-only)	\??\S:	GandCrab.exe
File opened (read-only)	\??\a:	Cerber5.exe
File opened (read-only)	\??\i:	Cerber5.exe
File opened (read-only)	\??\l:	Cerber5.exe
File opened (read-only)	\??\t:	Cerber5.exe
File opened (read-only)	\??\B:	GandCrab.exe
File opened (read-only)	\??\K:	GandCrab.exe
File opened (read-only)	\??\Q:	GandCrab.exe
File opened (read-only)	\??\T:	GandCrab.exe
File opened (read-only)	\??\U:	GandCrab.exe
File opened (read-only)	\??\n:	Cerber5.exe
File opened (read-only)	\??\s:	Cerber5.exe
File opened (read-only)	\??\y:	Cerber5.exe
File opened (read-only)	\??\J:	GandCrab.exe
File opened (read-only)	\??\W:	GandCrab.exe
File opened (read-only)	\??\Y:	GandCrab.exe
File opened (read-only)	\??\D:	SearchHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
119	raw.githubusercontent.com
120	raw.githubusercontent.com
121	raw.githubusercontent.com
122	raw.githubusercontent.com
123	raw.githubusercontent.com
117	raw.githubusercontent.com
118	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
199	ip-addr.es
207	ip-addr.es

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpFA5F.bmp"	Cerber5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyCalendarSearch.scale-125.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\BLUEPRNT.ELM.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\msvcp110.dll.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\mfc140enu.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_bho.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ur.pak.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-150.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessCompare.rdlc.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Wood.jpg	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jsdt.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetIQ.ExcelAddin.Resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-200.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms	CoronaVirus.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small.png.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\MOFL.DLL.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\en-US.pak	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\cloud_icon.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\PackageManagementDscUtilities.strings.psd1	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.ILGeneration.dll.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-300.png	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-100.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\6px.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\stable.identity_helper.exe.manifest	CoronaVirus.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-It.otf.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ui-strings.js	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-16_altform-lightunplated.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_zh_cn_135x40.svg.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\web_documentcloud_logo.png.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Shaders\LoadedModelShaders\StandardLighting.hlsl	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encodings.Web.dll.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-36.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Retail\Retail_Feedback_icon.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ui-strings.js.id-B6206E09.[[email protected]].ncov	CoronaVirus.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File opened for modification	C:\Windows\FC0A.tmp	rundll32.exe
File opened for modification	C:\WINDOWS\Web	Krotten.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GandCrab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	GandCrab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GandCrab.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2500	SCHTASKS.exe
1504	schtasks.exe
2684	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
12740	vssadmin.exe
6800	vssadmin.exe
7068	vssadmin.exe
7128	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\Main	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window title = ":::::::::::::::::: ÌÎÉ ÕÓÉ ÏÐÎÒÓÕ À ÏÈÇÄÀ ÃÍÈÅÒ ::::::::::::::::::"	Krotten.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://poetry.rotten.com/lightning/"	Krotten.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557049126-2506969350-2798870634-1000\{FFFDA2CE-B1B3-4BCE-A05A-DB0354129BAA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\REGFILE\SHELL\OPEN\COMMAND	Krotten.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
504	msedge.exe
504	msedge.exe
3740	identity_helper.exe
3740	identity_helper.exe
6132	msedge.exe
6132	msedge.exe
5796	msedge.exe
5796	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
1516	rundll32.exe
4952	FC0A.tmp
4952	FC0A.tmp
4952	FC0A.tmp
4952	FC0A.tmp
4952	FC0A.tmp
4952	FC0A.tmp
4952	FC0A.tmp
3172	GandCrab.exe
3172	GandCrab.exe
3172	GandCrab.exe
3172	GandCrab.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe
4016	CoronaVirus.exe

Suspicious behavior: LoadsDriver 32 IoCs

pid	Process
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe
2320	mssql.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5984	CryptoWall.exe
3884	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1516	rundll32.exe
Token: SeDebugPrivilege	1516	rundll32.exe
Token: SeTcbPrivilege	1516	rundll32.exe
Token: SeDebugPrivilege	4952	FC0A.tmp
Token: SeDebugPrivilege	3744	DeriaLock.exe
Token: SeDebugPrivilege	2268	Fantom.exe
Token: SeSystemtimePrivilege	760	Krotten.exe
Token: SeDebugPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeShutdownPrivilege	2296	Cerber5.exe
Token: SeCreatePagefilePrivilege	2296	Cerber5.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeDebugPrivilege	12400	mssql2.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeIncreaseQuotaPrivilege	7052	WMIC.exe
Token: SeSecurityPrivilege	7052	WMIC.exe
Token: SeTakeOwnershipPrivilege	7052	WMIC.exe
Token: SeLoadDriverPrivilege	7052	WMIC.exe
Token: SeSystemProfilePrivilege	7052	WMIC.exe
Token: SeSystemtimePrivilege	7052	WMIC.exe
Token: SeProfSingleProcessPrivilege	7052	WMIC.exe
Token: SeIncBasePriorityPrivilege	7052	WMIC.exe
Token: SeCreatePagefilePrivilege	7052	WMIC.exe
Token: SeBackupPrivilege	7052	WMIC.exe
Token: SeRestorePrivilege	7052	WMIC.exe
Token: SeShutdownPrivilege	7052	WMIC.exe
Token: SeDebugPrivilege	7052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	7052	WMIC.exe
Token: SeRemoteShutdownPrivilege	7052	WMIC.exe
Token: SeUndockPrivilege	7052	WMIC.exe
Token: SeManageVolumePrivilege	7052	WMIC.exe
Token: 33	7052	WMIC.exe
Token: 34	7052	WMIC.exe
Token: 35	7052	WMIC.exe
Token: 36	7052	WMIC.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe
Token: SeLoadDriverPrivilege	2320	mssql.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
3820	SearchHost.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
3820	SearchHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2320	mssql.exe
12400	mssql2.exe
3820	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 2152	504	msedge.exe	87
PID 504 wrote to memory of 2152	504	msedge.exe	87
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 3584	504	msedge.exe	90
PID 504 wrote to memory of 1080	504	msedge.exe	91
PID 504 wrote to memory of 1080	504	msedge.exe	91
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92
PID 504 wrote to memory of 3988	504	msedge.exe	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Ransomware
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9523b46f8,0x7ff9523b4708,0x7ff9523b4718
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3314002778319645969,6737957470650844238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:6232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5448

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\$uckyLocker.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\$uckyLocker.exe"
1⤵
- Sets desktop wallpaper using registry
PID:2492

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\7ev3n.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\7ev3n.exe"
1⤵
PID:2124
- C:\Users\Admin\AppData\Local\system.exe
  "C:\Users\Admin\AppData\Local\system.exe"
  2⤵
  - Executes dropped EXE
  PID:2496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\del.bat
    3⤵
    PID:5108
- - C:\Windows\SysWOW64\SCHTASKS.exe
    C:\Windows\System32\SCHTASKS.exe /create /SC ONLOGON /TN uac /TR "C:\Users\Admin\AppData\Local\bcd.bat" /RL HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2500
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    PID:3108
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Modifies WinLogon for persistence
      PID:3884
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
    3⤵
    PID:4008
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /t REG_SZ /d "C:\Users\Admin\AppData\Local\system.exe" /f /reg:64
      4⤵
      Adds Run key to start application
      PID:452
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
    3⤵
    PID:3092
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
      4⤵
      PID:5664
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
    3⤵
    PID:5064
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d 506 /f /reg:64
      4⤵
      PID:4020
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
    3⤵
    PID:5592
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion" /v "rgd_bcd_condition" /t REG_SZ /d 1 /f /reg:64
      4⤵
      PID:5464
- - C:\windows\SysWOW64\cmd.exe
    C:\windows\system32\cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:2820
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f /reg:64
      4⤵
      UAC bypass
      PID:1824

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Annabelle.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Annabelle.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Adds Run key to start application
PID:5104
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:7128
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:7068
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:6800
- C:\Windows\SYSTEM32\NetSh.exe
  NetSh Advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:6220
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" -r -t 00 -f
  2⤵
  PID:7952

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\BadRabbit.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\BadRabbit.exe"
1⤵
- Drops file in Windows directory
PID:5560
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Delete /F /TN rhaegal
    3⤵
    PID:4488
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /F /TN rhaegal
      4⤵
      PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 219676972 && exit"
    3⤵
    PID:6100
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 219676972 && exit"
      4⤵
      Creates scheduled task(s)
      PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:32:00
    3⤵
    PID:5376
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 17:32:00
      4⤵
      Creates scheduled task(s)
      PID:2684
- - C:\Windows\FC0A.tmp
    "C:\Windows\FC0A.tmp" \\.\pipe\{6555E5E9-89B0-4C1C-9884-7038FE10327A}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4952

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Cerber5.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Cerber5.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:2296
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  PID:5768
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  PID:1168
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___247AS_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:17572

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\CoronaVirus.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\CoronaVirus.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4016
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:848
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:7884
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:12740
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:19016
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:20392

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\CryptoLocker.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\CryptoLocker.exe"
1⤵
PID:5172
- C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
  "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2124
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000224
    3⤵
    - Executes dropped EXE
    PID:3640

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\CryptoWall.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\CryptoWall.exe"
1⤵
- Suspicious behavior: MapViewOfSection
PID:5984
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\syswow64\explorer.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: MapViewOfSection
  PID:3884
- - C:\Windows\SysWOW64\svchost.exe
    -k netsvcs
    3⤵
    PID:5944

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\DeriaLock.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\DeriaLock.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Dharma.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Dharma.exe"
1⤵
PID:816
- C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\nc123.exe
  "C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\nc123.exe"
  2⤵
  - Executes dropped EXE
  PID:5780
- C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql.exe
  "C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql.exe"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2320
- C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql2.exe
  "C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:12400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\Shadow.bat" "
  2⤵
  PID:12568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\systembackup.bat" "
  2⤵
  PID:12656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
    3⤵
    PID:7432
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:7052
  - - C:\Windows\SysWOW64\find.exe
      Find "="
      4⤵
      PID:6664
- - C:\Windows\SysWOW64\net.exe
    net user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
    3⤵
    PID:20384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user systembackup Default3104 /add /active:"yes" /expires:"never" /passwordchg:"NO"
      4⤵
      PID:10472
- C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\EVER\SearchHost.exe
  "C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\EVER\SearchHost.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3820

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Fantom.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Fantom.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  PID:21012

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\GandCrab.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\GandCrab.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3172

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Krotten.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Krotten.exe"
1⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\NoMoreRansom.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\NoMoreRansom.exe"
1⤵
- Adds Run key to start application
PID:12484

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:9688

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___247AS_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
PID:11600

C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Annabelle.exe
"C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\Annabelle.exe"
1⤵
PID:24288

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:7112

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38b6855 /state1:0x41c64e6d
1⤵
PID:8156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-557049126-2506969350-2798870634-1000\IQJYNXQ-MANUAL.txt

Filesize
8KB

MD5
46e06443bf3f5a8b2957ab2dd7fa2faf

SHA1
f7ae5225ca7b79d327c33161f837474fdde2081f

SHA256
d1ed436bf6a62ab86f4c2d0fed91a2644a2d2bacbb44ee1c151cf0b515fba5f7

SHA512
ebadb1e588a7094a354feabe7a3666288f77a02d5ca79bc89ffbbeefe40e2d017a02f8fc7a688f42050e75d075a513713a6640274c03886f657932daedc04158

Download Submit
C:\$Recycle.Bin\S-1-5-21-557049126-2506969350-2798870634-1000\desktop.ini.id-B6206E09.[[email protected]].ncov

Filesize
918B

MD5
95357dc79c1a435a6007d2c30060c154

SHA1
de15a88392febdccd3cff7953dd5788306641267

SHA256
cd92780059138256f698000666523afa2fd3ed5f4d1fdf55b83179e4bb5ac001

SHA512
521faf658696382c8c24c9b54b9c59efbd708496a7bcdbada6fc615d7eb6f94d5052a593bba5f07a282836a2e0c1b138064453b38b88d648b879c43475e5f1c1

Download Submit
C:\$Recycle.Bin\S-1-5-21-557049126-2506969350-2798870634-1000\desktop.ini.id-B6206E09.[[email protected]].ncov

Filesize
378B

MD5
0622239b1730d778b3e837dd4078e7ee

SHA1
67ff6889776dd7f00bca2e5b34fbb21113ddb20a

SHA256
6c3e81dd9710cad0b1671ce83078ef96433633ea089ab48e4113514666ed8c07

SHA512
280d723e2bcfd35a0f92e3be013d959b02dea3a674dec36fcdfe7c798560dd4ded1862ee405d89ef63c6afc37f62bc6a178311ec15f3604d6b938edd394eea09

Download Submit
C:\Program Files\7-Zip\7z.dll.id-B6206E09.[[email protected]].ncov

Filesize
2.5MB

MD5
5d814f60fd22216d7debd05beaa12dd2

SHA1
d6d44fa523612bfabd0a2904efeb7af4d132529a

SHA256
cd39b9748a9d2ba78de5c43718b5994b4b07d53247e281115a28a13315991222

SHA512
d65dd3e7a59db0d35bd020a347cbffbe11326c36195e5e04f401198b3f796220d772a5daa736403ee5ec8811e7c7057bc68239e1a3154c9a08a2197fa10944e5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\CoronaVirus.exe

Filesize
768KB

MD5
4182878bc42374642fac7459770ef556

SHA1
0834be017de17c29df1be10ffd9e6e14857f87de

SHA256
d2c0486fcf7fd923f904b1a9e1c51b9c74d62f1af7090799c6f47e106d22bb73

SHA512
81a3d5ad4061c8953dfa27296f90ef3886fdf2edb9a66a6cc074b88cb36dd871082ca3c87a673722dc6be6b5300945ba498fdaeccc49361ec2eca3ae226427ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
34KB

MD5
02214b097305a8302b21e630fa201576

SHA1
90c2a31521803b73e847f7a3e0cfceec84df9fa5

SHA256
1d98076cfae6a0a8f0b0b1c654270b900de83e633cc01d98ef63e6a8e485a3f4

SHA512
553c81eb51880f83b9918aef766ff0f41170895b1cda2589f0b69c3d1362de8e8decf14a413f6b5df1fb7ce07fc939211407b29046188b37c290133c9d5e1cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
1.1MB

MD5
fcb3b79b4ee2a97d69020a59b8d5caee

SHA1
4c8c8dc00b8c71694cdadbfd1fe70358d34a0883

SHA256
36b4ec7a0ae8d3b2f907b88735287ffc68c0c35e472b3c8cc30f49f4387c9f8b

SHA512
7874b3e78d0c0ef2f1f2e417a989550208c20aab398ef9ec800104dc047ec3866863dbbeab379fdbda7643210b03e20d7305a5fb776df88bef72ad89023cb558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c3f7695ca23729d3455e2c466b6106eb

SHA1
b2326a8ec4c41cff2939df7a1b39cc6e3235764d

SHA256
3351a1a16890df6268341b300655f4e0834a6b80b7ad5603d71d7939954bcc6e

SHA512
03eae3a30eb04db4ee6c00d91c1e748393123be018536423a6462f89f99a97ca553a588033d346f8e8fb08e87f131e2d2eae77126e0645033494536000f3e919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c81fc61e1f82fcc0cc9795f58bab61a6

SHA1
da62cd221c7b1aeba59c4f7ed8cd34fce21ff966

SHA256
c50dc353e57d15c12b61e1583f42918513258c8c14543cb1a5dcd937984dceca

SHA512
e6cf8c74f30675cc45803eb5305b04998b1db76878a2264968481384ca9854958e87757f6c8a70f64546174bd5f151c7cdbca96c8002126e9942760f04cae9ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cef9ecbd2023d1725a6eb7fdc899803a

SHA1
33bd455625478d6e420c71f7d860cef9c352d172

SHA256
e8485b5a16c9d0541c40ac3378031df2fbc9a4cc1269282f6bd82e476e07d238

SHA512
1499fad65a4f6feebfafed19dc549f55a32a3cf91d79ab60ae3acd6a5615f2e2c9463668e416d9a3f1e2b016eec400db6d19080582ed0bc3a160bf6d2dc9c4ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
93a257b03f5a8a84d3459b77d54b4ad5

SHA1
6ac239107b619d4c62da698342fdb6c2152897c6

SHA256
8620b9334698471ca0e8c0ebf913c39ec184bbe4df50f64848f5f483a1448e78

SHA512
bf6f482fe3f23b039f55a01ada9d53985d080f8853b6590c9505a46543a893d21aaec6b0fe28c6a483bfcd905b43081691f442d9f17baf7c83395f3290bfce4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
185265d12bb4adaf0ee2ccd440d79b65

SHA1
0f5b6142d9cb3259fa30607c153766b3f42b0d97

SHA256
f2b549efe4d56813640919208b1ce350917f95fcf426e605afd753d41f04e186

SHA512
9d7727b88d44ee6136dad73f5ed05b017e7b48d30f381596caeb8211d6540e28f4f8209517089f1be54d596381c0b060503622a832142be054fcaf14aa2f2051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8e95d9297ab01755538e83bafcfb2344

SHA1
a0c380ecc1d641230da02bd4aaf3b146f65e47d1

SHA256
f49adaa5e0b1db0386eb6280b77f993aab11d3db37d261bc0c42c31866f0a0ab

SHA512
6c380289e5a0ab8d8132483c7248dba6ef53ae5612b6102c7ae4e2c2cf0eeebee7f700aa4010ea46f4d0f10ea5db01d37e386fa29af96c40735f0e1bd57038fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
160afd473bfa0fb56e15f066de57981d

SHA1
533f8b5269583083f2e7aa5c4311669be9e90881

SHA256
b041bbbbd6d3eb29aae58c7c90f0eb005ed4c4c60af8e4124322b90ac8c22622

SHA512
614d362a762bd07caca29401c31bc59c0301fca8d9268ab1b10ea40ef0ecdad1f6ec65366108c4ebddd6f7d49f1bf5cf7d3c2e950db715834945355a136d0506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ec0a7f9a9f62819ed082a7607554a9c

SHA1
daded61df7a810962f7f0c89376035d8a680f201

SHA256
316a09959fe2461cf3d43e233027647121f43a3c89e6217971a117fd10b9f0f1

SHA512
a0d4d78cc1dca5b8cfce0e9b9d9cc519631146f5a7e9933ed0a3069a909a1b5b7fa760e385acc2c92bac3fc95c7d35f0f3309f9291c18c77bafd69473b656eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
68fccbaa149533dccfd99d32f0cac358

SHA1
eb4a566b80389b7b55eac4f7e0c7c56cf146cbe8

SHA256
4b19b88a7934d33cf9abf180b1260bd4c4e3eb4be58f181ffca906443e53ae0e

SHA512
59be60f52f99e2cb4098e53255cfac82e40e62e2e7b508755cc58fc39af3901541cba9d1dc41a6127c6e402712c8e656323a8bf63560eebc8bc7cc39ff8750c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f28d40b68a4e278b06b7508b3dbc6c6

SHA1
8c431dbd443490c45b808e6d604340e5ffd71069

SHA256
274372dbc83a28a95776b59f84e68544d95ad27b560e64beeed9ec31a1eae149

SHA512
b053558d04077d5e5a831075bf3e6444a05fad8baf49849c800c5187bdfb571e6a0972f904dff91d77c6b003590660c8eb9356be5ad245f39e802a4fc1105322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9d31be68b46732e18ad42359152ad172

SHA1
c3d5f5a7cf0dac577e35b3e445e49ca8d3b574cb

SHA256
4a88dad99bfe0dd2783010bed9fe5e1076591291d3040ad59bebffdba28bb2c5

SHA512
ba8bf055ae816d5d35443ad097cda7425e525145b1de3ad2d476c20abbf5fb76f64a5d02eefe0cc1f3cd78d4945428f4bec3ed5dbebb5367a2a2f76ad218e47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
49684b5c5beed9f9f04d0dc0b3cac6c5

SHA1
6b43661d9b276adc777983a6422477b7de431c62

SHA256
4e1fbb407d73ff2d4d98984096d700d6ceac58e0d4f12f658c8e2024787afe36

SHA512
d7d10e722d7c898b778fa4c5982f2756eeba9ca114e2be9992c410dd3848b655797cd7addf30804bea2e8254c5198f47cd569bf320d79bc877eba561f8dcd143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cf4773ad60737be35b03a8ecebcd096b

SHA1
736f57dd20e5d70fa40a4023366045a9788c745d

SHA256
d97c6a0196b304022ab01a7c4d44f048d17feb96da705fb42a2e66ac78fc341d

SHA512
aa42dfda15b8f2bf4e6dc87755d3665f44bc8c85d2cc9a87559092e7b6d311320fb8e3ad9eb4396fcc897314aeb0b90752a907f74fd3f41afa3ea4b360eb399e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c7d4.TMP

Filesize
874B

MD5
3ff1d64f2057d92d043b0fd0c9f22f88

SHA1
742bc58c6116adefe9823bd352a1592f8f8023ab

SHA256
0b8bb929e2bf8e5bdbe921c20950089dad64685210d826d1eb9fe8a39f2d99c9

SHA512
801a14cec6d86e89db163da93bea7eb44c4712c43f8ef64145fc53db7073922712effc5796d421724989336b6f1fbca86dad32eea2becd1eabc253b7dfaac917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da8b5aad-0ddc-4ba0-a66f-b284617d7da5.tmp

Filesize
6KB

MD5
37535f735c60190078a6cba1042dcd1a

SHA1
7d46954120372bd1a455558d0eda342fd744cf1a

SHA256
7000c043e38bd1421a3f4c8e70227ac9daa147f59623af3ee4eb55b5b25b116e

SHA512
2880996295b1dc4847823fb56b3c6f1f93a1253b84955f3c6670ad6b09b541d61f42459410586edd7e0970974131d5cfd009effa0c1e0f2043a4ef0e2acdcb70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43bf60aaf34380b0af24dfa9fae226f1

SHA1
dbf11f96d340b4b382328f038974180c4b13ee30

SHA256
d50cb0b68b070b2f1829031baccca9c1d6caaca8297872a610a7e5668a1c9e9d

SHA512
0642933c600b3632df9daed21a6a964d365a26e47f6999de96799786c4a81b3d300cc8559c314efcf1c3a3f748a3ebc3fbea0123d95886f7a0d35ef0fdf0875c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9b2dd6f5a1042d8db326a5a8ff897cc8

SHA1
b2478a35478eb6ba65df5b7c9de8e9375bc7cc6b

SHA256
2ec179d4c1be0741dffef20430fcdb6f93e7df8958c3aa903b31532e1af01f02

SHA512
48bb5f381e18752ab60a2e476bee490213740cd0d2d0f2b6531b11e3ac3fcca38a44c41d046de40ba5c93fb346ff0a4b7f6da6ddea9a1b9c9181d37bb982b281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
963ad36bd8ddd1398585bd56f98fd18c

SHA1
a4d0733c9014de1609d277418d2809fb4cfdc8a1

SHA256
7281d230bfe54c5e12b651501c69244a5a33fac0b7a38b7ada4e0647a732ee00

SHA512
513e89bcb265a78cd07eb2083702a89dec699120e469090b64af7ffb609c77e0c1cc5d41fb4982370c4a5ad42aceb13bdefaf9c342f149cd5d6c60993cbb5142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b62032ad9968beed61b6908df4a32214

SHA1
5dcb1eb1376fe3f3902ffa7093f5630b09fa5cb0

SHA256
7e968e2bd47d495a6768f37ffcd71fac1d233a4097fde4d5d3bfe0576cb0f5f9

SHA512
7c7d2b113cc8f672f070832a79c22b25cd7376641cb34a685bfd1d0122bd41f3825dee77eb284be21f8a79c43c929d8c2d1f3e9a678942d068d4ac6033f7095b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Local\del.bat

Filesize
100B

MD5
3f0bf833cda75ba13ee3999eddeff836

SHA1
7e581b7641c3081fcecf2ea8cb1ba262ec5e68c3

SHA256
feaa47953b7def5dc66a3d978745010c980d889aba42b963095ca5ff4e8d45d3

SHA512
f390de0cc40cf8e94078c9e50bbfa35463697c33ad5a2af0dd3abb44f5ef8ed16718719aa0cf79092bc634286c0576daf8de287e26296c0fe067126f64409f82

Download Submit
C:\Users\Admin\AppData\Local\system.exe

Filesize
315KB

MD5
68c8e18a1887eedc3da23719a34f6329

SHA1
682a53bb3b8006219f0cfde25f7866db755c0a19

SHA256
b3d38fd9bc60f5610c262392e8dcce0ad05b6a7ebc4e4b7232578ed80ff0270d

SHA512
2733065fe4e2ee1749bfb78d5541cdb5204f291ceec4711da856e4e8f2d80eed51169c5434afbcc493434862787267f878de619847f03113c078a24d8f177c07

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\139b50ea.exe

Filesize
132KB

MD5
919034c8efb9678f96b47a20fa6199f2

SHA1
747070c74d0400cffeb28fbea17b64297f14cfbd

SHA256
e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

SHA512
745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

Download Submit
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Desktop\READ_IT.txt

Filesize
124B

MD5
54ba0db9b8701f99a46ae533da6fe630

SHA1
2bd5aea2aceea62deb7ba06969ff6108f3381929

SHA256
bb1455630e747e00b60910f9eadf47641ecc46e917034d08530430569d8eaeac

SHA512
27fa4e43cf1a1b79a597cfb28aa29457aa096d8c485f84d7b2754268148bfa7430e53abdee4897f911af51aabbae3942ff57cbae02765bbea27e1c181bfecc1a

Download Submit
C:\Users\Admin\Documents\1.R5A

Filesize
11KB

MD5
85906469a37c5e037e574ffc6d2a436e

SHA1
c2e970a86d308e8db9ce4d76a0bfd299efd1e910

SHA256
ae8df427066b4ce856dea93cdcd08b5948ef1b1c98f3d2f6d3e8db2346dfac45

SHA512
8587b53191efb3275b5d67e1a3253f5839f76462697ecaa5c2eb22da5f5cb3bc4540ca9146a3bf3f287075bfc9498a9c7c139668a894907d446a8e9ed01c1582

Download Submit
C:\Users\Admin\Documents\2.R5A

Filesize
192KB

MD5
b2a96a37c649341f5ac543789d9e2670

SHA1
3c15ba177b819deff50aac4609c4e75872241998

SHA256
c735cbabb1db46b060b7b53e61ac724416660838824723d6cb3ae37914d5a9ef

SHA512
3598545661c619ca945feb058aea2f8ce2a3b491c50be726719a241b98e5b16bd47524fdca4fa9eed3bbfda032ce0e81085cf56d9c0d08d16f7ad20733afb855

Download Submit
C:\Users\Admin\Documents\3.R5A

Filesize
11KB

MD5
f5c5a2e944d361943376cc7756f16c9e

SHA1
1d712c715071eec4621686e74d003619ab4d1f03

SHA256
388cebed4a66ddf9818a495d9743172084e70df49b10fdf8e5736c24f43dadeb

SHA512
436925c4afc31e25bce735a3855817bf328a2ccb03cd09a5661b4f301fc82f95e07ec13ac412df8fdae5c7b0d189c69d60689e90136a6121a97f31a04c821b5e

Download Submit
C:\Users\Admin\Documents\4.R5A

Filesize
1024KB

MD5
71e22542560f18f212e591455acf443a

SHA1
355a578e357a904423b087c5fd42008d11c3e7e9

SHA256
4eea37a8b633b4631d848e509a48d5b16a96bf4c1b00f5d1356043068891f2a3

SHA512
8e4590e864c8f57dc1ee296e5daa64c90abf83f0ce3c1234a3d5119d8a41c6eaaaba631254eb73ed08d74e367dbcb1587a6eed48b26ce89dcd7540be89230e0c

Download Submit
C:\Users\Admin\Documents\5.R5A

Filesize
11KB

MD5
839ac0a19fd745643b458e1342782a3a

SHA1
1a83389328b895b6117b44f9f23872e5266f1e16

SHA256
6b36efba19f4d5a07fc3069b78b32d607f07a661b79a3586bd15e501ff1dc2dc

SHA512
4b66624ceb656876c7301b93ae0d6f92be5bb3a26f2c311384d33e2335a115605b00b5493c7760822805909f4ac403371ef7e6b699b4e715499c14b65e245471

Download Submit
C:\Users\Admin\Documents\6.R5A

Filesize
11KB

MD5
69c03cb2d835b3ec618f6ba833e1f11e

SHA1
12f2797e4c93e4fd4d4f5aeb2faf1e35e50aedac

SHA256
4efdd6865206156a535a7c129346808d4f3424d0e06754e7cbc5417a91498b9f

SHA512
ea2e5f847863866b429f017d4364ae283a7b46bdf1c33b382a61a9b1a350a6347408f5505396d728c313b6dc27a794e28111e6bec8a1e568e9c4d2d774d52458

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware.zip

Filesize
24.6MB

MD5
2b9d7761bdf21c76a2a422bfcc4cdf0e

SHA1
00d312e6a42c4d93a8b18509c6b620c9f8ee8a00

SHA256
6dd95bde11d22564b5e4136909698bbc6460d08b8f55362dcefcb3d962976ac8

SHA512
4a4d90b7fd5cf2c5d185e0b9f4c5462b2ed3a648ce4b7b52f3bfa28bcbba08239f2ec71ccfd41287acaec3bd3a78af4e1c67dc98716f47a2c8306e7f5fd6143e

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware.zip

Filesize
320KB

MD5
88f24c916520ef85928a387131af660e

SHA1
6d681acd49bd3ce0624225b6290b8cc8b5d4dc7f

SHA256
3e30c98a540c216457b087095590cd960239ad8bdecf1934fe1f1313dceddad6

SHA512
b1627a1f42d9be0b42f067d6ae6fd18f3061d801794f9e85136a5b7417a5e043154399ddae2ab270450b96941fed734b7fe54439b71a0453847967f8fdc546e0

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\EVER\Everything.ini

Filesize
19KB

MD5
5531bbb8be242dfc9950f2c2c8aa0058

SHA1
b08aadba390b98055c947dce8821e9e00b7d01ee

SHA256
4f03ab645fe48bf3783eb58568e89b3b3401956dd17cb8049444058dab0634d7

SHA512
3ce7e1d7b330cc9d75c3ce6d4531afe6bfa210a0bcbb45d4a7c29aabff79bebf3263fe0b5377956e2f88036b466383f001a7a6713da04a411b1aceb42bc38291

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\EVER\SearchHost.exe

Filesize
128KB

MD5
0111d35eb62fac0447e6bdfa71f58aa5

SHA1
4f9573252d1f8974e7106305b13af3565add6558

SHA256
44aa0efb7bbd5521aeb0ea8e952ae313153a7d9fc0f9eaf3a8ea6724732f88d4

SHA512
2c532b55a4aab1e57a1564267f0770257dcadced4a1c96d60a38386283e39cb0cd47effe7a815807d489ab0298170cd74da14e616cc8c587d5b7f52d54092207

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\EVER\SearchHost.exe

Filesize
561KB

MD5
86ec260012457305e1d88f06f8373b9a

SHA1
daa580b28279a95e2589a019b0ce16808154f0d6

SHA256
98862f81c502c6114438c7bce5e82fa8661672ad866d9b2ab2deade00e7139b1

SHA512
75885241784798c25797ad65c082b76a563c94a2a4b9cd078d40b6cecdbb2abc83faa48fa7d9e5324bab770d2c37087d2536d57a9ce5c9beee77a1ab03371f6b

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\EVER\SearchHost.exe

Filesize
192KB

MD5
31fe79797fa856ce5983c6c399bbe9b7

SHA1
8647c40987c5f6ceb87632c8dabbc4124118d91c

SHA256
0d52b5ccf4e5dd922aa13dbcec284215bb1e5464f377117127e5835507602dc4

SHA512
0102e238d21efa240db6028ee64276b5ee9b48a9efcbf297618a04632ed4ca06a2c6800b69fcd95a7296c96c74ae803a175fd231c2a60aacaa6cf4d36a59786b

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\Shadow.bat

Filesize
28B

MD5
df8394082a4e5b362bdcb17390f6676d

SHA1
5750248ff490ceec03d17ee9811ac70176f46614

SHA256
da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878

SHA512
8ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql.exe

Filesize
64KB

MD5
15051f741f8ff82f2fbcb0dc07e4ee65

SHA1
46bb91a94064571eba22456dbdcf45b47c1df05b

SHA256
5629a0c1d79354cee94381b3883c8821ba70e21b3544d252ea415f6738ed3138

SHA512
3f0358d661acb0284ab54333322c4b8821a7d743796b2bc21d5d8d84a6ce1eb41e98323eca34569a6e859e7e20d551057e441ccad4d5c9bf1dac0bbe2b188827

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql.exe

Filesize
448KB

MD5
2a4221b9647d7ea0e20a2d3cfc0c16ad

SHA1
058e5c9aa97cb609563345a949665f4c56668cc9

SHA256
a16e1f037ff07be02f9b494ed4b7ccd74992a42f6e3f22fde4e3eb13232362e2

SHA512
55fd47e79a77fe976161455f20dd194679474b87bb83b86346af67d8f35aca639e92a3697bf5e282bee59e7f4969c9fcb2f4c7d4ec24a7e98d95542c424f1cb6

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql.exe

Filesize
384KB

MD5
63b78997c235fa734a3a374feb2a59e3

SHA1
9c93acd13aa9608bc5e3f00e2b893318c290c69e

SHA256
a04955be8274c62bab0ce1b6a48e2c7a92d1bbce12bf05e1a9c55465febc044b

SHA512
1cd80a500c7d1ce5fb43e5a06ec401e540fd156e7fd6d4aac6b25f38ba48f006b10787e861729cd1bc4cd6644ead9038b807ffda6dc334b00daab0d2a5391687

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql2.exe

Filesize
576KB

MD5
12e48f0aac1698e199c6c7cab02e075b

SHA1
2be6ab05139137b5bbf44f35f9e325c1fc1a7c90

SHA256
4cc4d2cc23f67d38fc437e61f167641741ffa391d07555985608249216ecaacc

SHA512
185dbf28e9aa1b568a4b06e78cb20e82643edec39377a72880033a084c29a859055e9637aff38a2ee85a2a9b5417cd873e4e4ad30fddae05ee60246773bdf414

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql2.exe

Filesize
128KB

MD5
6dd11e3db0cbfa9024be702df5396089

SHA1
8660820f7752526e66efc98013543210ff710409

SHA256
25d62f336e7ca7307cebd0b4e9f8b26855c3451b81487b618d8efa438ecf10b3

SHA512
40c3b621c68dd7c9c5c301237704b8357b146b0af824a9289b7de0fc6600121e6bb106a9130f5a1487f91f6dffc03a76fb4dff262f7c84305f831dcd45e2889e

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\mssql2.exe

Filesize
384KB

MD5
cf45f5d2222389a15b189651640397ab

SHA1
863b0134848cbaef4ff8c70c9693294b04eb9357

SHA256
9079c24e1b428392e89f578945730b3eb79b971a44446b115077a2cfcb597572

SHA512
9618519f59f716ebd61b8ce34a70a7291efe5e38001c56e8b84c3252c384bdef24570bd9de2185a0d2a6b04ee62192a2e18ffd247d66d19e1c071cef7d22cfbc

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\nc123.exe

Filesize
125KB

MD5
597de376b1f80c06d501415dd973dcec

SHA1
629c9649ced38fd815124221b80c9d9c59a85e74

SHA256
f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

SHA512
072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\systembackup.bat

Filesize
1KB

MD5
b4b2f1a6c7a905781be7d877487fc665

SHA1
7ee27672d89940e96bcb7616560a4bef8d8af76c

SHA256
6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f

SHA512
f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6

Download Submit
C:\Users\Admin\Downloads\Da2dalus The-MALWARE-Repo master Ransomware\ac\thwskdtkuszmoe.sys

Filesize
674KB

MD5
b2233d1efb0b7a897ea477a66cd08227

SHA1
835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

SHA256
5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

SHA512
6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

Download Submit
C:\Windows\FC0A.tmp

Filesize
60KB

MD5
347ac3b6b791054de3e5720a7144a977

SHA1
413eba3973a15c1a6429d9f170f3e8287f98c21c

SHA256
301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

SHA512
9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

Download Submit
C:\Windows\infpub.dat

Filesize
401KB

MD5
1d724f95c61f1055f0d02c2154bbccd3

SHA1
79116fe99f2b421c52ef64097f0f39b815b20907

SHA256
579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

SHA512
f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

Download Submit
C:\g1rFryAhrVg2xrt\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
b537e33b09334f4cc80fb3edc2050281

SHA1
c0c9836b7024ef3885de9eeb0cbef87b5f4f7f8e

SHA256
eb2b99579c6eb3b90a8f72e464fc75f346f2f16488fc2abd75bc72070996dea1

SHA512
e75fbc6bddc2ebd01a331212328d1dc2bfe04574b3893bdab208af594a71943b7ab613396f1d664c47f8cf24660e2ad0bc1b14ee8ff79e206bb7ada8dc7f3403

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-557049126-2506969350-2798870634-1000\IQJYNXQ-MANUAL.txt

Filesize
8KB

MD5
9785f38785585849073f247ba0054eff

SHA1
d4b81015f8c934f4b1c18213ed7b7efe3f0fd3a9

SHA256
18e26f4b7ab68b42460690ebc9a56dcecac5e5a4a6d24bcb837b464f348bb57d

SHA512
7e90a077c6130a189b5deffacf2c45886456b6d382345fe9764a18043ff96424a43b33bc5b6a54f462350e78ef3f5d3c13910137fc93fe77348d6cf96590e358

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-557049126-2506969350-2798870634-1000\desktop.ini.id-B6206E09.[[email protected]].ncov

Filesize
918B

MD5
9b48db019c33b7761426d588f650ed00

SHA1
75a5213f23ed270cc88039d9ac96d88d266d498c

SHA256
7cf682b77ff37dcfff728f1fea499ecee3b79a0cbaa4fb44cbe88967fa0e54d9

SHA512
de0fa4f9bc3fe220f1830efcc241b90d8d38b5572fc95204069afbcc09136f0a24a98ad1942106c62447092f98cfab2d9334575ec84dbb056581e3b0e48b1411

Download Submit
memory/1516-856-0x0000000002840000-0x00000000028A8000-memory.dmp

Filesize
416KB

Download
memory/1516-864-0x0000000002840000-0x00000000028A8000-memory.dmp

Filesize
416KB

Download
memory/1516-906-0x0000000002840000-0x00000000028A8000-memory.dmp

Filesize
416KB

Download
memory/2268-26722-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2268-5576-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1024-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1034-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1036-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1038-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1040-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-27709-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2268-1046-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1059-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-27708-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2268-27746-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2268-1012-0x0000000002280000-0x00000000022B2000-memory.dmp

Filesize
200KB

Download
memory/2268-1066-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1015-0x00000000049A0000-0x00000000049D2000-memory.dmp

Filesize
200KB

Download
memory/2268-1026-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1016-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2268-1017-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2268-2782-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1021-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2268-2786-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-26701-0x0000000000560000-0x000000000056E000-memory.dmp

Filesize
56KB

Download
memory/2268-2788-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1032-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-2791-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-1022-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2268-2798-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-2806-0x00000000049A0000-0x00000000049CB000-memory.dmp

Filesize
172KB

Download
memory/2268-20850-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/2268-20181-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/2296-874-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-2796-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-27372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-873-0x0000000003D70000-0x0000000003DA1000-memory.dmp

Filesize
196KB

Download
memory/2492-825-0x0000000005C20000-0x0000000005C30000-memory.dmp

Filesize
64KB

Download
memory/2492-1023-0x0000000005C20000-0x0000000005C30000-memory.dmp

Filesize
64KB

Download
memory/2492-27747-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2492-822-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2492-823-0x0000000005F50000-0x00000000064F4000-memory.dmp

Filesize
5.6MB

Download
memory/2492-826-0x00000000059D0000-0x00000000059DA000-memory.dmp

Filesize
40KB

Download
memory/2492-2784-0x0000000005C20000-0x0000000005C30000-memory.dmp

Filesize
64KB

Download
memory/2492-821-0x0000000000F60000-0x0000000000FCE000-memory.dmp

Filesize
440KB

Download
memory/2492-831-0x0000000005C20000-0x0000000005C30000-memory.dmp

Filesize
64KB

Download
memory/2492-1014-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2492-824-0x0000000005A40000-0x0000000005AD2000-memory.dmp

Filesize
584KB

Download
memory/3172-1065-0x00000000053F0000-0x00000000054F0000-memory.dmp

Filesize
1024KB

Download
memory/3744-27634-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/3744-979-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/3744-26715-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/3744-1000-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/3744-968-0x0000000004D20000-0x0000000004DBC000-memory.dmp

Filesize
624KB

Download
memory/3744-26719-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/3744-981-0x0000000005110000-0x0000000005166000-memory.dmp

Filesize
344KB

Download
memory/3744-26706-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/3744-960-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/3744-961-0x0000000000420000-0x00000000004A2000-memory.dmp

Filesize
520KB

Download
memory/3884-954-0x0000000001290000-0x00000000012B5000-memory.dmp

Filesize
148KB

Download
memory/3884-958-0x0000000001290000-0x00000000012B5000-memory.dmp

Filesize
148KB

Download
memory/4016-1062-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4016-1061-0x000000000ADC0000-0x000000000ADF4000-memory.dmp

Filesize
208KB

Download
memory/4016-893-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/4016-2779-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/5104-27754-0x00007FF93D580000-0x00007FF93E041000-memory.dmp

Filesize
10.8MB

Download
memory/5104-6090-0x000001FC99410000-0x000001FC9A99E000-memory.dmp

Filesize
21.6MB

Download
memory/5104-830-0x000001FCFD6A0000-0x000001FCFE694000-memory.dmp

Filesize
16.0MB

Download
memory/5104-829-0x00007FF93D580000-0x00007FF93E041000-memory.dmp

Filesize
10.8MB

Download
memory/5104-18857-0x000001FCFEFF0000-0x000001FCFF000000-memory.dmp

Filesize
64KB

Download
memory/5104-1058-0x00007FF93D580000-0x00007FF93E041000-memory.dmp

Filesize
10.8MB

Download
memory/5944-1013-0x0000000000E10000-0x0000000000E35000-memory.dmp

Filesize
148KB

Download
memory/5944-1025-0x0000000000E10000-0x0000000000E35000-memory.dmp

Filesize
148KB

Download
memory/5944-27744-0x0000000000E10000-0x0000000000E35000-memory.dmp

Filesize
148KB

Download
memory/12400-2807-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/12400-22251-0x0000000000400000-0x0000000000B02000-memory.dmp

Filesize
7.0MB

Download
memory/12400-22197-0x0000000076040000-0x0000000076130000-memory.dmp

Filesize
960KB

Download
memory/12484-6197-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/12484-27749-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/12484-26176-0x0000000002230000-0x00000000022FE000-memory.dmp

Filesize
824KB

Download
memory/21012-26716-0x0000000000B70000-0x0000000000B7C000-memory.dmp

Filesize
48KB

Download
memory/21012-27748-0x00007FF93D580000-0x00007FF93E041000-memory.dmp

Filesize
10.8MB

Download
memory/21012-26724-0x000000001B6F0000-0x000000001B700000-memory.dmp

Filesize
64KB

Download
memory/21012-26717-0x00007FF93D580000-0x00007FF93E041000-memory.dmp

Filesize
10.8MB

Download
memory/24288-26703-0x00007FF93D580000-0x00007FF93E041000-memory.dmp

Filesize
10.8MB

Download
memory/24288-27764-0x00007FF93D580000-0x00007FF93E041000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads