teslacrypt | 5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

Resubmissions

04-04-2024 18:10

240404-wscc9afa67 10

04-04-2024 03:22

240404-dw4mssdg95 10

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

220518-1mgg8seec9.exe
Size

360KB
MD5

9ce01dfbf25dfea778e57d8274675d6f
SHA1

1bd767beb5bc36b396ca6405748042640ad57526
SHA256

5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d
SHA512

d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b
SSDEEP

6144:4qZbqZToxIizLBZ6R56VkGM4ceLJ5vs5JGJceO/QCErIiuNAvwu:4qZb8oR3D6R5QHXZJy/Q50imAvB

Score

10^/10

teslacrypt persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+fklnh.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A5A3E62527059DA 2. http://tes543berda73i48fsdfsd.keratadze.at/A5A3E62527059DA 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A5A3E62527059DA If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/A5A3E62527059DA 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A5A3E62527059DA http://tes543berda73i48fsdfsd.keratadze.at/A5A3E62527059DA http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A5A3E62527059DA *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/A5A3E62527059DA

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/A5A3E62527059DA

http://tes543berda73i48fsdfsd.keratadze.at/A5A3E62527059DA

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A5A3E62527059DA

http://xlowfznrg4wf7dli.ONION/A5A3E62527059DA

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (285) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
2632	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3068	uwjbkwlsmhtn.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\twtgvbvjemle = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\uwjbkwlsmhtn.exe\""	uwjbkwlsmhtn.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Defender\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full_partly-cloudy.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jre7\lib\applet\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Office\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\highDpiImageSwap.js	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Uninstall Information\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\currency.js	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\de-DE\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\picturePuzzle.css	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\es-ES\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\it-IT\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\_RECOVERY_+fklnh.html	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\it-IT\_RECOVERY_+fklnh.txt	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_RECOVERY_+fklnh.png	uwjbkwlsmhtn.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt	uwjbkwlsmhtn.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\uwjbkwlsmhtn.exe	220518-1mgg8seec9.exe
File opened for modification	C:\Windows\uwjbkwlsmhtn.exe	220518-1mgg8seec9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe
3068	uwjbkwlsmhtn.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	220518-1mgg8seec9.exe
Token: SeDebugPrivilege	3068	uwjbkwlsmhtn.exe
Token: SeIncreaseQuotaPrivilege	2416	WMIC.exe
Token: SeSecurityPrivilege	2416	WMIC.exe
Token: SeTakeOwnershipPrivilege	2416	WMIC.exe
Token: SeLoadDriverPrivilege	2416	WMIC.exe
Token: SeSystemProfilePrivilege	2416	WMIC.exe
Token: SeSystemtimePrivilege	2416	WMIC.exe
Token: SeProfSingleProcessPrivilege	2416	WMIC.exe
Token: SeIncBasePriorityPrivilege	2416	WMIC.exe
Token: SeCreatePagefilePrivilege	2416	WMIC.exe
Token: SeBackupPrivilege	2416	WMIC.exe
Token: SeRestorePrivilege	2416	WMIC.exe
Token: SeShutdownPrivilege	2416	WMIC.exe
Token: SeDebugPrivilege	2416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2416	WMIC.exe
Token: SeRemoteShutdownPrivilege	2416	WMIC.exe
Token: SeUndockPrivilege	2416	WMIC.exe
Token: SeManageVolumePrivilege	2416	WMIC.exe
Token: 33	2416	WMIC.exe
Token: 34	2416	WMIC.exe
Token: 35	2416	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2416	WMIC.exe
Token: SeSecurityPrivilege	2416	WMIC.exe
Token: SeTakeOwnershipPrivilege	2416	WMIC.exe
Token: SeLoadDriverPrivilege	2416	WMIC.exe
Token: SeSystemProfilePrivilege	2416	WMIC.exe
Token: SeSystemtimePrivilege	2416	WMIC.exe
Token: SeProfSingleProcessPrivilege	2416	WMIC.exe
Token: SeIncBasePriorityPrivilege	2416	WMIC.exe
Token: SeCreatePagefilePrivilege	2416	WMIC.exe
Token: SeBackupPrivilege	2416	WMIC.exe
Token: SeRestorePrivilege	2416	WMIC.exe
Token: SeShutdownPrivilege	2416	WMIC.exe
Token: SeDebugPrivilege	2416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2416	WMIC.exe
Token: SeRemoteShutdownPrivilege	2416	WMIC.exe
Token: SeUndockPrivilege	2416	WMIC.exe
Token: SeManageVolumePrivilege	2416	WMIC.exe
Token: 33	2416	WMIC.exe
Token: 34	2416	WMIC.exe
Token: 35	2416	WMIC.exe
Token: SeBackupPrivilege	1176	vssvc.exe
Token: SeRestorePrivilege	1176	vssvc.exe
Token: SeAuditPrivilege	1176	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3068	2120	220518-1mgg8seec9.exe	28
PID 2120 wrote to memory of 3068	2120	220518-1mgg8seec9.exe	28
PID 2120 wrote to memory of 3068	2120	220518-1mgg8seec9.exe	28
PID 2120 wrote to memory of 3068	2120	220518-1mgg8seec9.exe	28
PID 2120 wrote to memory of 2632	2120	220518-1mgg8seec9.exe	29
PID 2120 wrote to memory of 2632	2120	220518-1mgg8seec9.exe	29
PID 2120 wrote to memory of 2632	2120	220518-1mgg8seec9.exe	29
PID 2120 wrote to memory of 2632	2120	220518-1mgg8seec9.exe	29
PID 3068 wrote to memory of 2416	3068	uwjbkwlsmhtn.exe	31
PID 3068 wrote to memory of 2416	3068	uwjbkwlsmhtn.exe	31
PID 3068 wrote to memory of 2416	3068	uwjbkwlsmhtn.exe	31
PID 3068 wrote to memory of 2416	3068	uwjbkwlsmhtn.exe	31

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	uwjbkwlsmhtn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	uwjbkwlsmhtn.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\220518-1mgg8seec9.exe
"C:\Users\Admin\AppData\Local\Temp\220518-1mgg8seec9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\uwjbkwlsmhtn.exe
  C:\Windows\uwjbkwlsmhtn.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3068
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\220518~1.EXE
  2⤵
  - Deletes itself
  PID:2632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+fklnh.html

Filesize
11KB

MD5
59ee090340894603c62889dbf42c320e

SHA1
56a0a286629efa772c7e6fc09d6c38e5ff3d9ec0

SHA256
2c1833e690d391e5f731a73070209b68531a89992b77faf0c09f5f4885923564

SHA512
81d317f1f80a56227d7a78c20d3d1681f294a67bd0c743dcfbd2e8cc42a6bf6cba7797fb9b324077bc2c234abc83dd8ec40ecb86f640299fccdc3d32f76c8742

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+fklnh.png

Filesize
62KB

MD5
c2d6a8b47c331787ae10d730c2bc9ebb

SHA1
3927f1e29deccff936c6d7fdb4af495408564315

SHA256
34ca67015ffa6c4947fae5dc4192c68a60a93919ab31ea81e7b961f91c7bc528

SHA512
3abf5cbc68476a7917abcde480d8daafc7e6607ac78093445dabceb9030616618d52e5dc58b59d23932e053b50f18aacd47575545b2537a28fb364d5afe81dc9

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+fklnh.txt

Filesize
1KB

MD5
f989b67b38ff30c098ee34c6416a2fa2

SHA1
dac231748b835b386cd52dda937a112ebec5b2cd

SHA256
bc20506693865ee12b29babc47c68f89cb12db7b5112dfab94f608fe3a5c32d4

SHA512
0ae6eb075800cff6182abafd772e4e2e1f2969afc52d9ed3c8f89eb1774696769f1ac0041f22c3685cfedec0ec131e532622ca38fd7b39f5e8555933aca65569

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
49f542445e13a509a44bc1d39c940212

SHA1
cdb8afff0f3118f344fecae71a865f2c83c6b924

SHA256
f88451d3c41722a759df668ee70c0df366ad8c462b970de8a3bce5eae272e08d

SHA512
23e5f90230f2261dcb7bfbc07a3cf7c1cb63b699411dc6d410b7abc7449e615d5447be584694fc5f6c15d2e18222cd30a95c10ff8dc4e2928b8543c2b5d94d25

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
9486e338e767b8d39de0a7412f422dcf

SHA1
d920a79cb283dbae7fadb48f70e03d9847720a3c

SHA256
3aabfa988ab6e9111f9a37045b70ab3d64bae662ba489a6a6edf92f3c03cc209

SHA512
b2095a945dd3438e91903eae666c6e50483f33a0c6e2a4db8ee7a04d8d07afd05c17ad5be0763561186119dc2bfb4c215d4157fefea33c499b6d870de18c40c8

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
27013592f027794903669278dc6ea371

SHA1
7afbffcfb4c2ff69183d8c9f6e7aafc3c87a8ef1

SHA256
3900aec353b9e1c9bce53265a40dc9f1f726187892a2d4cb2dd2b08546d182aa

SHA512
976d0ba0c3ccb419e3f290d49fc7c6670fbb4b2495a8ec143c9531cf521944ba63d93caa6e0382830e3e0c79b317de3f99127bcafb09efe3cf7658194d2fa401

Download Submit
C:\Windows\uwjbkwlsmhtn.exe

Filesize
360KB

MD5
9ce01dfbf25dfea778e57d8274675d6f

SHA1
1bd767beb5bc36b396ca6405748042640ad57526

SHA256
5343947829609f69e84fe7e8172c38ee018ede3c9898d4895275f596ac54320d

SHA512
d6ba89c1f221a94e3061bc4da896760d99935a7c766b8e4e30146266cf3356acd883835e75dbb86574bc869c83d381c8f63f23392101f6062bba4343af49978b

Download Submit
memory/2120-0-0x0000000000370000-0x00000000003F5000-memory.dmp

Filesize
532KB

Download
memory/2120-1-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2120-11-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2120-12-0x0000000000370000-0x00000000003F5000-memory.dmp

Filesize
532KB

Download
memory/3068-103-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-880-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-220-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-735-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-794-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-844-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-863-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-100-0x0000000000270000-0x00000000002F5000-memory.dmp

Filesize
532KB

Download
memory/3068-97-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-1289-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-18-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-14-0x0000000000270000-0x00000000002F5000-memory.dmp

Filesize
532KB

Download
memory/3068-2674-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3068-3838-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download