teslacrypt | 342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
Size

384KB
MD5

88716ed91614ba43691f1204a8e1936c
SHA1

d8b3411ae843a5f1d4b506eccec26077fd2f29f2
SHA256

342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0
SHA512

e64af6563e672408ebefc089a02dc6c99082c7a1d4b0a67258c50da88add8bf8c58045041968e22d1a9924f95d62cf2245ed253ac41473c1d28c8d8c62f88bad
SSDEEP

6144:zBeJdbHCHcRlJUdarnrIM+PbeEnvutw2cVMuXrvEnODd0cpMLnJV6Xlxq+:zBCdG4l2rM+PFgYM+rcOd0l/elxz

Score

10^/10

teslacrypt persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_RECOVERY_+rpism.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6A66B718C43BCFA1 2. http://tes543berda73i48fsdfsd.keratadze.at/6A66B718C43BCFA1 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6A66B718C43BCFA1 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/6A66B718C43BCFA1 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6A66B718C43BCFA1 http://tes543berda73i48fsdfsd.keratadze.at/6A66B718C43BCFA1 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6A66B718C43BCFA1 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/6A66B718C43BCFA1

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6A66B718C43BCFA1

http://tes543berda73i48fsdfsd.keratadze.at/6A66B718C43BCFA1

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6A66B718C43BCFA1

http://xlowfznrg4wf7dli.ONION/6A66B718C43BCFA1

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (874) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exemxqvxxcfoxin.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	mxqvxxcfoxin.exe

Drops startup file 6 IoCs

Processes:

mxqvxxcfoxin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+rpism.html	mxqvxxcfoxin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+rpism.html	mxqvxxcfoxin.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe

Executes dropped EXE 2 IoCs

Processes:

mxqvxxcfoxin.exemxqvxxcfoxin.exe

pid process

3468 mxqvxxcfoxin.exe
4912 mxqvxxcfoxin.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3468	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mxqvxxcfoxin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vpumwgcbyxkm = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\mxqvxxcfoxin.exe\""	mxqvxxcfoxin.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exemxqvxxcfoxin.exe

description	pid	process	target process
PID 2444 set thread context of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 3468 set thread context of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe

Drops file in Program Files directory 64 IoCs

Processes:

mxqvxxcfoxin.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-24_altform-unplated_contrast-black.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-200_contrast-white.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\WideTile.scale-125.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\Logo.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\_RECOVERY_+rpism.html	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-400_contrast-white.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-24.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-80_altform-unplated.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\WideTile.scale-200.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_RECOVERY_+rpism.html	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-96.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_contrast-white.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40_altform-lightunplated.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\_RECOVERY_+rpism.html	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-200.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-100.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-100.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\_RECOVERY_+rpism.html	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square310x310\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Tented\TentMobile_24x20.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Triedit\en-US\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_RECOVERY_+rpism.html	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-400.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-125.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-125.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MediumTile.scale-100_contrast-black.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer3Sec.targetsize-16.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\_RECOVERY_+rpism.html	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-400_contrast-white.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\dotnet\_RECOVERY_+rpism.html	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-32_altform-unplated_contrast-white.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ko-KR\View3d\_RECOVERY_+rpism.txt	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileOneNote32x32.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png	mxqvxxcfoxin.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\_RECOVERY_+rpism.png	mxqvxxcfoxin.exe

Drops file in Windows directory 2 IoCs

Processes:

342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe

description	ioc	process
File created	C:\Windows\mxqvxxcfoxin.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
File opened for modification	C:\Windows\mxqvxxcfoxin.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

mxqvxxcfoxin.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings mxqvxxcfoxin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1676 NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	mxqvxxcfoxin.exe

pid	process
1676	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

mxqvxxcfoxin.exe

pid	process
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe
4912	mxqvxxcfoxin.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4248 msedge.exe
4248 msedge.exe
4248 msedge.exe
4248 msedge.exe
4248 msedge.exe
4248 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exemxqvxxcfoxin.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	348	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
Token: SeDebugPrivilege	4912	mxqvxxcfoxin.exe
Token: SeIncreaseQuotaPrivilege	3840	WMIC.exe
Token: SeSecurityPrivilege	3840	WMIC.exe
Token: SeTakeOwnershipPrivilege	3840	WMIC.exe
Token: SeLoadDriverPrivilege	3840	WMIC.exe
Token: SeSystemProfilePrivilege	3840	WMIC.exe
Token: SeSystemtimePrivilege	3840	WMIC.exe
Token: SeProfSingleProcessPrivilege	3840	WMIC.exe
Token: SeIncBasePriorityPrivilege	3840	WMIC.exe
Token: SeCreatePagefilePrivilege	3840	WMIC.exe
Token: SeBackupPrivilege	3840	WMIC.exe
Token: SeRestorePrivilege	3840	WMIC.exe
Token: SeShutdownPrivilege	3840	WMIC.exe
Token: SeDebugPrivilege	3840	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3840	WMIC.exe
Token: SeRemoteShutdownPrivilege	3840	WMIC.exe
Token: SeUndockPrivilege	3840	WMIC.exe
Token: SeManageVolumePrivilege	3840	WMIC.exe
Token: 33	3840	WMIC.exe
Token: 34	3840	WMIC.exe
Token: 35	3840	WMIC.exe
Token: 36	3840	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3840	WMIC.exe
Token: SeSecurityPrivilege	3840	WMIC.exe
Token: SeTakeOwnershipPrivilege	3840	WMIC.exe
Token: SeLoadDriverPrivilege	3840	WMIC.exe
Token: SeSystemProfilePrivilege	3840	WMIC.exe
Token: SeSystemtimePrivilege	3840	WMIC.exe
Token: SeProfSingleProcessPrivilege	3840	WMIC.exe
Token: SeIncBasePriorityPrivilege	3840	WMIC.exe
Token: SeCreatePagefilePrivilege	3840	WMIC.exe
Token: SeBackupPrivilege	3840	WMIC.exe
Token: SeRestorePrivilege	3840	WMIC.exe
Token: SeShutdownPrivilege	3840	WMIC.exe
Token: SeDebugPrivilege	3840	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3840	WMIC.exe
Token: SeRemoteShutdownPrivilege	3840	WMIC.exe
Token: SeUndockPrivilege	3840	WMIC.exe
Token: SeManageVolumePrivilege	3840	WMIC.exe
Token: 33	3840	WMIC.exe
Token: 34	3840	WMIC.exe
Token: 35	3840	WMIC.exe
Token: 36	3840	WMIC.exe
Token: SeBackupPrivilege	3588	vssvc.exe
Token: SeRestorePrivilege	3588	vssvc.exe
Token: SeAuditPrivilege	3588	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5064	WMIC.exe
Token: SeSecurityPrivilege	5064	WMIC.exe
Token: SeTakeOwnershipPrivilege	5064	WMIC.exe
Token: SeLoadDriverPrivilege	5064	WMIC.exe
Token: SeSystemProfilePrivilege	5064	WMIC.exe
Token: SeSystemtimePrivilege	5064	WMIC.exe
Token: SeProfSingleProcessPrivilege	5064	WMIC.exe
Token: SeIncBasePriorityPrivilege	5064	WMIC.exe
Token: SeCreatePagefilePrivilege	5064	WMIC.exe
Token: SeBackupPrivilege	5064	WMIC.exe
Token: SeRestorePrivilege	5064	WMIC.exe
Token: SeShutdownPrivilege	5064	WMIC.exe
Token: SeDebugPrivilege	5064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5064	WMIC.exe
Token: SeRemoteShutdownPrivilege	5064	WMIC.exe
Token: SeUndockPrivilege	5064	WMIC.exe
Token: SeManageVolumePrivilege	5064	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exemxqvxxcfoxin.exemxqvxxcfoxin.exemsedge.exe

description	pid	process	target process
PID 2444 wrote to memory of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 2444 wrote to memory of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 2444 wrote to memory of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 2444 wrote to memory of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 2444 wrote to memory of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 2444 wrote to memory of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 2444 wrote to memory of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 2444 wrote to memory of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 2444 wrote to memory of 348	2444	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
PID 348 wrote to memory of 3468	348	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	mxqvxxcfoxin.exe
PID 348 wrote to memory of 3468	348	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	mxqvxxcfoxin.exe
PID 348 wrote to memory of 3468	348	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	mxqvxxcfoxin.exe
PID 348 wrote to memory of 2392	348	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	cmd.exe
PID 348 wrote to memory of 2392	348	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	cmd.exe
PID 348 wrote to memory of 2392	348	342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe	cmd.exe
PID 3468 wrote to memory of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe
PID 3468 wrote to memory of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe
PID 3468 wrote to memory of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe
PID 3468 wrote to memory of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe
PID 3468 wrote to memory of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe
PID 3468 wrote to memory of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe
PID 3468 wrote to memory of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe
PID 3468 wrote to memory of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe
PID 3468 wrote to memory of 4912	3468	mxqvxxcfoxin.exe	mxqvxxcfoxin.exe
PID 4912 wrote to memory of 3840	4912	mxqvxxcfoxin.exe	WMIC.exe
PID 4912 wrote to memory of 3840	4912	mxqvxxcfoxin.exe	WMIC.exe
PID 4912 wrote to memory of 1676	4912	mxqvxxcfoxin.exe	NOTEPAD.EXE
PID 4912 wrote to memory of 1676	4912	mxqvxxcfoxin.exe	NOTEPAD.EXE
PID 4912 wrote to memory of 1676	4912	mxqvxxcfoxin.exe	NOTEPAD.EXE
PID 4912 wrote to memory of 4248	4912	mxqvxxcfoxin.exe	msedge.exe
PID 4912 wrote to memory of 4248	4912	mxqvxxcfoxin.exe	msedge.exe
PID 4248 wrote to memory of 3984	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 3984	4248	msedge.exe	msedge.exe
PID 4912 wrote to memory of 5064	4912	mxqvxxcfoxin.exe	WMIC.exe
PID 4912 wrote to memory of 5064	4912	mxqvxxcfoxin.exe	WMIC.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe
PID 4248 wrote to memory of 1556	4248	msedge.exe	msedge.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

mxqvxxcfoxin.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	mxqvxxcfoxin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	mxqvxxcfoxin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
"C:\Users\Admin\AppData\Local\Temp\342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
  "C:\Users\Admin\AppData\Local\Temp\342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:348
- - C:\Windows\mxqvxxcfoxin.exe
    C:\Windows\mxqvxxcfoxin.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\mxqvxxcfoxin.exe
      C:\Windows\mxqvxxcfoxin.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4912
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3840
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:1676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4248
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe49e746f8,0x7ffe49e74708,0x7ffe49e74718
        6⤵
        
        PID:3984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        6⤵
        
        PID:1556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
        6⤵
        
        PID:3936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
        6⤵
        
        PID:1496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
        6⤵
        
        PID:3660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
        6⤵
        
        PID:2664
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
        6⤵
        
        PID:2996
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
        6⤵
        
        PID:5128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
        6⤵
        
        PID:5184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
        6⤵
        
        PID:5192
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        6⤵
        
        PID:5440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12443862719280368177,5625713023738620168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
        6⤵
        
        PID:5448
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5064
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\MXQVXX~1.EXE
        5⤵
        
        PID:5392
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\342A08~1.EXE
    3⤵
    PID:2392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_RECOVERY_+rpism.html

Filesize
11KB

MD5
31831573f4f8da36dad51dda94bb3ce2

SHA1
629262b1797cacc79f1e69616d5ce6a31a3a82f3

SHA256
e464e0eb5750367ab4be9ac162a0dbbe2205f9589bc7cb00446c4a1a8d96d793

SHA512
e3c87081f4fa2d2479ae4d5c5c0072018f80e205649b62fc0e35a9439d3c794e31923bfc7917ab873455c1b137b41312dbeafe3194fbf4436440b6886a911b35

Download Submit
C:\Program Files\7-Zip\Lang\_RECOVERY_+rpism.png

Filesize
62KB

MD5
43246e47ec6c4594ffd4d1b44517109a

SHA1
32a0062e4266e4256fa9131a1308257fbf6bc22b

SHA256
afbe2aad864d23b2ce4c45c4ee39c9b9c46a42e78a39c442b88543f1db55f5bf

SHA512
62fe93a46bc5bf17cd4a5e7cfae23aa813fb9bc8ebf0e2addb70c1e2ffbde04cbbd9fe8534c52ed47409b1fa55a4f9982b3109b89e6f33bf5fa0450cdf679f4a

Download Submit
C:\Program Files\7-Zip\Lang\_RECOVERY_+rpism.txt

Filesize
1KB

MD5
7d35e1a5b49b9d2b96272ffea484c383

SHA1
aefcd34763046d611127cb92910b66fa15cc1c13

SHA256
37c2c260a53840b36cee03dbae34e69d673790ff7943fcd14b3ab51dc88e5fe8

SHA512
460a75eabce2d959588ec5e4d00c16a105f590c2e0fc95b7b905949ef5ee1995a2ba82b71046706889c617109f2ec304635c82e37c7102b07bc92d80990efff1

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
5df907746eee2a8f6f9f0f3c043640e4

SHA1
114bfb5867f79ac83b99097ae45afe139daec523

SHA256
bf042eb02aeb4e086f033c6837b2ab858bc22d5eb8343926d198d78bd8b0044b

SHA512
cc314fc5eb9a977b9e2d73cb0fb5931089c08849fbc381bcd6b9af8c2eed45446a6ad752d8399518a835bc754642c007b16e34ba3148fd668639edb9ea555814

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
288911560630d54934bb06f02928f0de

SHA1
95a0333224d7cc09bc1b430a61a244a16e25b99b

SHA256
3982548b7b4ee289f0b5593974a9025fdfdd302e5ca5951fec6021f970022fca

SHA512
aa6dcc931ac44ca3053b25d3a047152e970cfecc1366ae6c02183ed473e017b5bb892d58f1ffd6e955fb51303f00bc692e588d48f3565e4dcf5cc37875b672d3

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
6f278d3db0ec7138ccd87cd91e9dbeb4

SHA1
5bce9340c7d1cc7d6021e17de9f816ca37d10489

SHA256
72aaf36f0960c4d130587b420fc35c620ff9cdb10580b17487388c1b5ddd8806

SHA512
e790aff1db8700b6e68ef84c6a2f69e63537ed9cca6c2a8c9b8782cb079b6688ea0d2bc383dce912c534a2c9ae59fd1756320c8d6004b57115b7e2e08851de5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6552a874e05ff683c0ce26ce26ed21ed

SHA1
41f675bd35d16e19838e2854fc363c65c2a25476

SHA256
0cadf3dc9f99195d9acdded189ba7817fc46d9bef3f6fd8c485ee7a4cf0bce04

SHA512
0e52a75e8cfdb477d167a46822ed833de6dcbec553f3e585b24a4d04dca65c80074ae4e5c2fad48f3d900a18becfd95cc6c83204428f8ba4b205e5bc0dec82a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e36554ff4496e3454148ae8b3a99aca0

SHA1
fe8efebc38c96438fcb0601db0029f2ba2fcbf4b

SHA256
3ea9d3ee4de23e267f39797b29867b81e8aa9315901239512a6487a8f5fd91c5

SHA512
d01e168ae564ab554fe9fabffbd432d39d7bd80c7de1b58868c42f2febc8d15c430e7f1e6b42193c10408008c4d0899718732859a074dd7b58837cda0bed12b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d332333a30bce47f648e892757b9724d

SHA1
b2fb29b1de317888d96a532a7c13b2daa8104465

SHA256
9b2e6689876912b14f04d1828cb7fae2f5fe0d3321cf90d658974ba260ae3f66

SHA512
b62a06182b5d3227e2c513b5ec4cbd26c7f43845f7e306381b5035f2da2263bce2f26af2aaf6628230aeeddfa06d575bd74fc7f56ec038784448c9735d6aa083

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133573999664599509.txt

Filesize
75KB

MD5
fe5206fb87223e40d7abfe7c8f442622

SHA1
1f9a045fbfac1c1aa1f81daa420b41deacfbcf73

SHA256
29e5674969ee5844b8d9052c152ecf0822386c611109d80e9f1f3c197d430664

SHA512
07d5c41f6eb3b02612a92eecb4bef7bde4c78ac280d33f176f15a1330f2ef8ecfb977b18614e4e628efcf801cb4c4f725a206cca26e74e434e4d2b57680c440b

Download Submit
C:\Windows\mxqvxxcfoxin.exe

Filesize
384KB

MD5
88716ed91614ba43691f1204a8e1936c

SHA1
d8b3411ae843a5f1d4b506eccec26077fd2f29f2

SHA256
342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0

SHA512
e64af6563e672408ebefc089a02dc6c99082c7a1d4b0a67258c50da88add8bf8c58045041968e22d1a9924f95d62cf2245ed253ac41473c1d28c8d8c62f88bad

Download Submit
\??\pipe\LOCAL\crashpad_4248_OEEGMZVVQADYIWYU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/348-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/348-7-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/348-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/348-4-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/348-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-0-0x0000000000400000-0x00000000006FD000-memory.dmp

Filesize
3.0MB

Download
memory/2444-5-0x0000000002460000-0x0000000002463000-memory.dmp

Filesize
12KB

Download
memory/2444-2-0x0000000000400000-0x00000000006FD000-memory.dmp

Filesize
3.0MB

Download
memory/2444-1-0x0000000002460000-0x0000000002463000-memory.dmp

Filesize
12KB

Download
memory/3468-15-0x0000000000400000-0x00000000006FD000-memory.dmp

Filesize
3.0MB

Download
memory/4912-5152-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-8365-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-9328-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-10383-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-10384-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-10392-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-10394-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-2598-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-26-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-25-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-23-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-21-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-20-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4912-10486-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download