teslacrypt | ea366505a9ffb1007fc9abb732c0a9c418df6abdf5c4b27b15ceb4595fd1a878

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
Size

312KB
MD5

128288b15bfc1adbb1fa5e30154d1a22
SHA1

1973d1e928f2bbc67644b772f4ca7c453a503753
SHA256

ea366505a9ffb1007fc9abb732c0a9c418df6abdf5c4b27b15ceb4595fd1a878
SHA512

15d17a1892d55f22c5a6d6fe11abc14d2c71f577e0cb513a7d6b6861d6fd10ec685dd115e0ace0002e1a34fec4b11891e8b2112e501cd17d46dae326b11e7f3d
SSDEEP

6144:LmKDzqaykFTZ8w5OAIfw6mkgVA/fSBVOBrKNudQm7dn8e6E:LmK3qaowwrfzHSBVmKAz7dn8

Score

10^/10

teslacrypt defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+vlnsc.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So , there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/62E246D0E2E0296 2 - http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/62E246D0E2E0296 3 - http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/62E246D0E2E0296 If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/62E246D0E2E0296 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/62E246D0E2E0296 http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/62E246D0E2E0296 http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/62E246D0E2E0296 Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/62E246D0E2E0296

URLs

http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/62E246D0E2E0296

http://u54bbnhf354fbkh254tbkhjbgy8258gnkwerg.tahaplap.com/62E246D0E2E0296

http://w6bfg4hahn5bfnlsafgchkvg5fwsfvrt.hareuna.at/62E246D0E2E0296

http://xlowfznrg4wf7dli.ONION/62E246D0E2E0296

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (893) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exevmghdxirutnw.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	vmghdxirutnw.exe

Drops startup file 6 IoCs

Processes:

vmghdxirutnw.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe

Executes dropped EXE 2 IoCs

Processes:

vmghdxirutnw.exevmghdxirutnw.exe

pid process

5092 vmghdxirutnw.exe
2780 vmghdxirutnw.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5092	vmghdxirutnw.exe
2780	vmghdxirutnw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vmghdxirutnw.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ivratgi = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\vmghdxirutnw.exe"	vmghdxirutnw.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exevmghdxirutnw.exe

description	pid	process	target process
PID 4640 set thread context of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 5092 set thread context of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe

Drops file in Program Files directory 64 IoCs

Processes:

vmghdxirutnw.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ringless_calls\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.scale-100.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-200.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\LargeTile.scale-125.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\HelpThumbnail.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ms\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-black_scale-125.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-24.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-300.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-400_contrast-white.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg5.jpg	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-400.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-100_contrast-black.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\WideTile.scale-125.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-125.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated_contrast-white.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\BF26F2B8-42BC-427B-B632-DBFABACD5EF4\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-black_scale-125.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\SmallTile.scale-125.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\WideTile.scale-125.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyView.scale-125.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-125.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\en-gb\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-200_contrast-white.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-48_altform-unplated.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogoCanary.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-48.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-200_contrast-black.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7dd.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-72_contrast-white.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\View3d\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-200_contrast-white.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-black_scale-100.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-48_altform-unplated.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\it-IT\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-lightunplated.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\SuggestionsService\PushpinDark.png	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_ReCoVeRy_+vlnsc.txt	vmghdxirutnw.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\_ReCoVeRy_+vlnsc.html	vmghdxirutnw.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\_ReCoVeRy_+vlnsc.png	vmghdxirutnw.exe

Drops file in Windows directory 2 IoCs

Processes:

128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\vmghdxirutnw.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
File opened for modification	C:\Windows\vmghdxirutnw.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

vmghdxirutnw.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings vmghdxirutnw.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1952 NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\Local Settings	vmghdxirutnw.exe

pid	process
1952	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

vmghdxirutnw.exe

pid	process
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe
2780	vmghdxirutnw.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

752 msedge.exe
752 msedge.exe
752 msedge.exe
752 msedge.exe
752 msedge.exe
752 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exevmghdxirutnw.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3152	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
Token: SeDebugPrivilege	2780	vmghdxirutnw.exe
Token: SeIncreaseQuotaPrivilege	3264	WMIC.exe
Token: SeSecurityPrivilege	3264	WMIC.exe
Token: SeTakeOwnershipPrivilege	3264	WMIC.exe
Token: SeLoadDriverPrivilege	3264	WMIC.exe
Token: SeSystemProfilePrivilege	3264	WMIC.exe
Token: SeSystemtimePrivilege	3264	WMIC.exe
Token: SeProfSingleProcessPrivilege	3264	WMIC.exe
Token: SeIncBasePriorityPrivilege	3264	WMIC.exe
Token: SeCreatePagefilePrivilege	3264	WMIC.exe
Token: SeBackupPrivilege	3264	WMIC.exe
Token: SeRestorePrivilege	3264	WMIC.exe
Token: SeShutdownPrivilege	3264	WMIC.exe
Token: SeDebugPrivilege	3264	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3264	WMIC.exe
Token: SeRemoteShutdownPrivilege	3264	WMIC.exe
Token: SeUndockPrivilege	3264	WMIC.exe
Token: SeManageVolumePrivilege	3264	WMIC.exe
Token: 33	3264	WMIC.exe
Token: 34	3264	WMIC.exe
Token: 35	3264	WMIC.exe
Token: 36	3264	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3264	WMIC.exe
Token: SeSecurityPrivilege	3264	WMIC.exe
Token: SeTakeOwnershipPrivilege	3264	WMIC.exe
Token: SeLoadDriverPrivilege	3264	WMIC.exe
Token: SeSystemProfilePrivilege	3264	WMIC.exe
Token: SeSystemtimePrivilege	3264	WMIC.exe
Token: SeProfSingleProcessPrivilege	3264	WMIC.exe
Token: SeIncBasePriorityPrivilege	3264	WMIC.exe
Token: SeCreatePagefilePrivilege	3264	WMIC.exe
Token: SeBackupPrivilege	3264	WMIC.exe
Token: SeRestorePrivilege	3264	WMIC.exe
Token: SeShutdownPrivilege	3264	WMIC.exe
Token: SeDebugPrivilege	3264	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3264	WMIC.exe
Token: SeRemoteShutdownPrivilege	3264	WMIC.exe
Token: SeUndockPrivilege	3264	WMIC.exe
Token: SeManageVolumePrivilege	3264	WMIC.exe
Token: 33	3264	WMIC.exe
Token: 34	3264	WMIC.exe
Token: 35	3264	WMIC.exe
Token: 36	3264	WMIC.exe
Token: SeBackupPrivilege	3952	vssvc.exe
Token: SeRestorePrivilege	3952	vssvc.exe
Token: SeAuditPrivilege	3952	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1980	WMIC.exe
Token: SeSecurityPrivilege	1980	WMIC.exe
Token: SeTakeOwnershipPrivilege	1980	WMIC.exe
Token: SeLoadDriverPrivilege	1980	WMIC.exe
Token: SeSystemProfilePrivilege	1980	WMIC.exe
Token: SeSystemtimePrivilege	1980	WMIC.exe
Token: SeProfSingleProcessPrivilege	1980	WMIC.exe
Token: SeIncBasePriorityPrivilege	1980	WMIC.exe
Token: SeCreatePagefilePrivilege	1980	WMIC.exe
Token: SeBackupPrivilege	1980	WMIC.exe
Token: SeRestorePrivilege	1980	WMIC.exe
Token: SeShutdownPrivilege	1980	WMIC.exe
Token: SeDebugPrivilege	1980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1980	WMIC.exe
Token: SeRemoteShutdownPrivilege	1980	WMIC.exe
Token: SeUndockPrivilege	1980	WMIC.exe
Token: SeManageVolumePrivilege	1980	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exevmghdxirutnw.exevmghdxirutnw.exemsedge.exe

description	pid	process	target process
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 4640 wrote to memory of 3152	4640	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
PID 3152 wrote to memory of 5092	3152	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	vmghdxirutnw.exe
PID 3152 wrote to memory of 5092	3152	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	vmghdxirutnw.exe
PID 3152 wrote to memory of 5092	3152	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	vmghdxirutnw.exe
PID 3152 wrote to memory of 3948	3152	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	cmd.exe
PID 3152 wrote to memory of 3948	3152	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	cmd.exe
PID 3152 wrote to memory of 3948	3152	128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe	cmd.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 5092 wrote to memory of 2780	5092	vmghdxirutnw.exe	vmghdxirutnw.exe
PID 2780 wrote to memory of 3264	2780	vmghdxirutnw.exe	WMIC.exe
PID 2780 wrote to memory of 3264	2780	vmghdxirutnw.exe	WMIC.exe
PID 2780 wrote to memory of 1952	2780	vmghdxirutnw.exe	NOTEPAD.EXE
PID 2780 wrote to memory of 1952	2780	vmghdxirutnw.exe	NOTEPAD.EXE
PID 2780 wrote to memory of 1952	2780	vmghdxirutnw.exe	NOTEPAD.EXE
PID 2780 wrote to memory of 752	2780	vmghdxirutnw.exe	msedge.exe
PID 2780 wrote to memory of 752	2780	vmghdxirutnw.exe	msedge.exe
PID 752 wrote to memory of 3420	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 3420	752	msedge.exe	msedge.exe
PID 2780 wrote to memory of 1980	2780	vmghdxirutnw.exe	WMIC.exe
PID 2780 wrote to memory of 1980	2780	vmghdxirutnw.exe	WMIC.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe
PID 752 wrote to memory of 4304	752	msedge.exe	msedge.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

vmghdxirutnw.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vmghdxirutnw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	vmghdxirutnw.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\128288b15bfc1adbb1fa5e30154d1a22_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\vmghdxirutnw.exe
    C:\Windows\vmghdxirutnw.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\vmghdxirutnw.exe
      C:\Windows\vmghdxirutnw.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2780
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:1952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:752
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffe638646f8,0x7ffe63864708,0x7ffe63864718
        6⤵
        
        PID:3420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        6⤵
        
        PID:4304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
        6⤵
        
        PID:4684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
        6⤵
        
        PID:1652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
        6⤵
        
        PID:4476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2888 /prefetch:1
        6⤵
        
        PID:1460
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
        6⤵
        
        PID:4640
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
        6⤵
        
        PID:2976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
        6⤵
        
        PID:4140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
        6⤵
        
        PID:4976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
        6⤵
        
        PID:268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15825514376307942616,6769598447093374021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
        6⤵
        
        PID:4252
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\VMGHDX~1.EXE
        5⤵
        
        PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\128288~1.EXE
    3⤵
    PID:3948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+vlnsc.html

Filesize
11KB

MD5
c42938dda345451045d6062952ff3c65

SHA1
812ab98242ab84d084efa4356bd3f7355fb5ca59

SHA256
347d845a4992f19ab47b60223001957a0f747380aa690fbc2873f387542afbbb

SHA512
489d8ffafc8ea202f614af4f931f3e19810874d2c8649db7af0b4a8a200a0bb16e64a5431bdba6c60ecdd40e2cdaca4b9115ac85bdec1d67cf4ea25276cac78d

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+vlnsc.png

Filesize
64KB

MD5
70a209557e8dc67206e6632c74b69c3c

SHA1
0c07e843251fe41a6eb09cc4fb08d7d97841b208

SHA256
4d4013f29c54029dadf645376394fb39f41fddc0ea5f7c15b6c20a496e19a383

SHA512
e8f8553a1dd22933f34c0e6f6f32f3d64c9382c161d9b9ad9409452ead84032a45bee773e3b45f156ab94706efc20fe0fdd5511c770ebf5a9633d45fd8cfa64d

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+vlnsc.txt

Filesize
1KB

MD5
355fc75e5ea4323b3836610c812528e5

SHA1
a4f5888bb44dcd3eacfc16a2c4259c787acf0adf

SHA256
847fab00a65984c7f5cac7bbddbb175087218a3ceb1ba92556b18e0d62afdd32

SHA512
4fbdbecc055e8194b5a1bd028f375466d7198505ef76d2191c5a9b7c8aba3f2c7ab756484352c0ad9f47f7bcaa898f2449e15ec1d4b91602a60b84a4fa134c21

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
6720c1f1499c7ed9d690ee0388840ad1

SHA1
621998db2953ece4ac8105a05feeefd949b34fe2

SHA256
4f6a7bdb47fa77bba0ec88f20c610c24d1f888a55c52c4eafbcf5fcc04141e15

SHA512
5a55acab3cbef850a6a9682dddbd5f98e7e55311fd6a69d94a0daa1080fe2e5d1ab3ca6bae6e48f54a0bac263331817a257ec0bd32471dce69303622770be843

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
7a0d79d931b4906fcb0e45faf10e8dd8

SHA1
e153ad86da8b332ec330581d8281b85b2f41257a

SHA256
9f0b12098000644550a9ec09faecd0333343e7d9915e2ba810ba949f6e055f68

SHA512
c3cc34411c3565ece28f3e887a7afc18062982747018302e4fe05c8ccee9622fa32dac9e22feda792c3eea2a5ad486b0c4a144012a9bd986e5c98a8426aa80e0

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
44d2a763ed6a0295f598b6bebfbf3edd

SHA1
b1648ccdf8731beda9a83b0bcd6c7dc7c273aebc

SHA256
030ed7c70e12541039459cef613edf62c393b6fb112171e96cab174a9e558541

SHA512
11cc0e95842cd65ffa69ca576130f863eb75cb908575048fce2737d0695b08443831ac967ad1fab1fc67ade9d4622aa4f88fa6ecaa15b01fd012937b79dcd0bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90226d01507ce276ed3ae3aef90ebf86

SHA1
afa3951ce91eebb922348d24597bdc62ae1e155e

SHA256
608dbfae5dc078557f488564e989882ab1e48c857dda2a931b730add6eca6269

SHA512
94c0243af7f9bf293af01ccbe657efbe1bf266d1dced265e102cc53769a5b0620b3b640d4694677e376e9bd0240e8a5324abbbb315d139ebb08de8827c55951a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b35daa0098f9f2935ebc5e514de6cfe4

SHA1
3d09265ca2788be00066229683dd9ae03bf1b356

SHA256
b88ceb5836e7c32428367cc1ebdb8e7e1706d199e0fa971a7785d216c3150b7a

SHA512
67add189f9730d648a50051bc94c5aa77cc152fc446b5753087ce5ec885e4442c0926a814f19c56b23b4fc63975de2414eca5ff4a5077e5ddab21f5649f289f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
57add061abddd55afb75d89985f105f5

SHA1
f82007a2e19b953b58f73cc061e59ce1556a1487

SHA256
3f21a71adcb76596d6bb490786bec2c1cff94f74161dc622c6533d54ee3d5ff0

SHA512
c72a0c3b6802c82640d067a66e19a3b50e29418b68f598604faeb1b29ab76150a90c7767a32c47511f9e658af96c6fc3c340afe27f993086507b7909106242a3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838338840824.txt

Filesize
77KB

MD5
63ec4a337baa76f3af69501789310003

SHA1
1a2f477c5d070734b5a067e606461350d636c3c2

SHA256
43cd635919ab6402b4fe7c34d12f7dd7c44facdaacc074b395b0d56b95676660

SHA512
1f95ef7684380d23f1aac20a5107959a6085ecad7c68e5d0eb920e564537232c2992f05aee455fc5bed55dc9e854249cff43bd66989c2dfe84e9bc66b4e3f27e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840260629574.txt

Filesize
47KB

MD5
22338a982d1943935d6a64250949c17d

SHA1
951001836b8da614b8d846e577021ab7eb3d4547

SHA256
63167b9f9bc5bb6cbad49f823e3192f9f89fdfcd625d077ad7ca71ac35dad4ca

SHA512
6cd00a89fa855e4ea5eca7302f1319efb5c1771b84b431fab2c6ec299441e108db5fe2496c183ca5fc7aaffda398b1c2b5c6c10129ba17ac41e88334fc3a531a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848943443912.txt

Filesize
75KB

MD5
7b5856cf37cc7359e75b49579555fc8a

SHA1
27e359515eefd095c4138db5749371484cf305e5

SHA256
5e0d2534fb66a643bb4c01fe1ec435b44f075f376dca74504be8e3c569c06acb

SHA512
6b8a5a2969cb3c5960fc05e9e9a34427bec3aedbd1ef46de29c10b9af6bf286ab4ef8c4a28c1bdb51fb47e9b49021d6fcb53182b776239ee36271bb751aec18d

Download Submit
C:\Windows\vmghdxirutnw.exe

Filesize
312KB

MD5
128288b15bfc1adbb1fa5e30154d1a22

SHA1
1973d1e928f2bbc67644b772f4ca7c453a503753

SHA256
ea366505a9ffb1007fc9abb732c0a9c418df6abdf5c4b27b15ceb4595fd1a878

SHA512
15d17a1892d55f22c5a6d6fe11abc14d2c71f577e0cb513a7d6b6861d6fd10ec685dd115e0ace0002e1a34fec4b11891e8b2112e501cd17d46dae326b11e7f3d

Download Submit
\??\pipe\LOCAL\crashpad_752_LVVIMVOYVGRWDRCG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2780-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-10059-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-417-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-24-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-21-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-20-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-3795-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-6722-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-10608-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-10570-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-26-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-10559-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-10560-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2780-10568-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3152-15-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3152-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3152-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3152-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3152-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4640-0-0x0000000000740000-0x0000000000745000-memory.dmp

Filesize
20KB

Download
memory/4640-4-0x0000000000740000-0x0000000000745000-memory.dmp

Filesize
20KB

Download
memory/4640-1-0x0000000000740000-0x0000000000745000-memory.dmp

Filesize
20KB

Download
memory/5092-13-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download