zgrat | e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe

Resubmissions

12/05/2024, 18:26

240512-w3ftesdb5510

12/05/2024, 01:57

240512-cc9t2aea9910

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nvidia.exe
Size 2.6MB
Sample240512-cc9t2aea99
SHA256 e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe
MD5 87610f8f3d48edf25d48c4c0ba2b3486
SHA1 ab7498abd8626c968c84167ef1c1c503faace1fe
SHA512 73840a477b360fb1ab2061087838618a748f8b24560d289d563b4ba4b1b905f62686f4bca2c2e236007be1bc5931711c0d162b1c0f3ade009861e004116ddfe1
SSDEEP 49152:O+8l/s9Yf5u4uT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u65:OtVsGobzsG1tQRjdih8rwcV5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat ransomware rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4356-1-0x000002632A100000-0x000002632A3A4000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/4356-1-0x000002632A100000-0x000002632A3A4000-memory.dmp	net_reactor

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe	Nvidia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe	Nvidia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CashRansomware	Nvidia.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org
16	icanhazip.com
18	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cash.img"	Nvidia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\adovbs.inc.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\wab32.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado60.tlb.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msaddsr.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox28.tlb.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.CashRansomware	Nvidia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
856	msedge.exe
856	msedge.exe
292	identity_helper.exe
292	identity_helper.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	Nvidia.exe
Token: SeBackupPrivilege	4408	vssvc.exe
Token: SeRestorePrivilege	4408	vssvc.exe
Token: SeAuditPrivilege	4408	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 856	4356	Nvidia.exe	92
PID 4356 wrote to memory of 856	4356	Nvidia.exe	92
PID 856 wrote to memory of 4992	856	msedge.exe	93
PID 856 wrote to memory of 4992	856	msedge.exe	93
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 4460	856	msedge.exe	94
PID 856 wrote to memory of 3632	856	msedge.exe	95
PID 856 wrote to memory of 3632	856	msedge.exe	95
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96
PID 856 wrote to memory of 2608	856	msedge.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Nvidia.exe
"C:\Users\Admin\AppData\Local\Temp\Nvidia.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Cash Ransomware.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3f9246f8,0x7ffa3f924708,0x7ffa3f924718
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1552817368075087095,13209286370776118205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

metadata.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata.CashRansomware
Size 16B
SHA256 e8d247056fcafe2e3324882d0523e8f077d966662f27f9d013857bd56e52ab73
MD5 967331f544e093c7130095a7489cb751
SHA1 78569d73f562436ccce2550f3518fff76172689b
SHA512 a9c38fc7fb7c5393ca92a54e6f2631ddb9fefb99fd2f5c7210d5cbb69486a992543141927505ae530eac7b8c0be1bfdc276a738ad0a55890077888bafb74c5be
MD5 SHA1 SHA512

Submit Download

CURRENT.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT.CashRansomware
Size 32B
SHA256 834587e824cf15c0336d0d035a6c5e34e61cb40462abef08cef3e5c9b8052302
MD5 66477764fac5c6c5c8a0c3b3eac8c288
SHA1 f452c8025393bda430bf96a837ecd042c3814d9d
SHA512 04caff0493639377d70111afbad59baa6a4a8d0c28692c4c378864da9f0a27946966a94d7fab774e28a5b206f5c865b45fde8086c36aed20c3e208732edfa8a3
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001.CashRansomware
Size 48B
SHA256 ff7a92af62b67c8b0571c6f8c8d2e836bd4c5053528c75d50fa210d61918a678
MD5 f60a6997b4d935c856f1a6caf1e70b27
SHA1 6599a66b3304a0907beb8d7ee43a88ec66bc9612
SHA512 8afb757dab86e5f3b198b6f3e7821efce0441053f20d616acf2c4c05fdb4577ac26373d160f6e4935892184f449127f008bf4deb2435d260d4f7f4c1b40bb964
MD5 SHA1 SHA512

Submit Download

data_2.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2.CashRansomware
Size 8KB
SHA256 b4bec0ed802f27d8859ea4a048903c156f0054caf25b5bead7772b089fe38cb4
MD5 ea121778f055ef15ebd97bc049431fe0
SHA1 44916b906eb09c6e0228d2310c57d2abaa8e3e30
SHA512 7ceab485a35ea433310e8ca808534659c16204b4828846f17fb42795047615c0d30395292a9cd8a2ff3a45b98ac83402e8f16dc4028e0abb95e7d4665feeacb8
SSDEEP 192:JuccayHWGmAHDBNZ1ZbFpKiVfbP3iad6J6xqYqR:ojWLqbZHbvijRYG
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.CashRansomware
Size 8KB
SHA256 c783768b9083c0d115fab63521e2034039cadc37f53f3d7de5c1b2f03514e195
MD5 d2cd65bebc573fa5c4a5c2e320ae988e
SHA1 0e969ad8748644591f47c9518ca38ade5f65faba
SHA512 d2fbd96e4349e2467f154b0d5fe64989838ce1657f3f943fe539223dee652e3d1a7d1dcfda5340313b6078268a5e6683b3b4dd82c7cea73692741b9fd7c0bd89
SSDEEP 192:U9fDYcyfAb+JyUNEZm/6Zid8yIC+A8pDzRiG9h7bA:PEh0EZmiZCmnlV9lU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.CashRansomware
Size 264KB
SHA256 edfed186cd7207e56cf192955bc99f0df9ae4efd43122c04027da110329df69c
MD5 9652a0b68cd615a3984ea21c876f3977
SHA1 19b10c7f651476b2ce287680b273e1787aed0d95
SHA512 c346af96a42996c10d32df4e1d336f68a37be58b374797279e92f8c34ccc0a34b2f2fdaae312d5e425e804c8007aaccf644ef1b02c9ac12c987f6bcae5c415ea
SSDEEP 6144:JNFvXJQ+/9rKrLNZqwsjXCI9HQ7oLkuMpIT9OjcBdooJSOZ8:3VOLNZUrLHQB4T9OWdoosOZ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.CashRansomware
Size 8KB
SHA256 dc5a1fc13b905eda9efbd900cecaa10826c4eb50fbbdb3eb26eea3a2ee5f984f
MD5 c536a6304806e14b92fbbfc589357d8b
SHA1 c4953c3ae7fc2de5b766b9a67516844166d81b9e
SHA512 c24e32d1c8ed92168122e11114b78f2949dc62fa04b72e10a90ea8ad6adb91d19a9367690ad0fb0b9e680cae31fae03af9927b5b6729ee6a5f1bb0d9a0f2fad7
SSDEEP 192:LHeXgJUSilwrNwB7pUpPQzddlwe1PMS7qX5ntu3+:SXniNMSVQzddlQSmX0+
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 176B
SHA256 72b128de5bd06d50af02c4113956687082280bd564ff6b5517e4bc466ae5d526
MD5 4b0fdb42df7710656db54c391246153d
SHA1 76448462cca39b432c314f680ebb330258a28749
SHA512 f5681e8c75062df44e985069f51ebaf7f0cf0e10427b5dc4800e1c8af1d401816cc9bafad6157afcea9c85bf347540211332c273573c706632c290cbf90de067
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c06bb59c5ebb6a62c11277ce06c4433ac1e3ee96aa0dda45b9c7ec74f9da0a46
MD5 36f1ca8e5285b3e3e83fe984c753a126
SHA1 7f5ad6885e0d804f830eab9b1252634348ed649a
SHA512 dba22f24032f5f6366f4dddf8c1a5803d3ab0f8c4bc4788e193de84b029f5d2e6c7a786a83805e44e03decd78e2d1e74d199a18d323c6031fb718a3d21615b66
SSDEEP 96:nik3xm/pQYmqH171wpvWMoiVmdeHBrz6SIUWQyV+VDCziEwb:nikcCYx1GWMXkSIro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f5b2f6adeeea6a72f0fa8076b920e0f9a6bc8eb5317c30fbfa407498fa7f5831
MD5 19713cfb746571d6e1fe8b7fc057c149
SHA1 6ad0bc75d7d3c4e79d7eaf3ec2da270f042bc4c1
SHA512 9b7633d9d6b4c9dd6b24c6073dc11dbc9d9de7b4c7a0c645ea10f73b84f505e2271380c8adfec64b3cca8d467598fbd04f4d2d4634a0001b81dd0b5086829957
SSDEEP 96:nik3xm/pnmqH17FwpvWMoiVmdeHBrz6SIUWQyV+VD7AiEwb:nikcwYxFGWMXkSIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3e434fb28314274813e0b3296463f6b9e337a47d396e432f5454058e831b9abe
MD5 253977156451ea64b107da9cbaf8e81f
SHA1 84667b12dc53052e87ab4246fb2b7c419c18fb9d
SHA512 d8e38febabfd94b378989924d3acc381bae4a8faf292e0eaa91f8b946b439f5e9f9665744bae9aa4c7df49b6f15d10e5af0d22706ed08cc77511845f84c1c990
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxHAe2RU4GMj2k+OblfBhDg:A9iIxuERzA83h09RZxYxHenyk/XDafEQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.CashRansomware
Size 8KB
SHA256 60fcb9e835ec84f435e62b2272ad53f74ec9a24621f3775b56e97ec127408070
MD5 73919f5b1ac86bf254238c2270e99ff4
SHA1 5f9c22e4731cc093e80a8f8e102dae6c81a4d460
SHA512 15d9042bcef067c4c379ec64cb4cbaf8db77d180a0c6ff359c4a86131bd96f5d966a692f5532ee914688172e55e23a42d2ea45c65a0932f06b08fb053d162d21
SSDEEP 192:U+48sXE0WC4fNFvXcis8P0NfHZ+Hmv20fkEbXrq8:YE0WC41ZRs6U7VfNbX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.CashRansomware
Size 36KB
SHA256 021efd338f81e2279e080b13645995ac73d2fbd8a396e8e0674f9081a7b303c9
MD5 38d4015fb4499a3a0b233e42b226049c
SHA1 ec1f2909989b49b3a27b76c6fcba43b2b0d83e2c
SHA512 2139e6141b9b4516614bde1e099dd604c98a8c93a3352e43ebc16ff1672b924eb8ac14d45b5835d5ef1c86b161ef542c51be942593b6439d861fc76322f8d40b
SSDEEP 768:hL4WSYbgs/EMRWQGP9QJwft0kkmn5Y27msyO9km1i6K1:hL4WV7MMRWQGlkg0kkk5Ya1a1
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.CashRansomware
Size 36KB
SHA256 f6b5722385140fff1f180f89ec8d202a2ec1b29683a39b5479b94f79887f2ae9
MD5 1bf9893233b033e27bb1f19c6f7aef7c
SHA1 df06079fc81f3caebde616b5fb3f810c97d8c69b
SHA512 253fe7b7b382df51f1d0f9c28cc37ea6dee53a4299a5c33363dabd08c19ede610efc72fcf8b40946f5e6e7a3f75757f227f4cb04b58c57020ba5b9387fdff0d6
SSDEEP 768:px/HQlgrVMQLTJiWj55dgfIKjk7lwAjXZpWyBZp1YRe6tVINq1Vp+uPMdZKP:p9HQu9LTJtVrbZpXzDYR5VINiouPMdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.1.filtertrie.intermediate.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.1.filtertrie.intermediate.txt.CashRansomware
Size 16B
SHA256 80301316cd39e79910f16926ad1162e5f5f50eb51188bfa92e30184be6d17714
MD5 b52b04d9c9e6cc4b3d75bd91414f47da
SHA1 f8342c6269222378b0fed1dbee63fb2d64fb19a4
SHA512 030d769b7424920d6f0273733b6c3d9bbea8fd895022a35e9ba2be65c165dd5591e9abeec68695f44b49c464aebfb0c7b43cf73a419a0a0f31943e947564c469
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.2.filtertrie.intermediate.txt.CashRansomware
Size 16B
SHA256 ec197433f77a28049248aa786114d7e82234fa3e51a4933c56650aa58fa13b83
MD5 369a969b4941d5bb99707c99cb2edd38
SHA1 ecda018f88fab086cd2a5517eac81dab259f6950
SHA512 962c86a163f3517ccb584be2422c5051c891359fc304928c315a54f97dc931f8824b99bff26e345e7d22cbd6fdb0f7c6f3b9a6d2efe5eb13968dda90ecd8feb5
MD5 SHA1 SHA512

Submit Download

AppCache133596439083295209.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596439083295209.txt.CashRansomware
Size 77KB
SHA256 59bdd87059f9eedd06d69fc81121b9330e12accdd6a9b3d1e93ad19eadbd6fac
MD5 8a455ede2c0f5fe81c53f5b9a439a64b
SHA1 e533489814d0664564694b0b812f91650485214a
SHA512 d2e5d42a0ba5fd9320db0b3c1a2aa2c3e72c4a1c811c77e925b8868a95b12cea275196472ade45f7d8f4211c6dcf3905aa052318d38b365c98b896d92556b5ed
SSDEEP 1536:qECbIuDuBzlTt0PQiVOFxOK60aRQfvBQTzEnG8dNZgCJgJIBIpn781:qx0pREHOFxOdWfCKbjgp9q
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596440479376967.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596440479376967.txt.CashRansomware
Size 47KB
SHA256 5cf24d06be7f0e32602fbf3d9afd0339ce12c1c1c95d820a39ee1e3bedc48695
MD5 47fa3e46335a6216dd1a7458d91e017c
SHA1 ea88535254b9e83c856598201c51007fb5c410f7
SHA512 9a30631749cbe0e9eee1453c86a31b749695529ccfb1437bc986b9d1ba60b89dfe413100935fbeae7d8d4dd91073763e2fc72f2bcc48fd31404443725bf7e695
SSDEEP 768:BIfOgrm218tu8CoTC7KOcey1ttXnbBaMaFe3qR7M+Q7A52jjO2:SfY2WQoTmy9Ba1FcqS+qM92
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596447864304096.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596447864304096.txt.CashRansomware
Size 66KB
SHA256 92d5d2bbab49058dd9dcc4f38d006288459be2107b0f96adf1e36bc25329e1ca
MD5 5b4c77d47677e04ced5a600383d5f978
SHA1 f5461dd0ecdd1ca4c79c5b5741eb0488c52dbc91
SHA512 d9c1235f7f0c92dfb450bad9adf0447214194f6ed986f845d4a381460b9ce4a68c919e2491b2f910099dc1b2246d8dae44bce745d5bfffe6d73bc180f7f9e039
SSDEEP 1536:gs+e6s0FJyHZOyKbWf+ibljellAnjAvlhdOJHP7hMi328G:V+M0zy5eKiEsvlhdO5FMi3lG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596477452623360.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596477452623360.txt.CashRansomware
Size 75KB
SHA256 6122786e974cbfe66e734d4b5780ce69528f5f19de660ed597c9ee5f4796936e
MD5 fde14e072993e79e3d05d44b97f7a9b2
SHA1 ecddefe55db95f6d756d023e59e366f6611d98bb
SHA512 89c66dbc3bd71e1b1c8a4578f72d253d5f20e4041989f10100b09575f5b6b4a910be46d19e5a84be597665ea1142d1157b1c87c79ee2f5d5cad6097a77ddbfca
SSDEEP 1536:SU9qeYyMqtO4Ul+fYxN26ou82idY3eb/XTi63gKk99Ro79HilJ3YCUfhBU:SUcoFIZfid0aX/SRopHUNYR5BU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wctEED4.tmp.CashRansomware

Path C:\Users\Admin\AppData\Local\Temp\wctEED4.tmp.CashRansomware
Size 63KB
SHA256 38461519415b4f35e7813a1b7f56bab3f923e470be58d8dd4e71bca0c28a26d8
MD5 d713c4adeba2f2809b80170eb23d122c
SHA1 4b7a6987a25a4c3073a418ee917597773142b7e3
SHA512 c62126c632efaf6192692084f82dd8aa6ae2962dfec64f5f0c2f12e186f95fd9e7be5f4460f987ca09e81960b68949cce89b8b7468e1aedb03190ce3f4e991d8
SSDEEP 1536:YLfqQISgvwHONtHkM0qAkKpXd90bDO81gHsKrFd:0yPDqEx3bKpXd90bqHsKd
MD5 SHA1 SHA512 SSDEEP

Submit Download

3561288849sdhlie.sqlite.CashRansomware

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
Size 48KB
SHA256 75dbdf0a4056e5d47d0bbf8723a676dc6ef15ec57b7e70538c345f9616f55089
MD5 6274dd195272c5cec88ed06249a6148c
SHA1 c8d42ecb3c527b6f78493b1f6e35d04920c21ce1
SHA512 a28bff4e030f74dcd6f79729d9537b71a793b7bab86a01c7bfbd5d0c9b273d340958bf48eb60135f3bd197f9ae0d5f80e70bdb072f986f7968cb6a5689b5e5e0
SSDEEP 768:AZL/1UFwHGbDSxkwNR/tpEaPnBxLbzVRRzp3bUKyqbKUFR2TT70ranTimNeE:AZLNUFUGbDIkZQ5tRBxbKSRIv4CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cash Ransomware.html

Path C:\Users\Admin\Desktop\Cash Ransomware.html
Size 9KB
SHA256 579374af17d7b9f972e9efcb761e0a8f88ef6d44dce53d56d0512d16c4728b9d
MD5 b38d3abcc3a30f095eaecfdd9f62e033
SHA1 f9960cb04896c229fdf6438efa51b4afd98f526f
SHA512 46968c3951daa569dfecf75ba95a6694d525cbbd1883070189896ab270bb561cb2d00d7d38168405da1f78695f95cc481d28bcbff74be53d9a89822a09595768
SSDEEP 192:6on15KS3/n31837icqZvRHXVEnEnOOEVGMPzeikW2:cQEUOO+VKikW2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4356-1753-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Download

memory/4356-1716-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Download

memory/4356-1717-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Download

memory/4356-1715-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Download

memory/4356-1752-0x00007FFA45923000-0x00007FFA45925000-memory.dmp

Download

memory/4356-1718-0x000002634B610000-0x000002634B7D2000-memory.dmp

Download

memory/4356-1234-0x0000026344B10000-0x0000026344C12000-memory.dmp

Download

memory/4356-0-0x00007FFA45923000-0x00007FFA45925000-memory.dmp

Download

memory/4356-1719-0x000002634BD10000-0x000002634C238000-memory.dmp

Download

memory/4356-2-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Download

memory/4356-1793-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Download

memory/4356-1795-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Download

memory/4356-1-0x000002632A100000-0x000002632A3A4000-memory.dmp

Download