zgrat | e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe

Resubmissions

12/05/2024, 18:26

240512-w3ftesdb5510

12/05/2024, 01:57

240512-cc9t2aea9910

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nvidia.exe
Size 2.6MB
Sample240512-w3ftesdb55
SHA256 e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe
MD5 87610f8f3d48edf25d48c4c0ba2b3486
SHA1 ab7498abd8626c968c84167ef1c1c503faace1fe
SHA512 73840a477b360fb1ab2061087838618a748f8b24560d289d563b4ba4b1b905f62686f4bca2c2e236007be1bc5931711c0d162b1c0f3ade009861e004116ddfe1
SSDEEP 49152:O+8l/s9Yf5u4uT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u65:OtVsGobzsG1tQRjdih8rwcV5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat ransomware rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral3/memory/4072-1-0x000002061DAB0000-0x000002061DD54000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral3/memory/4072-1-0x000002061DAB0000-0x000002061DD54000-memory.dmp	net_reactor

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe	Nvidia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe	Nvidia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CashRansomware	Nvidia.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api.ipify.org
23	api.ipify.org
25	icanhazip.com
27	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cash.img"	Nvidia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\wab32res.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado60.tlb.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado15.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\wab32.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadds.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.CashRansomware	Nvidia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
1580	msedge.exe
1580	msedge.exe
4788	identity_helper.exe
4788	identity_helper.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	Nvidia.exe
Token: SeBackupPrivilege	2900	vssvc.exe
Token: SeRestorePrivilege	2900	vssvc.exe
Token: SeAuditPrivilege	2900	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 1580	4072	Nvidia.exe	95
PID 4072 wrote to memory of 1580	4072	Nvidia.exe	95
PID 1580 wrote to memory of 388	1580	msedge.exe	96
PID 1580 wrote to memory of 388	1580	msedge.exe	96
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 448	1580	msedge.exe	97
PID 1580 wrote to memory of 3884	1580	msedge.exe	98
PID 1580 wrote to memory of 3884	1580	msedge.exe	98
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99
PID 1580 wrote to memory of 3464	1580	msedge.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Nvidia.exe
"C:\Users\Admin\AppData\Local\Temp\Nvidia.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Cash Ransomware.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe4,0xe8,0xb4,0xe0,0xdc,0x7fff617946f8,0x7fff61794708,0x7fff61794718
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15884060267307023332,15890360297640404014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1284 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

metadata.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata.CashRansomware
Size 16B
SHA256 ac356b6a28ca93e0cdc3489c32e565a0fd06a9f709ba12c0f48aa942106df03c
MD5 4dbbfe13079120d86501e397d81a75c7
SHA1 89624c125d2887b5d55ba6ac31b7720d7075c2d6
SHA512 c106f2eac6be3d822cb9d5454e6d954295a6c66cf4290cd2728e66b72b69a542d72ce441cee6b2916a202a5e6fab8463961c104205bccf354c16935738043ef4
MD5 SHA1 SHA512

Submit Download

CURRENT.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT.CashRansomware
Size 32B
SHA256 82db7367bef70197d23735da40ff6514b37dcde8bdea549d86be874a41054c1d
MD5 e137d7f298ba1412be23bb90aceec54b
SHA1 5bab1bac3aae45edc17587f94126a5ecbfe02099
SHA512 e90022812f2fd1b95d98591c24cc924dfcb951eb888ee6ad1499366f3c4612bffc8c172be7866c527d90100213722fcc9f1a18b7ea22d3ab04c780b48258efda
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001.CashRansomware
Size 48B
SHA256 a4c67be0a5ba7267fd27b2d39111112734199268c60afc93fb61a4a78c261cfb
MD5 7c0e746f6300a061db56cf4697b4ee9e
SHA1 afb51a74127bfa8ee66f9616ac9052df07401bec
SHA512 c7265908ca35ce584ffbdd17e4ea1d58d874a89c08cc192a33762206871f0750e1c4463e5f9ce976411453e2db8502126a35b023719e8e00798042c8211e73d1
MD5 SHA1 SHA512

Submit Download

data_2.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2.CashRansomware
Size 8KB
SHA256 621857c80a542f9ac34573360ed55ed6bfd57577d7e2422283c53b1330c17c06
MD5 267835ba16bc29744c7390b5e312e0a5
SHA1 3cead158187f3b87242a77d0f80b25f2464f3d6a
SHA512 3ae82897efc1546eb458cfdb8490adb13a38bd98b0de288c1cc899e55f82d4b6fa30342347b3527056be283b95d7cb7408afc97ea3db0a020dede98d2694e286
SSDEEP 192:ejAwL8JdRRJR4zs4gEJhL2KZ/X8NBE+ENdSaqibCWD1b8UGJ2Ms4wr:S8JdRRX4zfJdj/Xei+ENdXhXGC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.CashRansomware
Size 8KB
SHA256 27366b3dca192eec2af61a486d0b2af044278209093fc3ee8f3d4d7b74f02612
MD5 3b15a749fe20617c5169f7e1c1f0304a
SHA1 beea856a3aa9a18c5873c496ac6c5c823eaa1455
SHA512 871125374e6296bce991067777a7baf0bb6f12e47f5cd911f200e034f0567dfc8c21ad80cc0d23236837407fbfe637b9952bda3d1e7ff24e4228a95ed1a32260
SSDEEP 192:GWUrygNzW+gSqqc++/n6f5dUkJjMkmNqpShh/E:Y+YWYZGniUkJQkmkpSX8
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.CashRansomware
Size 264KB
SHA256 c761b21ffdce62ee356d40a64f0a1af3c93d629560fb5b04c8166ec82b496775
MD5 c348affd02f06d06f89ea841fe8724b5
SHA1 35dc94f03e54d56ca012f022d4e813b0faa7086d
SHA512 8503b90984f7ce0e62b2c5b9ab20eaeef5bf310c2723784325e9cb5d3f1e198ac26439ce2a30b42688f526519f707e3f657dc2ea30be2b429ab3d3d5a7552df5
SSDEEP 6144:mGt0XuOjeRWdEIEFj+gSMBrKMfAw5AtgYrC60A:mZjsWd43jbfAw5AtJrCC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.CashRansomware
Size 8KB
SHA256 139de2c1ab83257342372bf002448e5345aa2c813f2e8c666a1ebbd1e08aad79
MD5 1c700693efe72b30c73675bdaedb317b
SHA1 449b09531d07b32fec2b451dacd4d3596070acc4
SHA512 b78bb22e4542011f8f966e998dbb1219c7260ee5d33c62cc8320fb321091cf108febcca8f001d7e993a20254e3c7167d9b98e842202124a8b36fd20b7e3ea9fa
SSDEEP 192:jUtN2D74ijgaI11RnC6mKdRbim01xrGweE4H/lbr/yTuPV6h:jUf+ci5IfRnf5dtiD1tVo/pzCK6h
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 176B
SHA256 72b128de5bd06d50af02c4113956687082280bd564ff6b5517e4bc466ae5d526
MD5 4b0fdb42df7710656db54c391246153d
SHA1 76448462cca39b432c314f680ebb330258a28749
SHA512 f5681e8c75062df44e985069f51ebaf7f0cf0e10427b5dc4800e1c8af1d401816cc9bafad6157afcea9c85bf347540211332c273573c706632c290cbf90de067
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bdfa04c7ccf452253b5b013c4fcdeff723b1f04eed02d03fa5d16c8ac784d6ff
MD5 ce372b4115985b6521478401e3d09d5d
SHA1 a2b3525d75d2992466d5bab2938c592505981507
SHA512 05e8a0742b31e76e70719918a5890009c439d610b5c61532a8b2f477d15844c9c74d3c9e52f6823a89ecd1928b872f3cdf35c46d6a172cd74cfd1938a1e958a3
SSDEEP 96:nQklxm/pQYmqW1otwpvWMoiVmdeHBrzB2+UWQyV+VDCziEwb:nQkWCdatGWMX32+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1babce70d49c3adbb4aaef0f10406988898ded3f300bfc32aed05838bf10ce98
MD5 570d13a2fb7d3f5bf3efd57b35fa1404
SHA1 a51748fd5805ccb53db0ec694eab9286fe5c7768
SHA512 bf7f52c7aa83abcee7d1e7cf162b8b3834c10b774b3c81e18d40cc285de1262c3a5ea1a81ce717f45fb84be48f71927e57591ecccf2d1ad79e48b55d8c938f2e
SSDEEP 96:nQklxm/pnmqW1odwpvWMoiVmdeHBrzB2+UWQyV+VD7AiEwb:nQkWwdadGWMX32+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1f8cb032d378f6fcb880cbda39d619a58f0bd9bea149e5f98c110fc0eac9cee8
MD5 c046b874fcb41e8e7df63f500aa6d0e7
SHA1 44e02e50fe31a4215184efc2afd2776ba2acb3f9
SHA512 d6e262f6f410f468c6753bbb242de6bff8facc5d5aaabacbadbe6928c0657c5caec3417691954a4cae353a2f4574a4e8be1d4e67046fc1aaf50eba473d4b2e26
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup9HRe2RUWMj2o+OblfBhDaZ:A9iIxuERzA83h09RZxY9HF4yo/XDafE0
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.CashRansomware
Size 8KB
SHA256 8cfcfbac776ad087aa43d653261116360a3f89a1bc38b88730db4bf273bc4f40
MD5 70018c832a9c549b02bcb58f55bb9673
SHA1 93c5aa4a7aba32d72b2c0388424cbd9d1a789127
SHA512 44e1fbc2edf86e81fef4488525cb8852fdcef52e964764787605779cbeec2e1b598089574c23158535caad7c47082c9f39c33106e90defc3e2a5df51251b0935
SSDEEP 192:tvRrFIEa/gN/DFjKGRdBdv+2FHF6ZF8ebrqkP+eNiZOqt6d:5RI/+puUdBdvhHiFRdP1NcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.CashRansomware
Size 36KB
SHA256 90a386126472fa1ec4a6e402d9089f84fc7d82abdb91cbdb3c7567de787ffbf1
MD5 7b77ba51676ed5f03f7291d6badd38a8
SHA1 51e6ec74fabd780924e75436c889fde8ef557f0e
SHA512 5b44809a3211a897d7c15f2629f62980781dbd08efcda6e6f9793e86e9ba1f883d9d9f7dbbee824d536b786b509dd4edb17daa1cc94809b18c002fdffd5a33e9
SSDEEP 768:AzKWQLkv6vsuHZFhpwukT923o6Xic9CNvpSQowhfTfhhqBcNyW1PB2HKE:GLSEuD84GNdhfbhccsWpaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.CashRansomware
Size 36KB
SHA256 b50d008d75655b8491edc80d35c184e2282544c2c429046a29aea058a8587ec1
MD5 e50759c34cae0de814b72dc8dda87990
SHA1 98f1dcf1fdd75f3b126df041467cf6011cb27072
SHA512 87540a1ce0d3bb1b6bcd872be53abd6b1128f3e0944339031abb37ea611adfa8257834de7b5e733237d1d5102bee6db3ad0c827d69bb7657363f19f0454a43dd
SSDEEP 768:YAELSzSo1w8l5Z3B1qZWb0KoGBQglPap3Zew/LU6iyZKyHebk+r6z8Bj:hE98PZz0GBhBa3kUUvEHlDz81
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.1.filtertrie.intermediate.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.1.filtertrie.intermediate.txt.CashRansomware
Size 16B
SHA256 b19509cc05175c1b289aee51d691c5487f5f335eb22921c8bceb790a0e7dd1c0
MD5 aeb0b33c9f1eaf7ec04a744e50fa9014
SHA1 2cbc8ce8cde353fc3bf111dd18aaf4bbaf782937
SHA512 e03d827c12065c1838572fd845b856493ee0e41d0b3eb902d308109407eabc517dab357d813c9568a16d0913ca9205ce2cf42823c27d30ecbdab34efe54e917c
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.2.filtertrie.intermediate.txt.CashRansomware
Size 16B
SHA256 edc62cfa5e81454c72a0e44f9a722c01f461da0cb3716ce56f9fd0258c2b55b9
MD5 02889d2ffed99ea3acba1b887938d0ee
SHA1 89f1cb16f18256e6f2cf37152d023919dac01329
SHA512 bdf543959b4aabecd9658e8ed89d42788d5b335291a86c404fdcd0635e539cc61a39fc310999644dc72cf3ebea22c456d119f15992382ded00bfa85d69fa2ade
MD5 SHA1 SHA512

Submit Download

AppCache133596439083295209.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596439083295209.txt.CashRansomware
Size 77KB
SHA256 b3eda24beb787509788d4c8de9dcbc693352f86ebb799266992dd847cdf4df93
MD5 cfbd18d6232adeec539d2002d3d74d8f
SHA1 3dc85d3d87fba495085eb3274275e18f9b6ea671
SHA512 d2ed13ab483f8b79ab0179bcc5105d33e28987dc4247cde6b01ec66e6fe74c2c4d378c27470949f4768ba9aede59ac983ac2ffc368f63354b39117398a0e740b
SSDEEP 1536:hAKVXHCjISuviCaoiDbaLUC9vFwL66v0PGjOn+HUwWz8yDZn4IWro01O4:Zgev/aoe2L7MLd0PGjOD8ytn4Po09
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596440479376967.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596440479376967.txt.CashRansomware
Size 47KB
SHA256 98217bac8b0e5e5646552650df3cf68bcf47e2ac1d79707e56a468cdae3efc96
MD5 8cdf43b70d662abeef0b1a382b7e7bd9
SHA1 51241557d254de192d885b46c8fce9ba25a009c8
SHA512 c7d54c869dd35a6ea6b87099e8b2b24313908f9f505bcb7ea1544eeb8900e714ee0aa01516f352fc2b0b1c358321f656c3bb6282f0eea6563b9009c43a4c4788
SSDEEP 768:poh/ViCbA/4YBpo4uerCJIRWq0S1vvQ1oNbyVQNZnJIaU1bB6naTRPXG:poBVLc/dluZiWo1vYOgVMnJIaU1VUaVW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596447864304096.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596447864304096.txt.CashRansomware
Size 66KB
SHA256 f5a7aeb358dd25d057e5725540410b5ba096728b848d410c0d0a8e7a4baefd4f
MD5 1e595ff3161544529ec331c0eb43f7ce
SHA1 0e19cbc443cb017869d3ebe1b6189fc6c24c8bf3
SHA512 c638ce8af015807297723e52c05ee8086ada23f8f3b671871e74e479377afb8f8bc7b440c96442a085663b9e6406b536c5ac82c572b1a53ada5d3838e1ca7ad8
SSDEEP 1536:+G0bIV1GmTRFFIo/XJshV1bdSTxPm/txVZ9e2TP:6UV1GOm8JKKs502TP
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596458396484730.txt.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596458396484730.txt.CashRansomware
Size 75KB
SHA256 20fafeb8db61c5e4dbf0a3f674b9cf66c89c4847dba4d4331e7b665bbf1c3ca6
MD5 471d6663febd7f7470ba6059028004e2
SHA1 e518b8a7b1e897c4a336b9eb2c0c07fe0306fc85
SHA512 0e88b36d95eaf5d6e90d559be40f90596925c9f9bef93d0346050455797069690d99586a0d8cd9205e19243d35635ab0e5209b64f443319b02ed3d4d082aa0be
SSDEEP 1536:3uVZQMHh69sbH6J4fMEzFbclpISFwWDSXW:3uVmWh69sTfPzFbcFeUSXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wctEED4.tmp.CashRansomware

Path C:\Users\Admin\AppData\Local\Temp\wctEED4.tmp.CashRansomware
Size 63KB
SHA256 26affe4b650e4d15cbb1bac8ff8158833402296b4716116ddb3ab039982c5ab2
MD5 105f92be2a4f7d3dee43681b72569113
SHA1 90741c150d87e0ceec592cdd414900635cef23f1
SHA512 7a543842a99a156f6ed0f560de436f3cab6abaaae5617d4d30e6742fa77c3d335677d91732cd1d1366017b4e30af1f28883228a5f41d27d6c8f04f16d7f36643
SSDEEP 1536:mPc7oyATnaYBlHCVOSpn+hpMrNgdMEgjmAXbNKiduk:mPccNTaQHCVOSXRm8Xwk
MD5 SHA1 SHA512 SSDEEP

Submit Download

3561288849sdhlie.sqlite.CashRansomware

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
Size 48KB
SHA256 2d5d0b16b73782850d63d079b056e5500b950c58d4fbf35a0d756e8b587cd751
MD5 45e68106c5f964e7c242499e485aa0b3
SHA1 b1fce0c9db643c1614c15b935edc3d67ac5e650d
SHA512 f7fa362484f85301b05739b9cca78c0869e72c53c7d24e8892d1c3a2571490cb4d795891377e33f2e6d4631cb14d6c9191dc2e98af4f9194d8a144809cf4eb4b
SSDEEP 1536:M5W2UAVZ+emnVPfW887F7PE7ojNaS2cUYKh2a:M5WNmZ+5Zf87F7s7EaSOhL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cash Ransomware.html

Path C:\Users\Admin\Desktop\Cash Ransomware.html
Size 9KB
SHA256 579374af17d7b9f972e9efcb761e0a8f88ef6d44dce53d56d0512d16c4728b9d
MD5 b38d3abcc3a30f095eaecfdd9f62e033
SHA1 f9960cb04896c229fdf6438efa51b4afd98f526f
SHA512 46968c3951daa569dfecf75ba95a6694d525cbbd1883070189896ab270bb561cb2d00d7d38168405da1f78695f95cc481d28bcbff74be53d9a89822a09595768
SSDEEP 192:6on15KS3/n31837icqZvRHXVEnEnOOEVGMPzeikW2:cQEUOO+VKikW2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4072-1741-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/4072-1683-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/4072-0-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Download

memory/4072-1682-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/4072-1681-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/4072-1736-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Download

memory/4072-2-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/4072-1685-0x000002063F610000-0x000002063FB38000-memory.dmp

Download

memory/4072-1684-0x000002063EF10000-0x000002063F0D2000-memory.dmp

Download

memory/4072-1756-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/4072-1757-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/4072-1758-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/4072-1-0x000002061DAB0000-0x000002061DD54000-memory.dmp

Download