zgrat | e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe

Resubmissions

12/05/2024, 18:26

240512-w3ftesdb5510

12/05/2024, 01:57

240512-cc9t2aea9910

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
12/05/2024, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nvidia.exe
Size 2.6MB
Sample240512-w3ftesdb55
SHA256 e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe
MD5 87610f8f3d48edf25d48c4c0ba2b3486
SHA1 ab7498abd8626c968c84167ef1c1c503faace1fe
SHA512 73840a477b360fb1ab2061087838618a748f8b24560d289d563b4ba4b1b905f62686f4bca2c2e236007be1bc5931711c0d162b1c0f3ade009861e004116ddfe1
SSDEEP 49152:O+8l/s9Yf5u4uT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u65:OtVsGobzsG1tQRjdih8rwcV5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat ransomware rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral4/memory/4628-1-0x000002849A010000-0x000002849A2B4000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral4/memory/4628-1-0x000002849A010000-0x000002849A2B4000-memory.dmp	net_reactor

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe	Nvidia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe	Nvidia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CashRansomware	Nvidia.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	ip-api.com
3	icanhazip.com
4	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cash.img"	Nvidia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadce.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\adovbs.inc.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdfmap.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado25.tlb.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadcer.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msaddsr.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\adcvbs.inc.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado15.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\gl-ES\tipresx.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado27.tlb.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.CashRansomware	Nvidia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.CashRansomware	Nvidia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2416	msedge.exe
2416	msedge.exe
4016	identity_helper.exe
4016	identity_helper.exe
240	msedge.exe
240	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	Nvidia.exe
Token: SeBackupPrivilege	2644	vssvc.exe
Token: SeRestorePrivilege	2644	vssvc.exe
Token: SeAuditPrivilege	2644	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2416	4628	Nvidia.exe	82
PID 4628 wrote to memory of 2416	4628	Nvidia.exe	82
PID 2416 wrote to memory of 4108	2416	msedge.exe	83
PID 2416 wrote to memory of 4108	2416	msedge.exe	83
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 1836	2416	msedge.exe	85
PID 2416 wrote to memory of 2020	2416	msedge.exe	86
PID 2416 wrote to memory of 2020	2416	msedge.exe	86
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87
PID 2416 wrote to memory of 4936	2416	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Nvidia.exe
"C:\Users\Admin\AppData\Local\Temp\Nvidia.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Cash Ransomware.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe8,0x10c,0x7fff78b83cb8,0x7fff78b83cc8,0x7fff78b83cd8
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,1465562583038401145,2861087974203978428,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2608 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

CURRENT.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT.CashRansomware
Size 32B
SHA256 b7504e2edc3650764f952fc76dec486dd72f9cbf5b788ad8db8a2554d6163428
MD5 6a72e38af9fd2dabcaa5a34b1e4541e9
SHA1 3441e0efe2708dd29b2a3117083425236e090f6d
SHA512 b37d54a9538f7b889d50876f681071206bebdb09febbc925b04034832368df7831416aa112bd589f65fba3f6b14af4e812207944abe8d5fc4ff7bc36bf774109
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001.CashRansomware
Size 48B
SHA256 bb22b5b0700beb5624278fb95bfc452bfd6c96c9def348e0d9fe8e0d23fbd745
MD5 13b2aef5ee351e0de0df0a6579ee8e0b
SHA1 50a15abdc67745dbde4fabcad3ea28cb171abaaf
SHA512 66ac8aa1fd8a2f09f7e6bcf846599fb2ef88399c85ebd94db3bef2e50e91ae1c1518b596af4696e3c21e151e9599c0f5d866e84d9d9819a7028857aa1cf843eb
MD5 SHA1 SHA512

Submit Download

data_2.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2.CashRansomware
Size 8KB
SHA256 ec9ae02f9887306b5ce969b21b68692921250c38881f63c11488e271171e9571
MD5 aaf52be04bad9248db44065853a0962c
SHA1 70bf4d63f2d267a25d6a0fb4eb329a60fb549987
SHA512 232de77990c92b3e731e7cdb3e302150f6a54ee771aefd48c6910346d35aaed1249be6c1b78d8a5412ba8679a4dc12f6b03e89ee5275bce31c50c771773518d5
SSDEEP 192:c9d5CjMn2QvSXeK9pkChRiwCd+43HlXhgKN+:4LSTpphRHuH5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

First Run.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\First Run.CashRansomware
Size 16B
SHA256 af9626b1157c281bd0e6b55e55ce3c71470746686881bb21753720d035ac202a
MD5 867a6cbf9bd49c96dd6f8e03198eb2bb
SHA1 94fc4d76743f598e539bce3198e53f801a1fc538
SHA512 a4e170a6a59b7f8faacb53a868714be33c9d94b3bdd44c075e7469c6d23795492cbafd63adb30c6171e03dbffb047a0841799bc0642ed4ea6db21d892b53db0f
MD5 SHA1 SHA512

Submit Download

data_0.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.CashRansomware
Size 8KB
SHA256 6b0dcb6534d0a3b402547809a89f870a385d2656b81a0287810fbc755e4a3dfa
MD5 387886bf11a1e9f45ce0f467bcd6aa4f
SHA1 6ed45e5a20751d0d2b6454ad91315f8e56c3e6a8
SHA512 5f35573163d687a71636f842d796c97f101cde7fffe5a3202059780bbc03c13541b824aabc003249569034a47b3c8fe1b06b9554a9940fd7edaad07a3eb723a9
SSDEEP 192:2uaufo10+3i2lUy+bxFZqrhZCA1zk7TZQPkoFUFae:2so10+3DUyKZqrzCA901zoyIe
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.CashRansomware
Size 264KB
SHA256 19b5ab9b1d0d582272d18dad6db49ff482441f150ba116d200a8602fc0dad147
MD5 a43cc0fddbcd165c96f985c8a9c37614
SHA1 bfd07cae8353b89f0bc945d3d49f75864f740490
SHA512 5045d133d34388906fc197fcb6d971e1bed66334e5a46abb54e6be20140c8d4731298cd9dd02b1ee387c8ddc7516bf79775227c9f8d461ef488a2da6a04af9ac
SSDEEP 6144:l1gYg15eeX9ZnZwtliP7PdEkDSP5a7vEM+Zzu:l1gX5ek9ZOMpBCAc7Zzu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3.CashRansomware

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.CashRansomware
Size 8KB
SHA256 adf37a8e1faa841cae013671c5d02b1e58423efa3292ab07ac402d338a26e8bc
MD5 be3fc33928bd2a2fd8baab281a426549
SHA1 3e2ee3834e55cd6062b4b058b3cf37ede2da7524
SHA512 e79b39a947870b8347e03e5fda7f1c490dbc11624451f13c7bfb4e518286a3c6cc44d19322ccfea3c3a991a26f1ec4685615b5c3133e9b60d9f1ec671eca9d39
SSDEEP 192:r+N4LCgSXTa6+5b1gEgP1XKG0sIdpoLieCelV8EXQOYuw:SN4LjaTa756EgGscSLieC0V8EXxYuw
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a
MD5 8294f1821fd3419c0a42b389d19ecfc6
SHA1 cd4982751377c2904a1d3c58e801fa013ea27533
SHA512 372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947
MD5 390187670cb1e0eb022f4f7735263e82
SHA1 ea1401ccf6bf54e688a0dc9e6946eae7353b26f1
SHA512 602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 176B
SHA256 72b128de5bd06d50af02c4113956687082280bd564ff6b5517e4bc466ae5d526
MD5 4b0fdb42df7710656db54c391246153d
SHA1 76448462cca39b432c314f680ebb330258a28749
SHA512 f5681e8c75062df44e985069f51ebaf7f0cf0e10427b5dc4800e1c8af1d401816cc9bafad6157afcea9c85bf347540211332c273573c706632c290cbf90de067
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d3d207174627c61e350bb15198e193b7015d8db4b1657c69c9e663e10e14a285
MD5 974e00d6913a3b64e958a9342fee112b
SHA1 4da26a21c2df7886e356d2d3408dd54affb0a057
SHA512 8f955a4ea8c393b5e9d3c980693e133c3d8de82369cdeb746524820e92edc1148e7782aa29d30f9172da43ef90a9506b6761d154987558fb3c803b13426c72f5
SSDEEP 96:n6k3Jxm/pQYmtOGFkIwSv0MoiVmdHITJ10WQyV+VpziX3wI3:n6k3SCsGFkIv0MAI91Lx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e4e34cccd90fa2de2bf863129735c2a72c719ef7c784587d61d2a0f8c8408692
MD5 6a824f4eafd69e72fe9ce870c6b0c00e
SHA1 8f1e5cd47abe5604090286d74f473e3b32bd4f79
SHA512 4e7b69b64a105510589829428f619b199b6e7229bb12967df5da161f89e287957ea9f69312461b81139cbfe8e4a275c0bef39424c0813ed5958c2672a5467430
SSDEEP 96:n6k3Jxm/pnmtOGFkYwSv0MoiVmdHITJ10WQyV+VpAiX3wI3:n6k3SwsGFkYv0MAI91Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 94a04ed51b69f44cc50324ac78ef98612ef19b775a653d5c705526f136df80b5
MD5 2e8d751eb1ec6f59562d0c86d3185ae5
SHA1 d5a29a5d76fa47c92ad4d8c9ba5759b89c4892ad
SHA512 983899b818e23e7bac98f4f7780d697eae8c39e2e1aa608b8e3fa6bf06a9ddcc78950d36abf889ea0a0f5910fc935801696ad609db1c75af92a10881fbaab6d3
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGaOdqe2RUnqNR2sL2TacHlGz0:M9iIxuERzA83h09RZxASGmqq/L0VGzPc
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.CashRansomware
Size 8KB
SHA256 d41edb53cdb2a5ac0d67dbc9ecb8f2cfacac6e752458519bfd98ff76212c579c
MD5 9402e21aee5daa87f099a9571a819fad
SHA1 2807a978b905de378f1d114b6f30086255adbd63
SHA512 dfed2612d502a64b2e099bd2f28631267c253d1b25648a5a06ea65e383ed2cd7c1bb675d704529724ada72994119f78a27b17df074d96012f35079faf1d1f4bf
SSDEEP 192:t01hcZMH7qgnLYp6XrT7ZoGoyzZ/4gMYhmP:2yZALYpmrfJo4Z/nMF
MD5 SHA1 SHA512 SSDEEP

Submit Download

edbres00002.jrs.CashRansomware

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs.CashRansomware
Size 512KB
SHA256 5058ce2830d55c5fefc7825951579dbdd2666e247c24a4d1915b1eaf59887938
MD5 94188630413cf6818968512acb10a899
SHA1 dd0bf0044553417c3748496a345c7a812caaef68
SHA512 2d4e31921b477ee71d2c955e45b7e6a220e83fc08014abf648a2da8bc1be63fb046ccc3084d2cf0761adaff655a84da56b7d60110e29756dd3703b93b45708fa
SSDEEP 12288:LmZBzDd3d4PxTGL85Rp1cgAonIyVdxwUUoimi2KeTk1Ffhej:LmjPd3dKku9ciKUUn6vTiFfhej
MD5 SHA1 SHA512 SSDEEP

Submit Download

wctD9F4.tmp.CashRansomware

Path C:\Users\Admin\AppData\Local\Temp\wctD9F4.tmp.CashRansomware
Size 63KB
SHA256 f290b45f33fc46a8b18ab46c00cac0566b305d34d7d1e822a1687cf9a8d46b06
MD5 79e448b2e54fc325b7df7ba776f44be0
SHA1 971d3fca4a1cd867fcce51d88fe53811b5d8a675
SHA512 2fc818f5d8b03ca0a9323cd98eda9b7dbb58215faf528edee75855b1add41602baac45f56e18ea6605e73455360164b2ad5fb7620f7e42a5310cc17746d42c35
SSDEEP 1536:Jlq3WZV9lE/U8bZxJO+tGMQImoSmi8Ldm7PaB9uGkCInQmF5:ga8bZx8+tlQXmmSbuGkCGQmF5
MD5 SHA1 SHA512 SSDEEP

Submit Download

3561288849sdhlie.sqlite.CashRansomware

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
Size 48KB
SHA256 4dd7fe195b4c3af28719fc7b529b75d11961a1d472283e3ab73a023adbe003ae
MD5 6246b46a7939cf18d8c0e9fd444bd6fd
SHA1 39ee4716524282ea4908e93523ed8c6f5d0ba300
SHA512 ca250218f5ed7e9d0970121db1f9e4f0ccd6c5a1432282b1397fa718b97dd9a51547868eaac0948e51d1d9e2273aecfff2c39a6047a72d402b3e284bd955e6fa
SSDEEP 1536:uqncDFk8PdIHqV3l9/7t03y5C48VqcS/h6:uqqFlIKHRt03An8Va6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cash Ransomware.html

Path C:\Users\Admin\Desktop\Cash Ransomware.html
Size 9KB
SHA256 579374af17d7b9f972e9efcb761e0a8f88ef6d44dce53d56d0512d16c4728b9d
MD5 b38d3abcc3a30f095eaecfdd9f62e033
SHA1 f9960cb04896c229fdf6438efa51b4afd98f526f
SHA512 46968c3951daa569dfecf75ba95a6694d525cbbd1883070189896ab270bb561cb2d00d7d38168405da1f78695f95cc481d28bcbff74be53d9a89822a09595768
SSDEEP 192:6on15KS3/n31837icqZvRHXVEnEnOOEVGMPzeikW2:cQEUOO+VKikW2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4628-1560-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Download

memory/4628-1561-0x00000284BBA70000-0x00000284BBF98000-memory.dmp

Download

memory/4628-1559-0x00000284BB370000-0x00000284BB532000-memory.dmp

Download

memory/4628-1558-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Download

memory/4628-0-0x00007FFF7D5D3000-0x00007FFF7D5D5000-memory.dmp

Download

memory/4628-1596-0x00007FFF7D5D3000-0x00007FFF7D5D5000-memory.dmp

Download

memory/4628-1597-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Download

memory/4628-1557-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Download

memory/4628-2-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Download

memory/4628-1620-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Download

memory/4628-1621-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Download

memory/4628-1631-0x00007FFF7D5D0000-0x00007FFF7E092000-memory.dmp

Download

memory/4628-1-0x000002849A010000-0x000002849A2B4000-memory.dmp

Download