zgrat | 26d0fdbb4bd6d3860f9e15d6311f2e28d36ff8df09aa51e945be368ed25f4255

Resubmissions

12-05-2024 21:19

240512-z6dd9aga9w 10

12-05-2024 21:19

240512-z55gcabc33 10

12-05-2024 20:53

240512-zpcrdsad49 10

12-05-2024 17:09

240512-vn594afe9s 10

Analysis

max time kernel
567s
max time network
571s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 20:53

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
Size

2.7MB
MD5

69cc2e20ea7a51666b8c14be90441073
SHA1

6a3c7d3267c5c2a679f5f41dff36c091dccfb337
SHA256

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24
SHA512

de565813d0ddfe491c367e78b2a11891a73859a04efd83d8f35a4a6f6a028a29c873750dc863d1dfca9c40f9b4778cb1882bf8c07b9609f8463db22ac912922a
SSDEEP

49152:nsul/s9YiZYGuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9uw:nJVsG+YRzsG1tQRjdih8rwcr

Score

10^/10

zgrat discovery ransomware rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2696-1-0x00000199C6450000-0x00000199C66FE000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0007000000023278-2225.dat	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/2696-1-0x00000199C6450000-0x00000199C66FE000-memory.dmp	net_reactor
behavioral1/files/0x0007000000023278-2225.dat	net_reactor

Drops startup file 4 IoCs

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exetaskmgr.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MVI6MT0qPLmQhQ6j.exe	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.cashransomware	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MVI6MT0qPLmQhQ6j.exe	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

Processes:

takeown.exe

pid	Process
3464	takeown.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
12	api.ipify.org
13	api.ipify.org
14	icanhazip.com
16	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cash.img"	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

Drops file in Program Files directory 64 IoCs

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox28.tlb.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\adcvbs.inc.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadrh15.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadox.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "95"	LogonUI.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3558294865-3673844354-2255444939-1000\{15B37381-D5F4-4447-86A8-E8DB79EDDF2E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exetaskmgr.exe

pid	Process
1784	msedge.exe
1784	msedge.exe
4556	msedge.exe
4556	msedge.exe
288	identity_helper.exe
288	identity_helper.exe
3320	msedge.exe
3320	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exevssvc.exetaskmgr.exetakeown.exe

description	pid	Process
Token: SeDebugPrivilege	2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
Token: SeBackupPrivilege	412	vssvc.exe
Token: SeRestorePrivilege	412	vssvc.exe
Token: SeAuditPrivilege	412	vssvc.exe
Token: SeDebugPrivilege	3820	taskmgr.exe
Token: SeSystemProfilePrivilege	3820	taskmgr.exe
Token: SeCreateGlobalPrivilege	3820	taskmgr.exe
Token: 33	3820	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3820	taskmgr.exe
Token: SeTakeOwnershipPrivilege	3464	takeown.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe
3820	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid	Process
2464	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exemsedge.exe

description	pid	Process	procid_target
PID 2696 wrote to memory of 4556	2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe	91
PID 2696 wrote to memory of 4556	2696	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe	91
PID 4556 wrote to memory of 4644	4556	msedge.exe	92
PID 4556 wrote to memory of 4644	4556	msedge.exe	92
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1808	4556	msedge.exe	93
PID 4556 wrote to memory of 1784	4556	msedge.exe	94
PID 4556 wrote to memory of 1784	4556	msedge.exe	94
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95
PID 4556 wrote to memory of 3272	4556	msedge.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
"C:\Users\Admin\AppData\Local\Temp\958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Cash Ransomware.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf69e46f8,0x7ffaf69e4708,0x7ffaf69e4718
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:3272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:1408
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16521385991200641066,8903901082042102065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:2404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Cash Ransomware.html
1⤵
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x40,0x128,0x7ffaf69e46f8,0x7ffaf69e4708,0x7ffaf69e4718
  2⤵
  PID:4468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:4296
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3464

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa393d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata.CashRansomware

Filesize
16B

MD5
bc602ebb3af3346915a6ed50f3b3cd83

SHA1
d4dc959ab6c522ad34e0f9e0b0843a0000c35843

SHA256
4f44ec3a364e3eb4265df2c024077fcefb0ab7096316bbe3d4f21927c5fe8a80

SHA512
61efce1f9dc47aa8e779ee7a74008f44ade9964f8dc941e34dc5e585e244d33ad85910f8b758822dc332fb3aa423e3da3f88d73757dd431fe0fbcba847bdb0fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT.CashRansomware

Filesize
32B

MD5
d7d8cd68c69b90d38c3e567183144b15

SHA1
d7df5cdaf8935071e46d7f6f844b9c29f9a70901

SHA256
ac9355c6e33716a21a4b2a9a624da2d338d042e7ea46c9e94a95f673b70b0d1c

SHA512
019ed5b94d1a7ed5058985c8c07cc8f319c01cfadded7b06ef6a70965d3045a3949f3fe4fe783d47919c6c2120048438457e173056d1f3e18f86f2598a4c458d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001.CashRansomware

Filesize
48B

MD5
5ae7bd8438167efefc0e88f42ebe9899

SHA1
4d2969c6307519f1538d8e5b471e1046bdc0acd6

SHA256
6823724c0016a04a0e4f859ff7d533aabf4afcc7100df4a0d40958f4b169e3ba

SHA512
8ea93e68a2a443b057fce5bc6843a2a0b251cea7a707170ccdc54d987b76f754de0ec4d7eaf2773948ced03f99880bb2026f3f61ec20cea59b147a525b2a8f13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2.CashRansomware

Filesize
8KB

MD5
cfafbbc433c6bb36af1e4d82d1792e0e

SHA1
1a41200a4f5d82b1e2d50dad9c022f2854caf6e9

SHA256
2ab17153f68eff009fe04298f247dde4f975e127e0f1449367c4f80940d9884e

SHA512
d75d1317c483684a3eb8fdbec8c44fe99d48178679c48309ce2d57121ce3d7a33678bdf6e3b356d92409a6326cf1740f10504ff32e3926df8faa4cd4bed4122b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.CashRansomware

Filesize
8KB

MD5
2a8826995f28098a96e115bc9b10bca4

SHA1
d6805a4b48042ade4f50e88b15831ce52a3c89d5

SHA256
4068db9c604e0328964533bcd2eea623dcbf671624d08ea9764a93c0277fc6f8

SHA512
ade81ce524bfb440e8fd8b9f90218207ef4cb555d9e72b3f07b67c2fd52939c3b951059824246895da67b1faef3589ee72950f249c27c2f33aa2ef45eab2d569

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.CashRansomware

Filesize
264KB

MD5
246363d618b0933bc3eaa611993c8db6

SHA1
317d858be7ac63a1225ddd6ea993f558d40dca01

SHA256
d25c3b909d338ebc7799789ff1b406233e6591201b495cc64bf1dd8022532950

SHA512
6dd790370e26f1b45940d59961b27941bf0238a4f31b9214468f6832a2d3a4a6a1832106bcfaacf49976fdd933c37b809ea3ef67b7270f9d80aed89f7db394a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.CashRansomware

Filesize
8KB

MD5
f2299a7c440b6eaa382b1041075fa75b

SHA1
cc81fe97fe0a2088aac86cfb34c27083ffcd17e1

SHA256
e6a424311085804f2eb510c81defe5acb36b6ac0eecd59be042747114aa4ef5c

SHA512
22b2fd4b6e1375058f12626f6c8ffe125e2fe5e6ed40bcc29cfc42db1986d4505e4437378dcd2c06f3a9f4188ba79032b5b819586c74f1d693dc890943dc42be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f684355-9d78-4e8c-97f8-ef5a17c89cfa.tmp

Filesize
7KB

MD5
683880d14907127f027363553346aeeb

SHA1
60ffdcc0513a6f158840bb044f2407208f2a9dde

SHA256
0e87f55cf780abc54f7f5685c1b8cb5163973fd3aa505983bef40fee23068170

SHA512
2c7fd4688367887092661dc8d55736da4e390f5a39940385b3d79d31a910d6bf8967e68471780eb212db9e3af4c9bfe3afafa36ab4ddaf89d9d73bc1550c78a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
1.2MB

MD5
b76a36f694fd69b229872393bd33b65c

SHA1
710ebf0e68bb65f2faa4356abe17f3d164e8b943

SHA256
1942ea4d2f0b066d0bbf102d25490e01e3843a204b2cc3cf2b721a7f7ddb9712

SHA512
8e4172f38b9b32658717de15c38f5b0c4dfcdbeb73424e6ba4f08981c868fdc240eb5776452f0a71395df2d0bc441f3f88ffaead5860fa672d992a94fb868a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e9008d1cfc3b7fd3e17b272fb4ecf18f

SHA1
45150477c9ca8863fd3a8c582627cf5b0a8948dd

SHA256
b7b863db2c4763dfd7caf7950d4f7943c735bb4f94b897f7911c79fb90bde041

SHA512
96d44948068dc607f18b38206fe82a5b30ef2cef3a65ca3c6a8b838ff001e8c55037735093acbbedbb06979fce4573851a4ae385c6134288814a53f614d53301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b1d43d7f714ebc521950cbd8d32f413a

SHA1
8548cb121b24189124990450e6f16d02dc86c0fd

SHA256
c5f2de81298f8fbf186b9610304d52ab5f00f79074ec87557f403435099a6c98

SHA512
428a2faa9adf5a414b48166ae4bd5196380f0a5a67e7fb42dd7a21eac9490b306ca6aae6df430ffb0ac1cd7e2a451d41e3e54f56efc5d0a74cee961efa03b25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9698fc2dd8e79e480c4c76865195c7fe

SHA1
c94e977c4e5cc0771bc573a80f0d784dca645b13

SHA256
6b5d2231a270c72e09b90e3bbe2e21db06328b3da3075edc4830de720ef0886b

SHA512
ec50e766cab49cbb25621b2e4d4683ab83ee90da949bacf57c82c4e025a32025f5776d7f54df0baabbea57db3d46b472ee881d026a67649cba0d18c6e767c016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
176B

MD5
4b0fdb42df7710656db54c391246153d

SHA1
76448462cca39b432c314f680ebb330258a28749

SHA256
72b128de5bd06d50af02c4113956687082280bd564ff6b5517e4bc466ae5d526

SHA512
f5681e8c75062df44e985069f51ebaf7f0cf0e10427b5dc4800e1c8af1d401816cc9bafad6157afcea9c85bf347540211332c273573c706632c290cbf90de067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3abd3fb5e9b513442173fb0b434152cc

SHA1
5f8e3488a6fd47b617499cb99a7696cf05440354

SHA256
e663c88b0a0901544c02f76af48b29b34619093d45483a5f03eca1be093f28c2

SHA512
5f38a70a74d210c9186ddbf760efdc1ff630d2432c8d4da96aa65452d9a3b04136ddac2b9fb3f5d9af8e02d82610aa7a9991a055612bb123236b8f2ae521bdb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1fe96e35f232bae97add57d74358e771

SHA1
a258b9a9ca1fff204e81ade88c7dee2edd3ae923

SHA256
fbcd720d3296ed6f2281451199f8967cf4e27b038592ca713700bb5092255784

SHA512
ed6c129066e0d7be0e2383a76e4379fd19c815708c154e0180735818fb28fa0bbaa81edc0063da4c20f51e1d00abbb670562a2e42e1753bb91946ccfb64ceb61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2819894ec542deaf63d1f41d027e2e76

SHA1
eca39c7e720ea1b8601e7b79cb62f4954f981d07

SHA256
43b1027d9cbb2df09576c8f8526f33905b02755e31b56c168c5dec284bb53fd2

SHA512
bf7c4a0aded27ae00d87b3b1975b67e06ea326c7f2342006763841e2549f2d6d96a80f09d92874b58b8aec8a87b91c4b9ad155b3ca1fd014ba1c967935b155e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a982927e2852720e624d10b9d3f6996a

SHA1
f5e095ee807878450231011c3b884885bdfa7568

SHA256
d726daecdb98be1998244a04f4902598b8fef131a23b0af9ab7227325034610c

SHA512
282e331abb747176388a7f7cfa9978828aaafe2925311f09e04111dbbee05670515518052e56bdfa152ba41cef65e31c4f5f8c4728c69534a337de9647851c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9bdb7b9aa53029d8a9ea5c1272f6eab

SHA1
b0db9134e11a96721f1cc193778e4dde1c0f1cec

SHA256
9224d92f11628b3a9cb52d9311d1e7373bb8c070c75389dad362399ea7e8eaf1

SHA512
b3350fef9ebd39ee47a89b8ee9a0ff7edcbe10e9e2021fbf2e1b9b119c3f7f01eb28ef0fb6055590227f3abef8d5b76abc7bb52a46795175acf2cb6507d3ae4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
57f1799ad31c0a725e04537820d92349

SHA1
db5ea4b10f0a694025eedad7ddf52056ad43697e

SHA256
1ab16281c4bd74cdc3ae04272206db8b7f59c2342438bf6b84132928ec03899f

SHA512
acbae080304a215d1c521d6fa4395a201d03190b8145b9a2e50b02926f779bebff53efb6747cedbebdd36841a8d87d5752ce6231a6afd227f30db90ab2836d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9090f7f9e89f9f099d3c90d8a4a5c7e2

SHA1
9b9dd43add17ad835df4ccf06c5604d03c394f16

SHA256
ceac18afa21a8aacd7926111fd3554e4bbc87f3612ba7e64cd6d36587b2b9840

SHA512
5d1bac141c134f53aff408b51fd6123306569b755f7b8c6960cbb1baefc9f8365b26598a9aee8582d179fd9aabce8723768a807be1dd5604b4877ea1ae7898aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e67ca1429268959a18d5bd603aeca198

SHA1
20aa4a8dff935d14730e324a631a01438f3df34a

SHA256
f343b44aad2573b51e9f1835fd59b66db4b616493bef3eb99b7b915dffc1d048

SHA512
aeb9d6d69b34ae353768dc9d75c72dea133906a4fcd1e89bc933e4b3e21c037cbe32ed67acca7c611d8abe8bd8eb202347596c4f6c25ef825ae39ec7fd5d252a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
89f7f96a3b4944264d8017ad742863f2

SHA1
91392464b7453d1fc7970f8c3c8e0b2e6606e068

SHA256
2c366b00af19b1dc4c0965875900fdcfea1c06827f8d4c1c251525ce6d0840cf

SHA512
06c5722934880816141440229f60ca77632ecd938230f7070c115bf1ff3e350a891cb2add0aa2440a1b8d8abdf944979a7d24fb44fcc70bdc3ec071b36b105a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a387e3be2c5e6f8f663b72020df76af4

SHA1
6af96191ab7a155ba31b14fbf28fcb300d0c73cf

SHA256
d0229f5781bf3f8900eb425f22275a42d690d2ba53fc8a8899e698231b7bc8d4

SHA512
d206bef643555034128d0324de6857872ec9ba3a8dc2bfbb586e53bc67bd2bfd1147af0975e55579aee6e95de0f185c7a832975dc10def4558652a03b203e9b9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.CashRansomware

Filesize
8KB

MD5
58ada42a7c467a299d20117959723417

SHA1
3cdf0e13fb71641623ddde3689afae944d0a5a0f

SHA256
d863876992860319a22bfd49dda34c34ec746bf51bd91bb4c6ce52f557f8ef38

SHA512
9f4fdc4aa8d5b9d89fbdc8b5ad485ece86140d14f8c370f14ac5221f9438a855ad44a6699fe74123503bbccbf282fb80210b3a4055622739be47163ebe7be4a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.CashRansomware

Filesize
36KB

MD5
b7794defd0e33fc90b9ab1af91fcedd8

SHA1
1cf957808d9b9e524ccc1643b054dba7d41cfbc9

SHA256
3ada6e09c34caccecd0e7877a1a1a7a30e4f6c143c33db5573cd029f24283570

SHA512
9cfd69bf530da5f667c54db649f5220a84e4bdf824b6bf9e65b1a8e7a7647564174efe082957842adb862ba7031f0a41a14592685a3f6ac3e95556a1d241d0e6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.CashRansomware

Filesize
36KB

MD5
87cf1f93a9969bd476dce6f2b225e24c

SHA1
bb5b1386d43da140e7d651eada2f9074f1a7a8b7

SHA256
8885fc0259582f380386f644f7748e802a13d8c534f2189340ac15cf97354d90

SHA512
84bc8ff08768b788671de23cd59ab5a47a1c315d0378d155284bc020634bb84ef16c31e39b4948e29b2d4f278ccec015c5a68239f087878cc1d7e8c0d567ed49

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f9cb7ceb-dbf3-46fc-8f32-f243eebcb148}\0.1.filtertrie.intermediate.txt.CashRansomware

Filesize
16B

MD5
047ad6f6a7923700fd14adde8007a19b

SHA1
c01f0f3bf2a2351dbff66aaea7488df57f9be735

SHA256
7f63ffe70ca9dda6e7950b5e6b6dc75a71cf268a736229917cf9f650189041b7

SHA512
f233e29c790aef5ab4725ddc97aeb4d8c09d38e200e64cc7581f41c77e2d734bb39bacdbbc744b34a0995dd7fa546339d0b4c5f23c432f609a978aa3fb08c23a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f9cb7ceb-dbf3-46fc-8f32-f243eebcb148}\0.2.filtertrie.intermediate.txt.CashRansomware

Filesize
16B

MD5
3c7d009ca4b64097e4c70e9c6960fe6c

SHA1
e50b4a1c952c5f05533734ca4f2f4f893becbbbd

SHA256
bc8d909cae6e7a23833fcf68a2d42226f644d9d73652b728c6c2d37affa1424a

SHA512
51d6a24e94965b4e564b6d8b9dd78584fe5b9ab123e2c4ceb74a2119da99e35c6e90457ab1d616fad18ccbae28a7070ae480981e8addebbb21857566bf9e2769

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596379517070185.txt.CashRansomware

Filesize
77KB

MD5
985a49bf2394a0be4778449cf7e5a267

SHA1
bc8f0b62d6fdae85bddb1aa7ddd81ae22ad6f58a

SHA256
66c1d3cf4737dc1929aa6d2cfb6a588b366f6648fc5ad8a3c3e66ed6c146f936

SHA512
936b71346728123dcafbfcd66bdcf9424ada44b291c9b715ed65bfb88a91d2de02ca035a34c2cf618c08206b66ae2804b249de0c88cf54b68946b55c32884140

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596380552933791.txt.CashRansomware

Filesize
47KB

MD5
02acd564766830fbae742bc76a19ed52

SHA1
ea9b6ad1244a8de81654346e7a9790cbfb303639

SHA256
d3673b83a0b91b9b01538c9a95022c8b031fc88afb01e3942773a8eb467cfab9

SHA512
4f823c46c9d4354fd769b5948865a4d260245bf5b58eecef18c3bb0042dc4b9227c603763ff0929d6ffe42aa2e01d73a5218f42d8e9b10082258df5a5c6f799f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596387720650447.txt.CashRansomware

Filesize
66KB

MD5
b74d5dee20f76d8743d669e83d6f1b97

SHA1
77995361e9e9e556f36701cb12003378e8d1fd3f

SHA256
efb9b93c213ba86be13925dbe72bad1d743fd462cb1967dd5dbbf0895e2e392a

SHA512
c2e90a3a71e8d0c1cc8757c5a28c71fc06d9f0f6c086201d1c3fc0ce6d0f20c8f5d70d46f461f327fc553f3cc4763673b3572dde4f1302dabeaadd3c3614c640

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctB258.tmp.CashRansomware

Filesize
63KB

MD5
03607413bd510a9bb03cfdd9ca696877

SHA1
b98eeb817f4c543d5617bc3898f10a9f87700ddc

SHA256
72e7b4593ecd340233d20739001d45de6b449cc9815ca1b3c68381f4901d35d8

SHA512
1eb4a31aea1e09509b5ee92f992c1cd5fdf68dbccb74815dae98f73f430f2428af964e90a2ec03b71492c09fad3673770e838df73272fbd05c1bbfe220b91a22

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MVI6MT0qPLmQhQ6j.exe

Filesize
2.7MB

MD5
69cc2e20ea7a51666b8c14be90441073

SHA1
6a3c7d3267c5c2a679f5f41dff36c091dccfb337

SHA256
958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24

SHA512
de565813d0ddfe491c367e78b2a11891a73859a04efd83d8f35a4a6f6a028a29c873750dc863d1dfca9c40f9b4778cb1882bf8c07b9609f8463db22ac912922a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CashRansomware

Filesize
176B

MD5
0fb0b40a199084b9ce7e23c0e47ba641

SHA1
ec6c0b19a5130aacb34cb8efa0016a72654e578f

SHA256
942345ca841f16321d918e118614085e2afe8418bbed845889f36a772e8c87b7

SHA512
722623e7deef9f674c997f78d071e0fe632be978a78723d5ffd4b185876dc9df633dac3515271e886732a475dec259435692d4d58637cd5995647d9091fc49f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware

Filesize
48KB

MD5
eefd6469db88ae342d6d71d70a9a7776

SHA1
4a11c24a32d12239ad56b56a4c1e716018761e7b

SHA256
cf5596afbd3eee0d043fa0626cb9d6d9954709b2ace1df29e7fa71b97c9b4bf0

SHA512
3af990269cf3a27c85b35a13c546b274872404cfeb0183355edb966579361d059095ff85a053b3d010ffc10c89f651d04b8318d06c3026be12b22e5006e519a4

Download Submit
C:\Users\Admin\Desktop\Cash Ransomware.html

Filesize
9KB

MD5
b38d3abcc3a30f095eaecfdd9f62e033

SHA1
f9960cb04896c229fdf6438efa51b4afd98f526f

SHA256
579374af17d7b9f972e9efcb761e0a8f88ef6d44dce53d56d0512d16c4728b9d

SHA512
46968c3951daa569dfecf75ba95a6694d525cbbd1883070189896ab270bb561cb2d00d7d38168405da1f78695f95cc481d28bcbff74be53d9a89822a09595768

Download Submit
\??\pipe\LOCAL\crashpad_4556_CNUCCCKEJVHJOMHK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2696-1760-0x00007FFAFC700000-0x00007FFAFD1C1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-1-0x00000199C6450000-0x00000199C66FE000-memory.dmp

Filesize
2.7MB

Download
memory/2696-1699-0x00007FFAFC700000-0x00007FFAFD1C1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-1759-0x00007FFAFC700000-0x00007FFAFD1C1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-1758-0x00007FFAFC700000-0x00007FFAFD1C1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-1700-0x00000199E7940000-0x00000199E7B02000-memory.dmp

Filesize
1.8MB

Download
memory/2696-1698-0x00007FFAFC700000-0x00007FFAFD1C1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-2223-0x00007FFAFC700000-0x00007FFAFD1C1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-2-0x00007FFAFC700000-0x00007FFAFD1C1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-1703-0x00007FFAFC703000-0x00007FFAFC705000-memory.dmp

Filesize
8KB

Download
memory/2696-1702-0x00007FFAFC700000-0x00007FFAFD1C1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-1735-0x00007FFAFC700000-0x00007FFAFD1C1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-1701-0x00000199E8040000-0x00000199E8568000-memory.dmp

Filesize
5.2MB

Download
memory/2696-0-0x00007FFAFC703000-0x00007FFAFC705000-memory.dmp

Filesize
8KB

Download
memory/3820-2210-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download
memory/3820-2216-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download
memory/3820-2217-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download
memory/3820-2218-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download
memory/3820-2219-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download
memory/3820-2220-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download
memory/3820-2221-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download
memory/3820-2222-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download
memory/3820-2212-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download
memory/3820-2211-0x000002F9BCB70000-0x000002F9BCB71000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads