zgrat | 12dcefaf7cb33b93666d904438d7e6de7d71618230f225c8a7ab37096857ae48

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
Size

2.7MB
MD5

69cc2e20ea7a51666b8c14be90441073
SHA1

6a3c7d3267c5c2a679f5f41dff36c091dccfb337
SHA256

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24
SHA512

de565813d0ddfe491c367e78b2a11891a73859a04efd83d8f35a4a6f6a028a29c873750dc863d1dfca9c40f9b4778cb1882bf8c07b9609f8463db22ac912922a
SSDEEP

49152:nsul/s9YiZYGuT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9uw:nJVsG+YRzsG1tQRjdih8rwcr

Score

10^/10

zgrat ransomware rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2256-1-0x00000192CEBF0000-0x00000192CEE9E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/2256-1-0x00000192CEBF0000-0x00000192CEE9E000-memory.dmp	net_reactor

Drops startup file 3 IoCs

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MVI6MT0qPLmQhQ6j.exe	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MVI6MT0qPLmQhQ6j.exe	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 api.ipify.org
18 api.ipify.org
19 icanhazip.com
21 ip-api.com

flow	ioc
17	api.ipify.org
18	api.ipify.org
19	icanhazip.com
21	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cash.img"	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

Drops file in Program Files directory 64 IoCs

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\wab32.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\adcvbs.inc.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadomd.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.CashRansomware	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2668	msedge.exe
2668	msedge.exe
3172	msedge.exe
3172	msedge.exe
292	identity_helper.exe
292	identity_helper.exe
280	msedge.exe
280	msedge.exe
280	msedge.exe
280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3172 msedge.exe
3172 msedge.exe
3172 msedge.exe
3172 msedge.exe
3172 msedge.exe
3172 msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2256	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
Token: SeBackupPrivilege	3636	vssvc.exe
Token: SeRestorePrivilege	3636	vssvc.exe
Token: SeAuditPrivilege	3636	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exemsedge.exe

description	pid	process	target process
PID 2256 wrote to memory of 3172	2256	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe	msedge.exe
PID 2256 wrote to memory of 3172	2256	958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe	msedge.exe
PID 3172 wrote to memory of 1816	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1816	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 5068	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2668	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2668	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4584	3172	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe
"C:\Users\Admin\AppData\Local\Temp\958ccd8e8dcce5e7bac5f891e8edc42ad6c5497d9385c8ae26c328c5f7beda24.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Cash Ransomware.html
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0x40,0x10c,0x7ffe916246f8,0x7ffe91624708,0x7ffe91624718
3⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
3⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
3⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
3⤵
PID:1780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
3⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
3⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
3⤵
PID:304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
3⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
3⤵
PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
3⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16959879949379496082,7329784368107337610,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata.CashRansomware
Filesize
16B

MD5
285e937c4d10e19c4db6996dd5e4e710

SHA1
aabdaefe67c204d4ab2d504536f684164b5e344a

SHA256
a9d7abddd264cf4f0317c5587a8b292b104aab6f7dd361de805c7fbbcfcc37a8

SHA512
ace2da1c9ae3fe92965e36ac4b1cd7bb30297d9f4aea9a571ff9feef8ea277c7c58a639a42de80e655a127bb1c5406c6dd342b3dcaa88d3c72483f051be9cade

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT.CashRansomware
Filesize
32B

MD5
c5c13b30b938bda79fc1ede70b735932

SHA1
f62105a22c62559f0d278e3d60cc71590566e540

SHA256
9034d064caa2ba91eb1f5ef050636c41ae1a76223ee8acbebfefeda504444e7b

SHA512
e810eb570597652ba6b37738627c84c6764bbcd8800b336171f833eb59802bad13eafd572db35ce749a0ec0f63b21cb70666c409cce9aa340da05fea4c7a491a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001.CashRansomware
Filesize
48B

MD5
94c5ea49673a19f28b2e6b66927c181b

SHA1
5f24445d603293caade4ec1968014f85eb16c0e1

SHA256
be1dab21ef008a04c98a50e50586f0e386cf9bd68cc22e0af20f3edda83b49a9

SHA512
e01320933b3f56150c2b9357c30a93af75e5079ff078e4621cfaa7b5fdf12ad731fe2bab3a0710326e4e959d84ca01f5ed03c82111d1f3e3ed416f02af2b40c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2.CashRansomware
Filesize
8KB

MD5
d43a62ba79f5afbcc996ab2a48dab7c5

SHA1
f72b6c2bc8a0972c2b3343abac8e8f567ae8cc69

SHA256
8ab90244f14deccbf7404e1b0bdcb26ecb29614f77a59add7523166d7e740865

SHA512
dde7fc0856302b1e453e5d0674db3a320a8317d8b1dc21470d75d494e43926d06fd8163e7a404096099274edeea740566faf1cf5dbdfdfff02a27600cf717dbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.CashRansomware
Filesize
8KB

MD5
215ef081a3db23ad0a83992afdbbb88d

SHA1
71fbd91f556413538f441973128ff76eb4b7f5a0

SHA256
296e8e95a517f079d7b0a5aa6abb2ff3b57a18afe0dddde72ae7f570ce9e3fb7

SHA512
92267d41e6ad1187b5b6fc9afc72aa79b4f3112d99fa5c323ddd55a28f69b0015ec9dbb4bd628ee302dcb4c32481e15cce22b4264cea1f2675d20e07bcd7bd4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.CashRansomware
Filesize
264KB

MD5
fabcc831d9c1f1303ecb16bf8903f788

SHA1
92d3b666ad6e46809e55fa35b8e9799ce46518df

SHA256
1172630f90ad3c00c1712be7da5643133f5f00110bf34e5619068f400bc684a1

SHA512
9eee0e54c9a5cd71d3fa1cae59d447325b596921bd4b4fc60825e7a47f56b32026c2aa90173b71d882d10ccd0568d4de6d234f536003a365fed4cf31544caaa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.CashRansomware
Filesize
8KB

MD5
926d3b78c7e8af37c0718ba1cea379bc

SHA1
c3c7721d628e7d76a15e296c0672989b07bbd765

SHA256
9df3e59fe271960ab84ed6503aa8a323f7584b314c31b9acd0b1d1210375c4ae

SHA512
930f69fe3e9fe0012d69b0397742840ce85fb2413717f630b2f4945cc429f748dc498169c8ee7ecd603a771956650a7504751fd081ef9d6292d377da54eba33b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
176B

MD5
4b0fdb42df7710656db54c391246153d

SHA1
76448462cca39b432c314f680ebb330258a28749

SHA256
72b128de5bd06d50af02c4113956687082280bd564ff6b5517e4bc466ae5d526

SHA512
f5681e8c75062df44e985069f51ebaf7f0cf0e10427b5dc4800e1c8af1d401816cc9bafad6157afcea9c85bf347540211332c273573c706632c290cbf90de067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
93bdac01d01a690c00a033a979baa888

SHA1
f3df29f403d8b9e5b814636a05d491d568b9acca

SHA256
0fedbc5a3e3b9b025751adce5578b8b23a877aa9cdfd5015af26a969ef021914

SHA512
139ae65ef28c3a97f2577e1e75fdfe802f97d90bf22fc29670b60d2a2fab03ed8efb43500453d2976e567408ef1d9ca56dd9645af708ce1ca81294f5d2fb5dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
51601b28bc1faf42cf19a2365bbfbfaa

SHA1
f07a8581e8301f775d6a09c9a8f636442baed107

SHA256
de89c090d46ffc9f03434471d8d861017fe25d4c46525b45e7b2c66eb77f36fa

SHA512
632cc59b93e818729bdb5e125251cdf758887e36a14f6c9e53140b8b21ea293c90ca7f65687a605f987c0fc9db4acef0145ef0162586009c52f4afec2478dfd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e478c059fba3f76783ff3b5922296cc7

SHA1
a3070f1e7b6b63d38f57e198d3adadf1fdc25b4e

SHA256
51a34eb9375cfc0f03bc14f023a7fbc35ce3adf69277224173b8f91a4eea2132

SHA512
570075f5dee430665dd41210a9acabb2861012e9b300cc77f347d321ee0aaad5867c009407efa7de2d537a0ece8d074e5f3f7a4d8bd90a1974fb4159eca52cfe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.CashRansomware
Filesize
8KB

MD5
cad5922d67fdc0820aa421d6bd2abb94

SHA1
f1066f410ebd7c952dde17441a272667ee500ba3

SHA256
42314a472047f4b1b778f4ff4764e34f784683705bac3bceed680e285c8559db

SHA512
647a05214c7dffc26c04532551cddf104bda755eb6c7a663ddf159737ec62acfe23eba1c8225c8638e012ea0679a155cc55cdda64882ae5d1e33bb4346c78991

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}.CashRansomware
Filesize
36KB

MD5
88453ff5bce30dee3884d95b49cd442e

SHA1
01a8462f925a72e2275901887e91ede58e9a4db1

SHA256
bce3cf032897c1b502a46024ebc0230cf25bac90d403d5d67d3e130938bf146b

SHA512
8c9dc6cdf2d2d5ac15a54455dcce4450dad9532e1ba0bf3b4ea7aaf8de55c9e0fbee7c4ba56c9a9dfc3756c67fef77f43a3c1d3d731b73c62c10315b3d08c7c5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.CashRansomware
Filesize
36KB

MD5
a06cb37df5f1cf7fa779a7244f520e45

SHA1
74845f39da5d72b524438481268675436c5f6d7b

SHA256
0413028d5e65b57cd4d1a9cd0e6d662afd3401f10a2f9e581fd995bc92daf182

SHA512
773a3a5fb54450d3a9fa54a15e917cd39abc448b119abbf459a8451064526353dd5283dde507a387085292e1e4110c106734f57afb622d703833a88b96e860b2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.1.filtertrie.intermediate.txt.CashRansomware
Filesize
16B

MD5
7a52df3b04fd2946fc35b275cf12e751

SHA1
71345f07ac15fd4668c2294dbf9cb85e60eb4197

SHA256
732df7dd5984e2ea6078cd9463863dc2382ece3f803dd5bb29f03d70ea4b5f3b

SHA512
54fa46c0efc03d24a63b7c12325b354acf3a1e1c10a8d65ce37d948c2f214eb03a1d6bd3ba706312c7bd2054e2d88a7086215600630219f4138235123134baa1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{5ad19b1b-600e-4a94-9f1d-df48f742e3e2}\0.2.filtertrie.intermediate.txt.CashRansomware
Filesize
16B

MD5
9295d3212b32453ed805c04c3ff5e446

SHA1
614ea01f4c508f2c942818e6392303155929858a

SHA256
9ce5fb9d7444ca44da418ac270bd63da7f82360e6a18423f9bd61c0aba129661

SHA512
6ab02bd2ec5a4793561393f307f6b44ffc7bb25317d3d943b2ab96a953723ecaa0a14e6dd8931222825d205d5d92d8037a132f916dd1254b11eaece7c6a934a7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596439083295209.txt.CashRansomware
Filesize
77KB

MD5
d33d1a99f555f84ab91b7f9655d41d9e

SHA1
82430b70e8f847c3be83b3199db3fe5e7b719203

SHA256
f744a66de957bb79606b4799b572a8ee8517d9fa40d166f26b17c40feadcf104

SHA512
19ab95b719ed5c7f2ca7c4b2326b5bcb85cfe0390b58fd055222d8bc9f5f48f0ff68a1b58e43800f932489a75bb459b34152031a586f9afd98728266b42a1a21

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596440479376967.txt.CashRansomware
Filesize
47KB

MD5
9757684e7c4978fa860ada59a1bbda82

SHA1
2933698f0696a6f5e1a051c1ec3a304ac87fac25

SHA256
b2396519b7112e9f5498fd243c7d2b232d618c11de0bf3e7dc4ffdb48a0bcd80

SHA512
c67abd39f336554f8edd33f8575f4a1b91bd3987bdec30c153f64a7bc4a1d400f35496cd3d134dc846df5d538df825bdbac6c960c665ef1d14e32952d83c2bd2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596447864304096.txt.CashRansomware
Filesize
66KB

MD5
999f4f335d768e794b0e7ee55771ce03

SHA1
e3c88b2e3dd44462d65a65fc55ed6bf7648e86ad

SHA256
78bb2585e786ce2b2f2084e2fee75d3ab1dd345def1e7d9310a5f3e549196981

SHA512
3d731da0e53102861f858762c763285f9e304fee0a73cc83421179b5c62c4851cf02b50c2f942899ec7aedfb3bcb2c2943897a140fbabb3e6626fe3c7e78fc7d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596477626237069.txt.CashRansomware
Filesize
75KB

MD5
fe7b201a0339ad27e96443525bce2bac

SHA1
0e8792b31a9fa24c6a93a5ceb5689ff74c0f2bab

SHA256
c2af87a5178815239fca02025d1a30753f438189737c0082186e9e0cee4a7bac

SHA512
37b1e224d92bbf4d6ad757b68ea5dd8cbb882c5985b6a775621e888c2b82e1f94a53d0330ef75987b7ce3b513f9ee76f63775c014dafb69ac85687d3ad3e66b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctEED4.tmp.CashRansomware
Filesize
63KB

MD5
abd11e03073ea4d28ce1fa007fd80c98

SHA1
54fc6b6e7191cfb2301b33a300b457923847f7e7

SHA256
784ae182936a13b5944089c4237aa737e599ed1e0970716beb7ca233c17fe924

SHA512
37859b7e05961333d49983207a2501e9ef7e70dd8e1f930d2f9130fc094947e66095afe4b187b961ea1c3eae3a498508a6e651736219442b56bada0e1debc5e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
Filesize
48KB

MD5
c35ec1ee42ebe25ad1803c38604c4cfd

SHA1
2d51e3670600df89932931f7f26b207245a10ca7

SHA256
8f63d37abd6b227f11b688886d5942abf44954a5951cc8b0c6f09e9e47b64afe

SHA512
26816914403c00a6e20021048440abd713671c000f6fbf6a3c711fefdef26fc8db826db2e2d445ddfb1e00c21225f6ceddb5aab867b8d9e2d5c76dc0a3044232

Download Submit
C:\Users\Admin\Desktop\Cash Ransomware.html
Filesize
9KB

MD5
b38d3abcc3a30f095eaecfdd9f62e033

SHA1
f9960cb04896c229fdf6438efa51b4afd98f526f

SHA256
579374af17d7b9f972e9efcb761e0a8f88ef6d44dce53d56d0512d16c4728b9d

SHA512
46968c3951daa569dfecf75ba95a6694d525cbbd1883070189896ab270bb561cb2d00d7d38168405da1f78695f95cc481d28bcbff74be53d9a89822a09595768

Download Submit
\??\pipe\LOCAL\crashpad_3172_IFRPZWVCWUDBAQMJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2256-1720-0x00007FFE97113000-0x00007FFE97115000-memory.dmp

Filesize
8KB

Download
memory/2256-2-0x00007FFE97110000-0x00007FFE97BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-1686-0x00007FFE97110000-0x00007FFE97BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-0-0x00007FFE97113000-0x00007FFE97115000-memory.dmp

Filesize
8KB

Download
memory/2256-1689-0x00000192F0560000-0x00000192F0A88000-memory.dmp

Filesize
5.2MB

Download
memory/2256-1685-0x00007FFE97110000-0x00007FFE97BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-1731-0x00007FFE97110000-0x00007FFE97BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-1688-0x00000192EFE60000-0x00000192F0022000-memory.dmp

Filesize
1.8MB

Download
memory/2256-1687-0x00007FFE97110000-0x00007FFE97BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-1750-0x00007FFE97110000-0x00007FFE97BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-1751-0x00007FFE97110000-0x00007FFE97BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-1752-0x00007FFE97110000-0x00007FFE97BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2256-1-0x00000192CEBF0000-0x00000192CEE9E000-memory.dmp

Filesize
2.7MB

Download