cerber | db2f389b5566822f8cecb27b989920f16137e82b54b446868d01f73af23f5bfa

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{37345610-6239-7F1B-59F5-99D852E1D980}\\systeminfo.exe\""	VirusShare_270b70bad151a515136f553e5bc880ac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{37345610-6239-7F1B-59F5-99D852E1D980}\\systeminfo.exe\""	systeminfo.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	systeminfo.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\systeminfo.lnk	VirusShare_270b70bad151a515136f553e5bc880ac.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\systeminfo.lnk	systeminfo.exe

Executes dropped EXE 1 IoCs

pid	Process
1688	systeminfo.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systeminfo = "\"C:\\Users\\Admin\\AppData\\Roaming\\{37345610-6239-7F1B-59F5-99D852E1D980}\\systeminfo.exe\""	VirusShare_270b70bad151a515136f553e5bc880ac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\systeminfo = "\"C:\\Users\\Admin\\AppData\\Roaming\\{37345610-6239-7F1B-59F5-99D852E1D980}\\systeminfo.exe\""	VirusShare_270b70bad151a515136f553e5bc880ac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systeminfo = "\"C:\\Users\\Admin\\AppData\\Roaming\\{37345610-6239-7F1B-59F5-99D852E1D980}\\systeminfo.exe\""	systeminfo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\systeminfo = "\"C:\\Users\\Admin\\AppData\\Roaming\\{37345610-6239-7F1B-59F5-99D852E1D980}\\systeminfo.exe\""	systeminfo.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ipinfo.io

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp777D.bmp"	systeminfo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
1688	systeminfo.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4228	vssadmin.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3176	taskkill.exe
2160	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{37345610-6239-7F1B-59F5-99D852E1D980}\\systeminfo.exe\""	systeminfo.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop	VirusShare_270b70bad151a515136f553e5bc880ac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{37345610-6239-7F1B-59F5-99D852E1D980}\\systeminfo.exe\""	VirusShare_270b70bad151a515136f553e5bc880ac.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\Desktop	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	systeminfo.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2880	PING.EXE
5056	PING.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
1688	systeminfo.exe
4672	msedge.exe
4672	msedge.exe
2280	msedge.exe
2280	msedge.exe
628	identity_helper.exe
628	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	VirusShare_270b70bad151a515136f553e5bc880ac.exe
Token: SeDebugPrivilege	1688	systeminfo.exe
Token: SeDebugPrivilege	3176	taskkill.exe
Token: SeBackupPrivilege	4832	vssvc.exe
Token: SeRestorePrivilege	4832	vssvc.exe
Token: SeAuditPrivilege	4832	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4740	wmic.exe
Token: SeSecurityPrivilege	4740	wmic.exe
Token: SeTakeOwnershipPrivilege	4740	wmic.exe
Token: SeLoadDriverPrivilege	4740	wmic.exe
Token: SeSystemProfilePrivilege	4740	wmic.exe
Token: SeSystemtimePrivilege	4740	wmic.exe
Token: SeProfSingleProcessPrivilege	4740	wmic.exe
Token: SeIncBasePriorityPrivilege	4740	wmic.exe
Token: SeCreatePagefilePrivilege	4740	wmic.exe
Token: SeBackupPrivilege	4740	wmic.exe
Token: SeRestorePrivilege	4740	wmic.exe
Token: SeShutdownPrivilege	4740	wmic.exe
Token: SeDebugPrivilege	4740	wmic.exe
Token: SeSystemEnvironmentPrivilege	4740	wmic.exe
Token: SeRemoteShutdownPrivilege	4740	wmic.exe
Token: SeUndockPrivilege	4740	wmic.exe
Token: SeManageVolumePrivilege	4740	wmic.exe
Token: 33	4740	wmic.exe
Token: 34	4740	wmic.exe
Token: 35	4740	wmic.exe
Token: 36	4740	wmic.exe
Token: SeIncreaseQuotaPrivilege	4740	wmic.exe
Token: SeSecurityPrivilege	4740	wmic.exe
Token: SeTakeOwnershipPrivilege	4740	wmic.exe
Token: SeLoadDriverPrivilege	4740	wmic.exe
Token: SeSystemProfilePrivilege	4740	wmic.exe
Token: SeSystemtimePrivilege	4740	wmic.exe
Token: SeProfSingleProcessPrivilege	4740	wmic.exe
Token: SeIncBasePriorityPrivilege	4740	wmic.exe
Token: SeCreatePagefilePrivilege	4740	wmic.exe
Token: SeBackupPrivilege	4740	wmic.exe
Token: SeRestorePrivilege	4740	wmic.exe
Token: SeShutdownPrivilege	4740	wmic.exe
Token: SeDebugPrivilege	4740	wmic.exe
Token: SeSystemEnvironmentPrivilege	4740	wmic.exe
Token: SeRemoteShutdownPrivilege	4740	wmic.exe
Token: SeUndockPrivilege	4740	wmic.exe
Token: SeManageVolumePrivilege	4740	wmic.exe
Token: 33	4740	wmic.exe
Token: 34	4740	wmic.exe
Token: 35	4740	wmic.exe
Token: 36	4740	wmic.exe
Token: 33	4000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4000	AUDIODG.EXE
Token: SeDebugPrivilege	2160	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1688	2852	VirusShare_270b70bad151a515136f553e5bc880ac.exe	85
PID 2852 wrote to memory of 1688	2852	VirusShare_270b70bad151a515136f553e5bc880ac.exe	85
PID 2852 wrote to memory of 1688	2852	VirusShare_270b70bad151a515136f553e5bc880ac.exe	85
PID 2852 wrote to memory of 1724	2852	VirusShare_270b70bad151a515136f553e5bc880ac.exe	86
PID 2852 wrote to memory of 1724	2852	VirusShare_270b70bad151a515136f553e5bc880ac.exe	86
PID 2852 wrote to memory of 1724	2852	VirusShare_270b70bad151a515136f553e5bc880ac.exe	86
PID 1724 wrote to memory of 3176	1724	cmd.exe	89
PID 1724 wrote to memory of 3176	1724	cmd.exe	89
PID 1724 wrote to memory of 3176	1724	cmd.exe	89
PID 1688 wrote to memory of 4228	1688	systeminfo.exe	88
PID 1688 wrote to memory of 4228	1688	systeminfo.exe	88
PID 1724 wrote to memory of 2880	1724	cmd.exe	94
PID 1724 wrote to memory of 2880	1724	cmd.exe	94
PID 1724 wrote to memory of 2880	1724	cmd.exe	94
PID 1688 wrote to memory of 4740	1688	systeminfo.exe	95
PID 1688 wrote to memory of 4740	1688	systeminfo.exe	95
PID 1688 wrote to memory of 2280	1688	systeminfo.exe	106
PID 1688 wrote to memory of 2280	1688	systeminfo.exe	106
PID 2280 wrote to memory of 3884	2280	msedge.exe	107
PID 2280 wrote to memory of 3884	2280	msedge.exe	107
PID 1688 wrote to memory of 2104	1688	systeminfo.exe	108
PID 1688 wrote to memory of 2104	1688	systeminfo.exe	108
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 2304	2280	msedge.exe	109
PID 2280 wrote to memory of 4672	2280	msedge.exe	110
PID 2280 wrote to memory of 4672	2280	msedge.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe"
1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Roaming\{37345610-6239-7F1B-59F5-99D852E1D980}\systeminfo.exe
  "C:\Users\Admin\AppData\Roaming\{37345610-6239-7F1B-59F5-99D852E1D980}\systeminfo.exe"
  2⤵
  - Adds policy Run key to start application
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Gathers system information
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4228
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbba9d46f8,0x7ffbba9d4708,0x7ffbba9d4718
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4380 /prefetch:8
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4380 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10245636141703910674,17714333507217973993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
      4⤵
      PID:3012
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cerberhhyed5frqa.vmfu48.win/79F8-4649-3DCA-0073-1293
    3⤵
    PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbba9d46f8,0x7ffbba9d4708,0x7ffbba9d4718
      4⤵
      PID:4700
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
    3⤵
    PID:32
- - C:\Windows\system32\cmd.exe
    /d /c taskkill /t /f /im "systeminfo.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{37345610-6239-7F1B-59F5-99D852E1D980}\systeminfo.exe" > NUL
    3⤵
    PID:2016
  - - C:\Windows\system32\taskkill.exe
      taskkill /t /f /im "systeminfo.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2160
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5056
- C:\Windows\SysWOW64\cmd.exe
  /d /c taskkill /t /f /im "VirusShare_270b70bad151a515136f553e5bc880ac.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_270b70bad151a515136f553e5bc880ac.exe" > NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /t /f /im "VirusShare_270b70bad151a515136f553e5bc880ac.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x2c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery