teslacrypt | dd754c7e866babc27f01d9e9b3bbac680dcc3e83b8a748d39e026b871052b527

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_0633631727771a19c3593b678268e8f9.exe
Size

276KB
MD5

0633631727771a19c3593b678268e8f9
SHA1

2c8af799af11e03abc5face54f3943c2b3071203
SHA256

dd754c7e866babc27f01d9e9b3bbac680dcc3e83b8a748d39e026b871052b527
SHA512

f705f51b7f49f51a13c4509909b80e7eaeecf2914867b41f42dd13f655ad1e815355366cb05b9a6093c1887dae569f204b9ca7ad5761a3f1952b3cbc9b31645b
SSDEEP

6144:wL+ROMHXZ99JX2WngMNSYZh1r0CLf2dWsLf2EUOH9:wQ7J9PgMN7LsqEUO

Score

10^/10

teslacrypt defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+kiuqh.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So , there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E751D88A4353D3A6 2 - http://gfkuwflbhsjdabnu4nfukerfqwlfwr4rw.ringbalor.com/E751D88A4353D3A6 3 - http://oehknf74ohqlfnpq9rhfgcq93g.hateflux.com/E751D88A4353D3A6 If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/E751D88A4353D3A6 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E751D88A4353D3A6 http://gfkuwflbhsjdabnu4nfukerfqwlfwr4rw.ringbalor.com/E751D88A4353D3A6 http://oehknf74ohqlfnpq9rhfgcq93g.hateflux.com/E751D88A4353D3A6 Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/E751D88A4353D3A6

URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E751D88A4353D3A6

http://gfkuwflbhsjdabnu4nfukerfqwlfwr4rw.ringbalor.com/E751D88A4353D3A6

http://oehknf74ohqlfnpq9rhfgcq93g.hateflux.com/E751D88A4353D3A6

http://xlowfznrg4wf7dli.ONION/E751D88A4353D3A6

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (867) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	VirusShare_0633631727771a19c3593b678268e8f9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	xaukbhvmvfan.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe

Executes dropped EXE 2 IoCs

pid	Process
4936	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpfurcp = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\xaukbhvmvfan.exe"	xaukbhvmvfan.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3976 set thread context of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 4936 set thread context of 4608	4936	xaukbhvmvfan.exe	93

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\uk-UA\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-100_contrast-white.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\et-EE\View3d\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-150.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-150.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-36.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-100.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-100.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_contrast-black.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-400_contrast-white.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-72_altform-unplated_contrast-black.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-unplated.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-100.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupSmallTile.scale-200.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-150.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Telemetry\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TinyTile.scale-125_contrast-white.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\AppSplashScreen.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\LargeTile.scale-200.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_contrast-black.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\LargeTile.scale-200.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\offlineStrings.js	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ms-logo-no-text.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-256.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\lua\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-20_contrast-white.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square310x310Logo.scale-125.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\_ReCoVeRy_+kiuqh.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\StoreLogo.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-36_contrast-white.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\_ReCoVeRy_+kiuqh.txt	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\_ReCoVeRy_+kiuqh.html	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteWideTile.scale-200.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-24_altform-unplated.png	xaukbhvmvfan.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MissingAlbumArt.jpg	xaukbhvmvfan.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\xaukbhvmvfan.exe	VirusShare_0633631727771a19c3593b678268e8f9.exe
File opened for modification	C:\Windows\xaukbhvmvfan.exe	VirusShare_0633631727771a19c3593b678268e8f9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	xaukbhvmvfan.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2772	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe
4608	xaukbhvmvfan.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	VirusShare_0633631727771a19c3593b678268e8f9.exe
Token: SeDebugPrivilege	4608	xaukbhvmvfan.exe
Token: SeIncreaseQuotaPrivilege	1332	WMIC.exe
Token: SeSecurityPrivilege	1332	WMIC.exe
Token: SeTakeOwnershipPrivilege	1332	WMIC.exe
Token: SeLoadDriverPrivilege	1332	WMIC.exe
Token: SeSystemProfilePrivilege	1332	WMIC.exe
Token: SeSystemtimePrivilege	1332	WMIC.exe
Token: SeProfSingleProcessPrivilege	1332	WMIC.exe
Token: SeIncBasePriorityPrivilege	1332	WMIC.exe
Token: SeCreatePagefilePrivilege	1332	WMIC.exe
Token: SeBackupPrivilege	1332	WMIC.exe
Token: SeRestorePrivilege	1332	WMIC.exe
Token: SeShutdownPrivilege	1332	WMIC.exe
Token: SeDebugPrivilege	1332	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1332	WMIC.exe
Token: SeRemoteShutdownPrivilege	1332	WMIC.exe
Token: SeUndockPrivilege	1332	WMIC.exe
Token: SeManageVolumePrivilege	1332	WMIC.exe
Token: 33	1332	WMIC.exe
Token: 34	1332	WMIC.exe
Token: 35	1332	WMIC.exe
Token: 36	1332	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1332	WMIC.exe
Token: SeSecurityPrivilege	1332	WMIC.exe
Token: SeTakeOwnershipPrivilege	1332	WMIC.exe
Token: SeLoadDriverPrivilege	1332	WMIC.exe
Token: SeSystemProfilePrivilege	1332	WMIC.exe
Token: SeSystemtimePrivilege	1332	WMIC.exe
Token: SeProfSingleProcessPrivilege	1332	WMIC.exe
Token: SeIncBasePriorityPrivilege	1332	WMIC.exe
Token: SeCreatePagefilePrivilege	1332	WMIC.exe
Token: SeBackupPrivilege	1332	WMIC.exe
Token: SeRestorePrivilege	1332	WMIC.exe
Token: SeShutdownPrivilege	1332	WMIC.exe
Token: SeDebugPrivilege	1332	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1332	WMIC.exe
Token: SeRemoteShutdownPrivilege	1332	WMIC.exe
Token: SeUndockPrivilege	1332	WMIC.exe
Token: SeManageVolumePrivilege	1332	WMIC.exe
Token: 33	1332	WMIC.exe
Token: 34	1332	WMIC.exe
Token: 35	1332	WMIC.exe
Token: 36	1332	WMIC.exe
Token: SeBackupPrivilege	4188	vssvc.exe
Token: SeRestorePrivilege	4188	vssvc.exe
Token: SeAuditPrivilege	4188	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2908	WMIC.exe
Token: SeSecurityPrivilege	2908	WMIC.exe
Token: SeTakeOwnershipPrivilege	2908	WMIC.exe
Token: SeLoadDriverPrivilege	2908	WMIC.exe
Token: SeSystemProfilePrivilege	2908	WMIC.exe
Token: SeSystemtimePrivilege	2908	WMIC.exe
Token: SeProfSingleProcessPrivilege	2908	WMIC.exe
Token: SeIncBasePriorityPrivilege	2908	WMIC.exe
Token: SeCreatePagefilePrivilege	2908	WMIC.exe
Token: SeBackupPrivilege	2908	WMIC.exe
Token: SeRestorePrivilege	2908	WMIC.exe
Token: SeShutdownPrivilege	2908	WMIC.exe
Token: SeDebugPrivilege	2908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2908	WMIC.exe
Token: SeRemoteShutdownPrivilege	2908	WMIC.exe
Token: SeUndockPrivilege	2908	WMIC.exe
Token: SeManageVolumePrivilege	2908	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 3976 wrote to memory of 4424	3976	VirusShare_0633631727771a19c3593b678268e8f9.exe	89
PID 4424 wrote to memory of 4936	4424	VirusShare_0633631727771a19c3593b678268e8f9.exe	90
PID 4424 wrote to memory of 4936	4424	VirusShare_0633631727771a19c3593b678268e8f9.exe	90
PID 4424 wrote to memory of 4936	4424	VirusShare_0633631727771a19c3593b678268e8f9.exe	90
PID 4424 wrote to memory of 1728	4424	VirusShare_0633631727771a19c3593b678268e8f9.exe	91
PID 4424 wrote to memory of 1728	4424	VirusShare_0633631727771a19c3593b678268e8f9.exe	91
PID 4424 wrote to memory of 1728	4424	VirusShare_0633631727771a19c3593b678268e8f9.exe	91
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4936 wrote to memory of 4608	4936	xaukbhvmvfan.exe	93
PID 4608 wrote to memory of 1332	4608	xaukbhvmvfan.exe	94
PID 4608 wrote to memory of 1332	4608	xaukbhvmvfan.exe	94
PID 4608 wrote to memory of 2772	4608	xaukbhvmvfan.exe	99
PID 4608 wrote to memory of 2772	4608	xaukbhvmvfan.exe	99
PID 4608 wrote to memory of 2772	4608	xaukbhvmvfan.exe	99
PID 4608 wrote to memory of 3976	4608	xaukbhvmvfan.exe	100
PID 4608 wrote to memory of 3976	4608	xaukbhvmvfan.exe	100
PID 3976 wrote to memory of 2552	3976	msedge.exe	101
PID 3976 wrote to memory of 2552	3976	msedge.exe	101
PID 4608 wrote to memory of 2908	4608	xaukbhvmvfan.exe	102
PID 4608 wrote to memory of 2908	4608	xaukbhvmvfan.exe	102
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104
PID 3976 wrote to memory of 4748	3976	msedge.exe	104

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xaukbhvmvfan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	xaukbhvmvfan.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_0633631727771a19c3593b678268e8f9.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_0633631727771a19c3593b678268e8f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\VirusShare_0633631727771a19c3593b678268e8f9.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_0633631727771a19c3593b678268e8f9.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\xaukbhvmvfan.exe
    C:\Windows\xaukbhvmvfan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\xaukbhvmvfan.exe
      C:\Windows\xaukbhvmvfan.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4608
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:2772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbce6f46f8,0x7ffbce6f4708,0x7ffbce6f4718
        6⤵
        
        PID:2552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        6⤵
        
        PID:4748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        6⤵
        
        PID:4848
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 /prefetch:8
        6⤵
        
        PID:3888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
        6⤵
        
        PID:4072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
        6⤵
        
        PID:4888
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
        6⤵
        
        PID:2104
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
        6⤵
        
        PID:4472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
        6⤵
        
        PID:4988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
        6⤵
        
        PID:5068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
        6⤵
        
        PID:1060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15372878034694645776,14154857247865671368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
        6⤵
        
        PID:4340
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\XAUKBH~1.EXE
        5⤵
        
        PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    PID:1728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+kiuqh.html

Filesize
11KB

MD5
152c9c281f678503ffc0024d03911f82

SHA1
082f847d0bfd85be3841293173dcee20d2981b44

SHA256
b091f451e236e8e03095aef6b4299515f34b1e9cdb30bf9c177546d0df79423f

SHA512
5f411964853ae91c37372d14922176d6ede7d8724f36671c3d1f5de52750a7054bcf73b75db1adaf05e9f7e70bbf96a6ad14f18594dc3d81b988658a4bed422b

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+kiuqh.png

Filesize
65KB

MD5
c84fe868abf3541c4d5af2332df5fb71

SHA1
1fbbdad1cf1027dabc2cb665062683b20d041fcd

SHA256
d0699c2d797be413fa38e55588466c641b5ce831e3f52be73dbb686638afe0a2

SHA512
5616fcc2f49c43d0235421b26745c12ba3f37c976af2b93de23e42deac62a369faa1c5123ffd0e3bb2ab9980b1192419cf8554945c2b257becafd8e34ee9d3a0

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+kiuqh.txt

Filesize
1KB

MD5
e2752a7e7a8830ee7918dd4eecef4aac

SHA1
1377fdf5978a4a1ae7fbe7ca7aa53de4a74f9735

SHA256
adbd81a7f55d8c0b18fc12d7669aa5297b5f28f6fdd1576114f41e0f855aa2f2

SHA512
ee705ab8ad9a7b40f2f5eb13b486a3e444d05f7ea9ed9f04af155bfd0b4c9fc4bf96dafc506ce737344a600200ad32b4e56c7b50586b4544d33d2737df06628a

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
79d153990bab2b719c30967106fb79b2

SHA1
828bec6d6dd8ce7d5ce60c591abf6057bc2c476f

SHA256
967341c187a2c660a6d086e51d41d99e0cb4786923a9c13b5f375359f69575cf

SHA512
32354b729f2cf2fd8d631ec191acc825092f118980dc9349deb0caf94b4c2f7bc34c99cd01268f036ba842b3c222555cce0d4866057f5a6fafcb58b5fe8a1cf4

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
f9e8405172823301bf18be86e82a90cc

SHA1
4777966cdad5fab856399f283b59fac26bf9856e

SHA256
b1222f12a82336f579e3a62229bc368b30549ddfa440e998a81de2ffec17726d

SHA512
f7b8ed0150ff3effb26a8a26db754564b29eb23f354c98db2868410712b5a106b6d2753399bdf913b3fe9591be8a9799db44e82c7f7b275a878d184c88783ce3

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
8ad5dcbd1909625e70225a9c94779d15

SHA1
9d81feb8969183a262d4bf292b12d4b5474f7401

SHA256
8510f6a0e077107ad6cdf4a898488bb3d85f71a75b7845f5db55c8b37ce7709a

SHA512
0430ce640f3c5479ddae93937d5f00be9fb05fcf1bc090d62de69e857a816190907f461512c2137f2e5f789cbb11104aaf622d4ea4661c54be687b87496eb739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
74ce9f2e360ffa43acb78da176673d19

SHA1
27fdba92be41448c03ffdca153679d0ef164adb2

SHA256
53449c30b304dbea8416ff1045aa975ad821961d638538b87398823722535e83

SHA512
7dd66549b8741b3bbb3a5d2b0fa83d902127f8cb058580a6be1b964cd80aab1ff251d6141eef14e7a1e042ae87ea7e71a8fc3cebedc8a5302970e06e0195c41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea1a17fd12799c277486aeffaf149d28

SHA1
5609c97abf1436f5b1362cfbe9eff08fe3097bff

SHA256
e72cbe5a85a38a44f532f1b1bbee2ecdfed5878de6f550343dbaa8cb4856eaa9

SHA512
604ec48e748874a4ddc391d7d03b8dd060645a2b0bcddaddc8c06de3b81864b933928429da8d5932c64150c1f95c323da73541e5376e05b9fa178505e0df01ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9aab464b1bd8ef9bdd138b3ec30b5514

SHA1
a788080f2b1641e915e8c9318738efa4958434d2

SHA256
d56d4c41dfb3bf7c8807871cce931069e4c5adb4fba3389a8d427deb2f1ec23e

SHA512
f2507220f4ba0cde18a04fca48cf92411ebb1a2b5ba703a4ce8c997436d8c9a78ca7a323e0f49ddad084f2e3feb2ca2b847f9be3326bf6e230a979319aff0ded

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586097090598174.txt

Filesize
75KB

MD5
663dca385278c5691fe54692607f9251

SHA1
6eeef13583082ab331acecba8decbccf9ec16bcb

SHA256
f8a7ff372b4742b8bad6704a315451d4cee41542cf8dd50a89b77791a640985a

SHA512
450461867263c3ff7d88b4fe3ec716bf8cc99329778bfcc5335ca58b6daf2e78d3efcbba22d2bbe2144920f27ef1acd205003bc4b2727e51c1f29f989daa0f39

Download Submit
C:\Windows\xaukbhvmvfan.exe

Filesize
276KB

MD5
0633631727771a19c3593b678268e8f9

SHA1
2c8af799af11e03abc5face54f3943c2b3071203

SHA256
dd754c7e866babc27f01d9e9b3bbac680dcc3e83b8a748d39e026b871052b527

SHA512
f705f51b7f49f51a13c4509909b80e7eaeecf2914867b41f42dd13f655ad1e815355366cb05b9a6093c1887dae569f204b9ca7ad5761a3f1952b3cbc9b31645b

Download Submit
memory/3976-3-0x0000000000630000-0x0000000000635000-memory.dmp

Filesize
20KB

Download
memory/3976-0-0x0000000000630000-0x0000000000635000-memory.dmp

Filesize
20KB

Download
memory/3976-1-0x0000000000630000-0x0000000000635000-memory.dmp

Filesize
20KB

Download
memory/4424-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4424-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4424-4-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4424-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4424-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-7916-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-7868-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-10368-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-10369-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-10377-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-10378-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-4662-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-2551-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-24-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-22-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-20-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-10447-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4608-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4936-12-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download