teslacrypt | 8506824ad4a9aabf540bbf58741412448178b846e540fbbfdf2a4e48acfe46da

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_09b500283366eafb809963ae3341e9c0.exe
Size

336KB
MD5

09b500283366eafb809963ae3341e9c0
SHA1

628610489c41e78617f4e51d0d0143a07b245f85
SHA256

8506824ad4a9aabf540bbf58741412448178b846e540fbbfdf2a4e48acfe46da
SHA512

7ecb3ed388e2866cbb0331d50d910ce3810f8b9bc1ece963e2cc67c5eaff017d2109e7ccb9d022b8960f78cca243c36bbdb29e0f78fdfc32a78cf2daea6ea796
SSDEEP

6144:r1w0U6D6x4kyjf+g0uc2RTqWmx7Ikw9NShXvSmk2OpXaP/EBySkQ4:ri0Uu6ikyjcuk5y0hXaxpKkB

Score

10^/10

teslacrypt defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+oaocn.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/FB64F52CF0EB942 2. http://tes543berda73i48fsdfsd.keratadze.at/FB64F52CF0EB942 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/FB64F52CF0EB942 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/FB64F52CF0EB942 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/FB64F52CF0EB942 http://tes543berda73i48fsdfsd.keratadze.at/FB64F52CF0EB942 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/FB64F52CF0EB942 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/FB64F52CF0EB942

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/FB64F52CF0EB942

http://tes543berda73i48fsdfsd.keratadze.at/FB64F52CF0EB942

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/FB64F52CF0EB942

http://xlowfznrg4wf7dli.ONION/FB64F52CF0EB942

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (880) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

VirusShare_09b500283366eafb809963ae3341e9c0.exepjjsimvudcyr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	VirusShare_09b500283366eafb809963ae3341e9c0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	pjjsimvudcyr.exe

Drops startup file 6 IoCs

Processes:

pjjsimvudcyr.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+oaocn.html	pjjsimvudcyr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+oaocn.html	pjjsimvudcyr.exe

Executes dropped EXE 2 IoCs

Processes:

pjjsimvudcyr.exepjjsimvudcyr.exe

pid process

1728 pjjsimvudcyr.exe
740 pjjsimvudcyr.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1728	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

pjjsimvudcyr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkjxmiiuqhoy = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\pjjsimvudcyr.exe\""	pjjsimvudcyr.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

VirusShare_09b500283366eafb809963ae3341e9c0.exepjjsimvudcyr.exe

description	pid	process	target process
PID 4796 set thread context of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 1728 set thread context of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe

Drops file in Program Files directory 64 IoCs

Processes:

pjjsimvudcyr.exe

description	ioc	process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\IncomingCallBrandingImage.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoDev.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageWideTile.scale-125.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+oaocn.html	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-100.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\8px.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-100.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-colorize.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-lightunplated.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Text\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\Recovery+oaocn.html	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+oaocn.html	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-150_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageLargeTile.scale-400.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-150_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-200.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-150.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-100.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_altform-unplated.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteMediumTile.scale-100.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch-Dark.scale-100.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\Recovery+oaocn.html	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-48_altform-unplated.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Recovery+oaocn.html	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-400_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-20_contrast-black.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\snooze.contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MediumTile.scale-100_contrast-black.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-30_altform-unplated.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_contrast-black.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_altform-unplated_contrast-black.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-100_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Lighting.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Retail\guest.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\5.jpg	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_4.m4a	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\Recovery+oaocn.html	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\THMBNAIL.PNG	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\am-ET\View3d\Recovery+oaocn.html	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uz-Latn-UZ\View3d\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\Recovery+oaocn.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-150.png	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\Recovery+oaocn.html	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\Recovery+oaocn.txt	pjjsimvudcyr.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_contrast-white.png	pjjsimvudcyr.exe

Drops file in Windows directory 2 IoCs

Processes:

VirusShare_09b500283366eafb809963ae3341e9c0.exe

description	ioc	process
File opened for modification	C:\Windows\pjjsimvudcyr.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
File created	C:\Windows\pjjsimvudcyr.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

pjjsimvudcyr.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings pjjsimvudcyr.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3100 NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	pjjsimvudcyr.exe

pid	process
3100	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pjjsimvudcyr.exe

pid	process
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe
740	pjjsimvudcyr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3988 msedge.exe
3988 msedge.exe
3988 msedge.exe
3988 msedge.exe
3988 msedge.exe
3988 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

VirusShare_09b500283366eafb809963ae3341e9c0.exepjjsimvudcyr.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	5004	VirusShare_09b500283366eafb809963ae3341e9c0.exe
Token: SeDebugPrivilege	740	pjjsimvudcyr.exe
Token: SeIncreaseQuotaPrivilege	4904	WMIC.exe
Token: SeSecurityPrivilege	4904	WMIC.exe
Token: SeTakeOwnershipPrivilege	4904	WMIC.exe
Token: SeLoadDriverPrivilege	4904	WMIC.exe
Token: SeSystemProfilePrivilege	4904	WMIC.exe
Token: SeSystemtimePrivilege	4904	WMIC.exe
Token: SeProfSingleProcessPrivilege	4904	WMIC.exe
Token: SeIncBasePriorityPrivilege	4904	WMIC.exe
Token: SeCreatePagefilePrivilege	4904	WMIC.exe
Token: SeBackupPrivilege	4904	WMIC.exe
Token: SeRestorePrivilege	4904	WMIC.exe
Token: SeShutdownPrivilege	4904	WMIC.exe
Token: SeDebugPrivilege	4904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4904	WMIC.exe
Token: SeRemoteShutdownPrivilege	4904	WMIC.exe
Token: SeUndockPrivilege	4904	WMIC.exe
Token: SeManageVolumePrivilege	4904	WMIC.exe
Token: 33	4904	WMIC.exe
Token: 34	4904	WMIC.exe
Token: 35	4904	WMIC.exe
Token: 36	4904	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4904	WMIC.exe
Token: SeSecurityPrivilege	4904	WMIC.exe
Token: SeTakeOwnershipPrivilege	4904	WMIC.exe
Token: SeLoadDriverPrivilege	4904	WMIC.exe
Token: SeSystemProfilePrivilege	4904	WMIC.exe
Token: SeSystemtimePrivilege	4904	WMIC.exe
Token: SeProfSingleProcessPrivilege	4904	WMIC.exe
Token: SeIncBasePriorityPrivilege	4904	WMIC.exe
Token: SeCreatePagefilePrivilege	4904	WMIC.exe
Token: SeBackupPrivilege	4904	WMIC.exe
Token: SeRestorePrivilege	4904	WMIC.exe
Token: SeShutdownPrivilege	4904	WMIC.exe
Token: SeDebugPrivilege	4904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4904	WMIC.exe
Token: SeRemoteShutdownPrivilege	4904	WMIC.exe
Token: SeUndockPrivilege	4904	WMIC.exe
Token: SeManageVolumePrivilege	4904	WMIC.exe
Token: 33	4904	WMIC.exe
Token: 34	4904	WMIC.exe
Token: 35	4904	WMIC.exe
Token: 36	4904	WMIC.exe
Token: SeBackupPrivilege	932	vssvc.exe
Token: SeRestorePrivilege	932	vssvc.exe
Token: SeAuditPrivilege	932	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1152	WMIC.exe
Token: SeSecurityPrivilege	1152	WMIC.exe
Token: SeTakeOwnershipPrivilege	1152	WMIC.exe
Token: SeLoadDriverPrivilege	1152	WMIC.exe
Token: SeSystemProfilePrivilege	1152	WMIC.exe
Token: SeSystemtimePrivilege	1152	WMIC.exe
Token: SeProfSingleProcessPrivilege	1152	WMIC.exe
Token: SeIncBasePriorityPrivilege	1152	WMIC.exe
Token: SeCreatePagefilePrivilege	1152	WMIC.exe
Token: SeBackupPrivilege	1152	WMIC.exe
Token: SeRestorePrivilege	1152	WMIC.exe
Token: SeShutdownPrivilege	1152	WMIC.exe
Token: SeDebugPrivilege	1152	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1152	WMIC.exe
Token: SeRemoteShutdownPrivilege	1152	WMIC.exe
Token: SeUndockPrivilege	1152	WMIC.exe
Token: SeManageVolumePrivilege	1152	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

VirusShare_09b500283366eafb809963ae3341e9c0.exeVirusShare_09b500283366eafb809963ae3341e9c0.exepjjsimvudcyr.exepjjsimvudcyr.exemsedge.exe

description	pid	process	target process
PID 4796 wrote to memory of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 4796 wrote to memory of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 4796 wrote to memory of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 4796 wrote to memory of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 4796 wrote to memory of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 4796 wrote to memory of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 4796 wrote to memory of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 4796 wrote to memory of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 4796 wrote to memory of 5004	4796	VirusShare_09b500283366eafb809963ae3341e9c0.exe	VirusShare_09b500283366eafb809963ae3341e9c0.exe
PID 5004 wrote to memory of 1728	5004	VirusShare_09b500283366eafb809963ae3341e9c0.exe	pjjsimvudcyr.exe
PID 5004 wrote to memory of 1728	5004	VirusShare_09b500283366eafb809963ae3341e9c0.exe	pjjsimvudcyr.exe
PID 5004 wrote to memory of 1728	5004	VirusShare_09b500283366eafb809963ae3341e9c0.exe	pjjsimvudcyr.exe
PID 5004 wrote to memory of 1700	5004	VirusShare_09b500283366eafb809963ae3341e9c0.exe	cmd.exe
PID 5004 wrote to memory of 1700	5004	VirusShare_09b500283366eafb809963ae3341e9c0.exe	cmd.exe
PID 5004 wrote to memory of 1700	5004	VirusShare_09b500283366eafb809963ae3341e9c0.exe	cmd.exe
PID 1728 wrote to memory of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe
PID 1728 wrote to memory of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe
PID 1728 wrote to memory of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe
PID 1728 wrote to memory of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe
PID 1728 wrote to memory of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe
PID 1728 wrote to memory of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe
PID 1728 wrote to memory of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe
PID 1728 wrote to memory of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe
PID 1728 wrote to memory of 740	1728	pjjsimvudcyr.exe	pjjsimvudcyr.exe
PID 740 wrote to memory of 4904	740	pjjsimvudcyr.exe	WMIC.exe
PID 740 wrote to memory of 4904	740	pjjsimvudcyr.exe	WMIC.exe
PID 740 wrote to memory of 3100	740	pjjsimvudcyr.exe	NOTEPAD.EXE
PID 740 wrote to memory of 3100	740	pjjsimvudcyr.exe	NOTEPAD.EXE
PID 740 wrote to memory of 3100	740	pjjsimvudcyr.exe	NOTEPAD.EXE
PID 740 wrote to memory of 3988	740	pjjsimvudcyr.exe	msedge.exe
PID 740 wrote to memory of 3988	740	pjjsimvudcyr.exe	msedge.exe
PID 3988 wrote to memory of 1072	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1072	3988	msedge.exe	msedge.exe
PID 740 wrote to memory of 1152	740	pjjsimvudcyr.exe	WMIC.exe
PID 740 wrote to memory of 1152	740	pjjsimvudcyr.exe	WMIC.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe
PID 3988 wrote to memory of 1616	3988	msedge.exe	msedge.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

pjjsimvudcyr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pjjsimvudcyr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	pjjsimvudcyr.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_09b500283366eafb809963ae3341e9c0.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_09b500283366eafb809963ae3341e9c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\VirusShare_09b500283366eafb809963ae3341e9c0.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_09b500283366eafb809963ae3341e9c0.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\pjjsimvudcyr.exe
    C:\Windows\pjjsimvudcyr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\pjjsimvudcyr.exe
      C:\Windows\pjjsimvudcyr.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:740
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4904
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:3100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc9c546f8,0x7ffcc9c54708,0x7ffcc9c54718
        6⤵
        
        PID:1072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
        6⤵
        
        PID:1616
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
        6⤵
        
        PID:3928
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
        6⤵
        
        PID:2808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:4688
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        6⤵
        
        PID:2848
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
        6⤵
        
        PID:4596
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
        6⤵
        
        PID:3860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
        6⤵
        
        PID:2584
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
        6⤵
        
        PID:428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
        6⤵
        
        PID:4644
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13286983057302333930,15112226672407444832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
        6⤵
        
        PID:4324
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\PJJSIM~1.EXE
        5⤵
        
        PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    PID:1700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+oaocn.html

Filesize
11KB

MD5
8b79c99723d2ee785bbc5106f92f076e

SHA1
9c7531e100b1cf87f334767f70dfdf91201b4281

SHA256
a257125ee2eae4d9304d2681666ed35fd3530999e5d9cb33663eec8abdcff53b

SHA512
82886f844273e603ef7313df7996364a2c02ef9df3f65769eb630d2efab31b6e7bbe974f1e9b036096c18d7bae5709bdae0474a6ee427595ae83ab3001fad45f

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+oaocn.png

Filesize
62KB

MD5
d97ab6613bd0fe6dde96c48d9bee46c3

SHA1
b0a6f9c8e077c2dfc4f901c8573dfb7cd7bd7e0a

SHA256
6208764fe47159739a48bca2d6bee281334eccb1ce0ee09d517f54c7902959dd

SHA512
22c9a401ca01fd942aed6a0f812e7775ae26b4b3b8d62651827b71f39301cc9fe12a4f84c4ea0858b0b23a0f40f84879a15162f16ee345d54a252142c14de239

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+oaocn.txt

Filesize
1KB

MD5
09d2e6f67a58efd2a1cf4ee6e293f977

SHA1
bb128aecd6af8306ae402c3ece40876f7bd808bf

SHA256
e69d6cf8bae319ef372363084015121d85652c8ffc95612a4d9d3c90995e9c08

SHA512
b0ceffa4d9e24496e743862c7467dee6175fb3cfa1c84002ff2e5cedf85712196046e3fcc24753e1e810bb457b3d6c7ba0c8e4a8a06156b4fda9313272e026dd

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
164590ffc8153bf8c7867849cbf5675c

SHA1
74875db923a7a6952b1fc326b1c4354bf93555cb

SHA256
502e0b635746b32e7f33b33290864178114e240c36802c4c6e5b462399f66934

SHA512
c42e0220eb7278b4437e9487616dd032ecf36158ba16518bb054bf4224b4ce71359de3752b246a649d62074e34ece257c08ba64b15453eddfcf9a8bc22918bd7

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
077684955e2cf245a44fcef0b9170593

SHA1
d6ab0fef578c51576ada925604c555fb33485c06

SHA256
4a9618cdee9d672492b520bc9e048dd21709aba95d8d09f3e45ca93d9428855b

SHA512
2480a7290675902ad9996befd09fe3105a2afe3733251242b014c806d97cf56d268efc505ee69207c0f9575bef42c19910f2b2c076e11a401a82ae585adcab6f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
d17008778a557d9eaecaf7bfc0c3d7e2

SHA1
dd415580374071aafd3b34e85251d8fe019ed3dd

SHA256
cd36c36d8a17776818e657730acffa393a9a630f71f10b3dbe60d9816d9d8d91

SHA512
a0cbb8dab41699e2d33bfdabfe45bc679776a61d1708a816b256b022ae703a8075a69c5e97dfc1119b51078b57e0e688033eb83e668f6a1e4eaf8d8c54ea74e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1819778f-ed54-48a1-9fe9-d27d16844a83.tmp

Filesize
6KB

MD5
6487794b3e220740255635134525bb9d

SHA1
9a42262da79e22dbec169adbbff57da0f9959390

SHA256
9723a1cd9d2459ac65054097005a0f384ec05b4a1549097b4ad0d14d9c8525e0

SHA512
fa1d78d98041194be3627fd8f8d1211ec7ba115064a41b7e38bdf569422f8668c377ca283ab1654651867b0b516e1374fd05cae964d6fa2c676b17915827deb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2cd41db03a9502ae7f233ed3c377f00e

SHA1
eb4d1b2565620e91d31a4f0137fc7f0238f79a2b

SHA256
e62308e5dc780fcc7eff4f251f1ea76940bc719562659ae99153befa1c914fd2

SHA512
2037db9c7e1078902bc31e5e693a86a08cd10f46ebd363bfa74370332225713e98f2b5aa56bc6ce9dbdbce159783418fa316fa0ef85e2895bd30cc06e43106c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b15fd47d7c8b93e21354882999d6b96

SHA1
66b9d3ba41e9d4070af071dd1d2a52a1754b58de

SHA256
50862c298a6977f35c0e9ce6aea343c28be50a31997d65263909185ae8d69104

SHA512
5ef53962deb3d10935e44d73f5bfe2ba8bb80e902e7e7d5cfeff712d94ddbfa7542302addd3e5563da39baaa1a8eaeea140b0a50728512dcd7bcb035004da1d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596380890952339.txt

Filesize
47KB

MD5
f88c5f48302a88b25920fd5721a99258

SHA1
810ebf175cf2e9fdb19d1f5a97ca34eacf0350bb

SHA256
bbacfe69c5ed0db8acffcfb6de4b05ac1082506e28f2362c8e316e6d8966b2e3

SHA512
4f0954cb7da60f30cb2b37c15d65e01d31b765864695074794eae40d6fca090e18d91697425757702e6ae6f8a987f95756b37e5aac762054f37ee19589de0b19

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596427278316214.txt

Filesize
75KB

MD5
0e0f03b5d8db48503518ee75de6ce3d6

SHA1
b841fc23b6c53db6e79337ab9d13ec7b896e8a69

SHA256
3279ada4a641760484fb9bf56d43e6a1c37236559ed8099ac8cdc04483b1e4bc

SHA512
fa024d49635ae1948b42bb47f3acfd4d9299fd2fed96e0ad65d28e410dfa689692ea3a8786610a15ca65fbd7dcff34dd1e29bce7c201e08948c6e260b570dab8

Download Submit
C:\Windows\pjjsimvudcyr.exe

Filesize
336KB

MD5
09b500283366eafb809963ae3341e9c0

SHA1
628610489c41e78617f4e51d0d0143a07b245f85

SHA256
8506824ad4a9aabf540bbf58741412448178b846e540fbbfdf2a4e48acfe46da

SHA512
7ecb3ed388e2866cbb0331d50d910ce3810f8b9bc1ece963e2cc67c5eaff017d2109e7ccb9d022b8960f78cca243c36bbdb29e0f78fdfc32a78cf2daea6ea796

Download Submit
\??\pipe\LOCAL\crashpad_3988_LDMVSDJYRVNCYPCW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/740-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-10458-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-25-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-23-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-20-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-2923-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-6020-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-17-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-10508-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-9558-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-10457-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-895-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-10466-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-10468-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/740-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1728-11-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4796-0-0x0000000000EA0000-0x0000000000EA3000-memory.dmp

Filesize
12KB

Download
memory/4796-3-0x0000000000EA0000-0x0000000000EA3000-memory.dmp

Filesize
12KB

Download
memory/5004-14-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/5004-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/5004-4-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/5004-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/5004-1-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download