7659872c938b820b351446509964ed4fcbc405b58e43694722f00bb42b277dd6

Analysis

max time kernel
144s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
Size

368KB
MD5

501d52bcc05636268a66a6e9f1c5c4ad
SHA1

2199071c4190b6aae6ec7dc65ced83301883d714
SHA256

7659872c938b820b351446509964ed4fcbc405b58e43694722f00bb42b277dd6
SHA512

d72db00dad74a6d15d59cd7dbb401f5f86706242b95a6c57dc12c9b33590fefe951b56043eae3f0125bd5240baad46edd919872820e40a8dac5109a3a7e222b8
SSDEEP

6144:GQNUdPR6oncUtPLJoJi8ju8FQNXsyR36GeHba2grj9F4SENppTUHtnvR3aF3J9PQ:jNUdc6wA8P2cyF6T7a2gH9F4dzhUl6rP

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+kjkuq.txt

Ransom Note

__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/D361FA807B716C4 2. http://b4youfred5485jgsa3453f.italazudda.com/D361FA807B716C4 3. http://5rport45vcdef345adfkksawe.bematvocal.at/D361FA807B716C4 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/D361FA807B716C4 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/D361FA807B716C4 http://b4youfred5485jgsa3453f.italazudda.com/D361FA807B716C4 http://5rport45vcdef345adfkksawe.bematvocal.at/D361FA807B716C4 *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/D361FA807B716C4 *-*-* Your personal identification ID: D361FA807B716C4

URLs

http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/D361FA807B716C4

http://b4youfred5485jgsa3453f.italazudda.com/D361FA807B716C4

http://5rport45vcdef345adfkksawe.bematvocal.at/D361FA807B716C4

http://fwgrhsao3aoml7ej.onion/D361FA807B716C4

http://fwgrhsao3aoml7ej.ONION/D361FA807B716C4

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	cbfpxbsciafq.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+kjkuq.png	cbfpxbsciafq.exe

Executes dropped EXE 2 IoCs

pid	Process
1052	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lmxokfrluept = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\cbfpxbsciafq.exe\""	cbfpxbsciafq.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4268 set thread context of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 1052 set thread context of 2444	1052	cbfpxbsciafq.exe	97

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-white_scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-400.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TinyTile.scale-100_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-200.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-400.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-128.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-100_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\LargeTile.scale-200.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-100_contrast-black.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-20_contrast-black.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\SmallTile.scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Wide310x150Logo.scale-125.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-96_altform-unplated.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-white_scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.js	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-125_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyView.scale-150.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-200_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-200.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-32_altform-unplated.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-100_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\LargeTile.scale-125.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-20.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg6.jpg	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-400.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-200_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\microsoft.system.package.metadata\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Recovery+kjkuq.html	cbfpxbsciafq.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\cbfpxbsciafq.exe	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
File opened for modification	C:\Windows\cbfpxbsciafq.exe	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cbfpxbsciafq.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1604	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
Token: SeDebugPrivilege	2444	cbfpxbsciafq.exe
Token: SeIncreaseQuotaPrivilege	4472	WMIC.exe
Token: SeSecurityPrivilege	4472	WMIC.exe
Token: SeTakeOwnershipPrivilege	4472	WMIC.exe
Token: SeLoadDriverPrivilege	4472	WMIC.exe
Token: SeSystemProfilePrivilege	4472	WMIC.exe
Token: SeSystemtimePrivilege	4472	WMIC.exe
Token: SeProfSingleProcessPrivilege	4472	WMIC.exe
Token: SeIncBasePriorityPrivilege	4472	WMIC.exe
Token: SeCreatePagefilePrivilege	4472	WMIC.exe
Token: SeBackupPrivilege	4472	WMIC.exe
Token: SeRestorePrivilege	4472	WMIC.exe
Token: SeShutdownPrivilege	4472	WMIC.exe
Token: SeDebugPrivilege	4472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4472	WMIC.exe
Token: SeRemoteShutdownPrivilege	4472	WMIC.exe
Token: SeUndockPrivilege	4472	WMIC.exe
Token: SeManageVolumePrivilege	4472	WMIC.exe
Token: 33	4472	WMIC.exe
Token: 34	4472	WMIC.exe
Token: 35	4472	WMIC.exe
Token: 36	4472	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4472	WMIC.exe
Token: SeSecurityPrivilege	4472	WMIC.exe
Token: SeTakeOwnershipPrivilege	4472	WMIC.exe
Token: SeLoadDriverPrivilege	4472	WMIC.exe
Token: SeSystemProfilePrivilege	4472	WMIC.exe
Token: SeSystemtimePrivilege	4472	WMIC.exe
Token: SeProfSingleProcessPrivilege	4472	WMIC.exe
Token: SeIncBasePriorityPrivilege	4472	WMIC.exe
Token: SeCreatePagefilePrivilege	4472	WMIC.exe
Token: SeBackupPrivilege	4472	WMIC.exe
Token: SeRestorePrivilege	4472	WMIC.exe
Token: SeShutdownPrivilege	4472	WMIC.exe
Token: SeDebugPrivilege	4472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4472	WMIC.exe
Token: SeRemoteShutdownPrivilege	4472	WMIC.exe
Token: SeUndockPrivilege	4472	WMIC.exe
Token: SeManageVolumePrivilege	4472	WMIC.exe
Token: 33	4472	WMIC.exe
Token: 34	4472	WMIC.exe
Token: 35	4472	WMIC.exe
Token: 36	4472	WMIC.exe
Token: SeBackupPrivilege	3580	vssvc.exe
Token: SeRestorePrivilege	3580	vssvc.exe
Token: SeAuditPrivilege	3580	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
1052	cbfpxbsciafq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 3428 wrote to memory of 1052	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	94
PID 3428 wrote to memory of 1052	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	94
PID 3428 wrote to memory of 1052	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	94
PID 3428 wrote to memory of 1880	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	95
PID 3428 wrote to memory of 1880	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	95
PID 3428 wrote to memory of 1880	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	95
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 2444 wrote to memory of 4472	2444	cbfpxbsciafq.exe	98
PID 2444 wrote to memory of 4472	2444	cbfpxbsciafq.exe	98
PID 2444 wrote to memory of 1604	2444	cbfpxbsciafq.exe	103
PID 2444 wrote to memory of 1604	2444	cbfpxbsciafq.exe	103
PID 2444 wrote to memory of 1604	2444	cbfpxbsciafq.exe	103
PID 2444 wrote to memory of 2256	2444	cbfpxbsciafq.exe	104
PID 2444 wrote to memory of 2256	2444	cbfpxbsciafq.exe	104
PID 2256 wrote to memory of 3944	2256	msedge.exe	105
PID 2256 wrote to memory of 3944	2256	msedge.exe	105
PID 2444 wrote to memory of 2448	2444	cbfpxbsciafq.exe	106
PID 2444 wrote to memory of 2448	2444	cbfpxbsciafq.exe	106
PID 2444 wrote to memory of 2448	2444	cbfpxbsciafq.exe	106
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cbfpxbsciafq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	cbfpxbsciafq.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\cbfpxbsciafq.exe
    C:\Windows\cbfpxbsciafq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\cbfpxbsciafq.exe
      C:\Windows\cbfpxbsciafq.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2444
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:1604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff43946f8,0x7ffff4394708,0x7ffff4394718
        6⤵
        
        PID:3944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
        6⤵
        
        PID:4656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
        6⤵
        
        PID:4008
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
        6⤵
        
        PID:3688
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        6⤵
        
        PID:5084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        6⤵
        
        PID:280
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
        6⤵
        
        PID:2892
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
        6⤵
        
        PID:2436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
        6⤵
        
        PID:1880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
        6⤵
        
        PID:2584
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
        6⤵
        
        PID:3140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
        6⤵
        
        PID:4892
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\CBFPXB~1.EXE
        5⤵
        
        PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    PID:1880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+kjkuq.html

Filesize
8KB

MD5
dff77ae8755b88fd37bcd6fd8a0f8a44

SHA1
51c5cf6639cccf1b66e70ff113763c90fe89a15d

SHA256
3443bc2bdfcef484049dd980985b19bcb508df3d068a88be02e1f7f5f96dcab9

SHA512
d18f98c849d0c56762a236ad8763073f8d7cb26553beb8d762dec7f5ec6886d4c374df66a88a1851405fedc1baad671198d9c57418cab20354ab37d469085a37

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+kjkuq.png

Filesize
69KB

MD5
96e233697b4ed2401b8f8b239d385562

SHA1
148ee908e1654142e5d1908dd57ecd61aa68cf03

SHA256
089392dd9d4f3a449d18a7eb5598adcfd8300b942e11b647dddb990378c4d935

SHA512
dbb6df78e7161c1e98415bbfea3610c01af3a4903890b38526e1e1a6a859c10fb94f5fdab1470e26c391ed90f1c2405e96945afb6a3c92ab77dd548b5298b343

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+kjkuq.txt

Filesize
2KB

MD5
5c10a9a60e96602fc82a45280230aadb

SHA1
66c51fb8334b57baf5a65e1711f1fe878a80dd5d

SHA256
b55e6d5c65b1466180954379e63175421ac3317bfbc0324b3f7e347609ea4cc7

SHA512
ca01ef0974b52166ccd3de14ae55bcb3a1dd0a6e1e7c94008c0a62d344ab1f8937d3fd956b0d0e713d3addbc08e6aa90a830f9108e90ba6cd10b74bd280c14da

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
1654fc767d3a4981dbd81d978822399a

SHA1
441c304c1f91accc6a5e72656955d7c536fd2f1d

SHA256
6d8365ef1ad1ee6fc15271166d2df7a23e9f90eadeb3d597a9dcc099d69b73ab

SHA512
1829ccd8005a0fb7901baf17ea2d5d89fde276c202817e45a9af6f0cfddb3393b6214941fde65e4a49b623aa7c992bb52d44751149758b0c7284a3970d2c376f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
04094faae9d7e438cf73018bcfe4cfba

SHA1
20450426bdcd02a0763b30d684cd1084b4ea35ff

SHA256
504a9915f4ef7d942d3b4bc5dcd653b028600de6d33ab85431c9126480fc9181

SHA512
5a9cbb8eedf39ba9acb0a812b9f61479404b0e0bdec063a951713325df33595e6ba6a81d98244f83db7d3d7b7ea8be61bcda98852ef2d13e69d64085cf6f81c5

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
b0f77e9971e29521b2baff96f806a533

SHA1
a564ddbe108969132fdc429cc5b78bf1f4f15a1f

SHA256
af760e27f4d431b4cbe38a806c83209400948a80c8a4a868de17e1a22aa8d5ab

SHA512
29794676ba548ce7323fc1e1bd5c758be9484b984b61bcc9d696950cca028e76aa9eb4459607e310f4efe9907ecd709e7e65deab2d258bac8667b7beb08fb013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c4d2156fb99fd0df87044db16095226e

SHA1
c08fe11f38bc16d0296e4fbe36176ba9d40e2f36

SHA256
19a670a8c632e3de38b1e87151a4d091fd85a3293a35ee708ef45f28cb4cda0b

SHA512
327aaedfa98a38b60555a01694c404e70af2fe4c93c4dc25ad94af68abe33ea381a3d6f01a39f3566f33ffedfa6389b59297f343322676c22d1f332addc2b241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92229458f793a4e709a6d6f156a9083c

SHA1
59b2d799a3cb1af77ff9cdf9ad9f3ed0e24c84d7

SHA256
5d5351acae81a098f608b87ac74794e88fd31c3972531fc76d40ef4f0afa5188

SHA512
7d9612cff4709cfc3a9eecd1ad304d00aed79413b60bab505a225a5e2c058c6bbb1d85a2b433e3a3cfddaa13f7786f4e964ea4f406c84ff031c5a2590d124a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dc9bdb57e9c04f0e4d6d0bb9d9b9ae84

SHA1
be279dfc45a190d3758be34585217097aaec24e6

SHA256
9816d72e9e780eb2b5cfed0abd46476c2208705d96567c4a92ee97f58f06b8da

SHA512
5f9e80ee1024bf1aee906118249a67b012c7c254680a7e0b3f01b6c8fbeebfba6eb64a446060cd685ad1ff0e49e3391a3393feff770bf682aae87d3a6b7e31b0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596449526171674.txt

Filesize
75KB

MD5
d9420975efb02eb52abd9f55088244c2

SHA1
e65ada2fbee328259da3e25789a2c00a19453598

SHA256
9358a1773e3157fee8a1eb20fcee03e264174d8fda43658b3fca76365239009d

SHA512
3491f492f843497a760306e5a9dbb5981177f2e74131854bf5b093b012381e49ef3b1a9dd0ccfcaf442b098a280693817affe6f3e6a44dbb1cf270788181be02

Download Submit
C:\Windows\cbfpxbsciafq.exe

Filesize
368KB

MD5
501d52bcc05636268a66a6e9f1c5c4ad

SHA1
2199071c4190b6aae6ec7dc65ced83301883d714

SHA256
7659872c938b820b351446509964ed4fcbc405b58e43694722f00bb42b277dd6

SHA512
d72db00dad74a6d15d59cd7dbb401f5f86706242b95a6c57dc12c9b33590fefe951b56043eae3f0125bd5240baad46edd919872820e40a8dac5109a3a7e222b8

Download Submit
memory/1052-12-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download
memory/1052-20-0x0000000000400000-0x00000000005AF000-memory.dmp

Filesize
1.7MB

Download
memory/2444-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-10348-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-26-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-24-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-21-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-17-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-1628-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-3825-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-6442-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-9395-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-68-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-10349-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-10356-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2444-10365-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3428-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3428-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3428-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3428-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3428-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4268-0-0x00000000007C0000-0x00000000007C3000-memory.dmp

Filesize
12KB

Download
memory/4268-4-0x00000000007C0000-0x00000000007C3000-memory.dmp

Filesize
12KB

Download
memory/4268-1-0x00000000007C0000-0x00000000007C3000-memory.dmp

Filesize
12KB

Download