7659872c938b820b351446509964ed4fcbc405b58e43694722f00bb42b277dd6

Analysis

max time kernel
144s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
Size 368KB
Sample240610-ng1mpshd65
SHA256 7659872c938b820b351446509964ed4fcbc405b58e43694722f00bb42b277dd6
MD5 501d52bcc05636268a66a6e9f1c5c4ad
SHA1 2199071c4190b6aae6ec7dc65ced83301883d714
SHA512 d72db00dad74a6d15d59cd7dbb401f5f86706242b95a6c57dc12c9b33590fefe951b56043eae3f0125bd5240baad46edd919872820e40a8dac5109a3a7e222b8
SSDEEP 6144:GQNUdPR6oncUtPLJoJi8ju8FQNXsyR36GeHba2grj9F4SENppTUHtnvR3aF3J9PQ:jNUdc6wA8P2cyF6T7a2gH9F4dzhUl6rP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+kjkuq.txt

Ransom Note

__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/D361FA807B716C4 2. http://b4youfred5485jgsa3453f.italazudda.com/D361FA807B716C4 3. http://5rport45vcdef345adfkksawe.bematvocal.at/D361FA807B716C4 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/D361FA807B716C4 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/D361FA807B716C4 http://b4youfred5485jgsa3453f.italazudda.com/D361FA807B716C4 http://5rport45vcdef345adfkksawe.bematvocal.at/D361FA807B716C4 *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/D361FA807B716C4 *-*-* Your personal identification ID: D361FA807B716C4

URLs

http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/D361FA807B716C4
http://b4youfred5485jgsa3453f.italazudda.com/D361FA807B716C4
http://5rport45vcdef345adfkksawe.bematvocal.at/D361FA807B716C4
http://fwgrhsao3aoml7ej.onion/D361FA807B716C4
http://fwgrhsao3aoml7ej.ONION/D361FA807B716C4

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	cbfpxbsciafq.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+kjkuq.png	cbfpxbsciafq.exe

Executes dropped EXE 2 IoCs

pid	Process
1052	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lmxokfrluept = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\cbfpxbsciafq.exe\""	cbfpxbsciafq.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4268 set thread context of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 1052 set thread context of 2444	1052	cbfpxbsciafq.exe	97

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-white_scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-400.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TinyTile.scale-100_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-200.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-400.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-128.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-100_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\LargeTile.scale-200.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-100_contrast-black.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-20_contrast-black.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\SmallTile.scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Wide310x150Logo.scale-125.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-96_altform-unplated.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-white_scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_scale-100.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.js	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-125_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyView.scale-150.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-200_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-200.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-32_altform-unplated.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Recovery+kjkuq.html	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+kjkuq.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-100_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\LargeTile.scale-125.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-20.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg6.jpg	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-400.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LargeTile.scale-200_contrast-white.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\microsoft.system.package.metadata\Recovery+kjkuq.txt	cbfpxbsciafq.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Recovery+kjkuq.html	cbfpxbsciafq.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\cbfpxbsciafq.exe	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
File opened for modification	C:\Windows\cbfpxbsciafq.exe	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cbfpxbsciafq.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1604	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe
2444	cbfpxbsciafq.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
Token: SeDebugPrivilege	2444	cbfpxbsciafq.exe
Token: SeIncreaseQuotaPrivilege	4472	WMIC.exe
Token: SeSecurityPrivilege	4472	WMIC.exe
Token: SeTakeOwnershipPrivilege	4472	WMIC.exe
Token: SeLoadDriverPrivilege	4472	WMIC.exe
Token: SeSystemProfilePrivilege	4472	WMIC.exe
Token: SeSystemtimePrivilege	4472	WMIC.exe
Token: SeProfSingleProcessPrivilege	4472	WMIC.exe
Token: SeIncBasePriorityPrivilege	4472	WMIC.exe
Token: SeCreatePagefilePrivilege	4472	WMIC.exe
Token: SeBackupPrivilege	4472	WMIC.exe
Token: SeRestorePrivilege	4472	WMIC.exe
Token: SeShutdownPrivilege	4472	WMIC.exe
Token: SeDebugPrivilege	4472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4472	WMIC.exe
Token: SeRemoteShutdownPrivilege	4472	WMIC.exe
Token: SeUndockPrivilege	4472	WMIC.exe
Token: SeManageVolumePrivilege	4472	WMIC.exe
Token: 33	4472	WMIC.exe
Token: 34	4472	WMIC.exe
Token: 35	4472	WMIC.exe
Token: 36	4472	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4472	WMIC.exe
Token: SeSecurityPrivilege	4472	WMIC.exe
Token: SeTakeOwnershipPrivilege	4472	WMIC.exe
Token: SeLoadDriverPrivilege	4472	WMIC.exe
Token: SeSystemProfilePrivilege	4472	WMIC.exe
Token: SeSystemtimePrivilege	4472	WMIC.exe
Token: SeProfSingleProcessPrivilege	4472	WMIC.exe
Token: SeIncBasePriorityPrivilege	4472	WMIC.exe
Token: SeCreatePagefilePrivilege	4472	WMIC.exe
Token: SeBackupPrivilege	4472	WMIC.exe
Token: SeRestorePrivilege	4472	WMIC.exe
Token: SeShutdownPrivilege	4472	WMIC.exe
Token: SeDebugPrivilege	4472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4472	WMIC.exe
Token: SeRemoteShutdownPrivilege	4472	WMIC.exe
Token: SeUndockPrivilege	4472	WMIC.exe
Token: SeManageVolumePrivilege	4472	WMIC.exe
Token: 33	4472	WMIC.exe
Token: 34	4472	WMIC.exe
Token: 35	4472	WMIC.exe
Token: 36	4472	WMIC.exe
Token: SeBackupPrivilege	3580	vssvc.exe
Token: SeRestorePrivilege	3580	vssvc.exe
Token: SeAuditPrivilege	3580	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
1052	cbfpxbsciafq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 4268 wrote to memory of 3428	4268	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	93
PID 3428 wrote to memory of 1052	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	94
PID 3428 wrote to memory of 1052	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	94
PID 3428 wrote to memory of 1052	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	94
PID 3428 wrote to memory of 1880	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	95
PID 3428 wrote to memory of 1880	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	95
PID 3428 wrote to memory of 1880	3428	VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe	95
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 1052 wrote to memory of 2444	1052	cbfpxbsciafq.exe	97
PID 2444 wrote to memory of 4472	2444	cbfpxbsciafq.exe	98
PID 2444 wrote to memory of 4472	2444	cbfpxbsciafq.exe	98
PID 2444 wrote to memory of 1604	2444	cbfpxbsciafq.exe	103
PID 2444 wrote to memory of 1604	2444	cbfpxbsciafq.exe	103
PID 2444 wrote to memory of 1604	2444	cbfpxbsciafq.exe	103
PID 2444 wrote to memory of 2256	2444	cbfpxbsciafq.exe	104
PID 2444 wrote to memory of 2256	2444	cbfpxbsciafq.exe	104
PID 2256 wrote to memory of 3944	2256	msedge.exe	105
PID 2256 wrote to memory of 3944	2256	msedge.exe	105
PID 2444 wrote to memory of 2448	2444	cbfpxbsciafq.exe	106
PID 2444 wrote to memory of 2448	2444	cbfpxbsciafq.exe	106
PID 2444 wrote to memory of 2448	2444	cbfpxbsciafq.exe	106
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108
PID 2256 wrote to memory of 4656	2256	msedge.exe	108

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cbfpxbsciafq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	cbfpxbsciafq.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_501d52bcc05636268a66a6e9f1c5c4ad.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\cbfpxbsciafq.exe
    C:\Windows\cbfpxbsciafq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\cbfpxbsciafq.exe
      C:\Windows\cbfpxbsciafq.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2444
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:1604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff43946f8,0x7ffff4394708,0x7ffff4394718
        6⤵
        
        PID:3944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
        6⤵
        
        PID:4656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
        6⤵
        
        PID:4008
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
        6⤵
        
        PID:3688
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        6⤵
        
        PID:5084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        6⤵
        
        PID:280
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
        6⤵
        
        PID:2892
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
        6⤵
        
        PID:2436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
        6⤵
        
        PID:1880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
        6⤵
        
        PID:2584
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
        6⤵
        
        PID:3140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,10089110399314835581,3347980766259338946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
        6⤵
        
        PID:4892
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\CBFPXB~1.EXE
        5⤵
        
        PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    PID:1880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Recovery+kjkuq.html

Path C:\Program Files\7-Zip\Lang\Recovery+kjkuq.html
Size 8KB
SHA256 3443bc2bdfcef484049dd980985b19bcb508df3d068a88be02e1f7f5f96dcab9
MD5 dff77ae8755b88fd37bcd6fd8a0f8a44
SHA1 51c5cf6639cccf1b66e70ff113763c90fe89a15d
SHA512 d18f98c849d0c56762a236ad8763073f8d7cb26553beb8d762dec7f5ec6886d4c374df66a88a1851405fedc1baad671198d9c57418cab20354ab37d469085a37
SSDEEP 96:Mm1Z8Dl1Z1IyEFeoEaB6XDWw9G/ro/ZPs+it1Ovgf16Hits2MGQq2/Wb50AEemHI:Z4VoFp8XDWs0axi7ldRHMGQ9W2JHhAT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recovery+kjkuq.png

Path C:\Program Files\7-Zip\Lang\Recovery+kjkuq.png
Size 69KB
SHA256 089392dd9d4f3a449d18a7eb5598adcfd8300b942e11b647dddb990378c4d935
MD5 96e233697b4ed2401b8f8b239d385562
SHA1 148ee908e1654142e5d1908dd57ecd61aa68cf03
SHA512 dbb6df78e7161c1e98415bbfea3610c01af3a4903890b38526e1e1a6a859c10fb94f5fdab1470e26c391ed90f1c2405e96945afb6a3c92ab77dd548b5298b343
SSDEEP 1536:QTu8Q9Unj0ea4zR4tq7uYfCynGwHKNHx0ewsKnaLFZTX/:Q2Unbxz37uz7q8FNX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recovery+kjkuq.txt

Path C:\Program Files\7-Zip\Lang\Recovery+kjkuq.txt
Size 2KB
SHA256 b55e6d5c65b1466180954379e63175421ac3317bfbc0324b3f7e347609ea4cc7
MD5 5c10a9a60e96602fc82a45280230aadb
SHA1 66c51fb8334b57baf5a65e1711f1fe878a80dd5d
SHA512 ca01ef0974b52166ccd3de14ae55bcb3a1dd0a6e1e7c94008c0a62d344ab1f8937d3fd956b0d0e713d3addbc08e6aa90a830f9108e90ba6cd10b74bd280c14da
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 6d8365ef1ad1ee6fc15271166d2df7a23e9f90eadeb3d597a9dcc099d69b73ab
MD5 1654fc767d3a4981dbd81d978822399a
SHA1 441c304c1f91accc6a5e72656955d7c536fd2f1d
SHA512 1829ccd8005a0fb7901baf17ea2d5d89fde276c202817e45a9af6f0cfddb3393b6214941fde65e4a49b623aa7c992bb52d44751149758b0c7284a3970d2c376f
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 504a9915f4ef7d942d3b4bc5dcd653b028600de6d33ab85431c9126480fc9181
MD5 04094faae9d7e438cf73018bcfe4cfba
SHA1 20450426bdcd02a0763b30d684cd1084b4ea35ff
SHA512 5a9cbb8eedf39ba9acb0a812b9f61479404b0e0bdec063a951713325df33595e6ba6a81d98244f83db7d3d7b7ea8be61bcda98852ef2d13e69d64085cf6f81c5
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 416B
SHA256 af760e27f4d431b4cbe38a806c83209400948a80c8a4a868de17e1a22aa8d5ab
MD5 b0f77e9971e29521b2baff96f806a533
SHA1 a564ddbe108969132fdc429cc5b78bf1f4f15a1f
SHA512 29794676ba548ce7323fc1e1bd5c758be9484b984b61bcc9d696950cca028e76aa9eb4459607e310f4efe9907ecd709e7e65deab2d258bac8667b7beb08fb013
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 19a670a8c632e3de38b1e87151a4d091fd85a3293a35ee708ef45f28cb4cda0b
MD5 c4d2156fb99fd0df87044db16095226e
SHA1 c08fe11f38bc16d0296e4fbe36176ba9d40e2f36
SHA512 327aaedfa98a38b60555a01694c404e70af2fe4c93c4dc25ad94af68abe33ea381a3d6f01a39f3566f33ffedfa6389b59297f343322676c22d1f332addc2b241
SSDEEP 96:nfkDX1/1wpvWMoiVmdeHBrz+gUWQyV+VDCziEwb:nfkTt1GWMX4gro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5d5351acae81a098f608b87ac74794e88fd31c3972531fc76d40ef4f0afa5188
MD5 92229458f793a4e709a6d6f156a9083c
SHA1 59b2d799a3cb1af77ff9cdf9ad9f3ed0e24c84d7
SHA512 7d9612cff4709cfc3a9eecd1ad304d00aed79413b60bab505a225a5e2c058c6bbb1d85a2b433e3a3cfddaa13f7786f4e964ea4f406c84ff031c5a2590d124a42
SSDEEP 96:nfk6X1/FwpvWMoiVmdeHBrz+gUWQyV+VD7AiEwb:nfkktFGWMX4grg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9816d72e9e780eb2b5cfed0abd46476c2208705d96567c4a92ee97f58f06b8da
MD5 dc9bdb57e9c04f0e4d6d0bb9d9b9ae84
SHA1 be279dfc45a190d3758be34585217097aaec24e6
SHA512 5f9e80ee1024bf1aee906118249a67b012c7c254680a7e0b3f01b6c8fbeebfba6eb64a446060cd685ad1ff0e49e3391a3393feff770bf682aae87d3a6b7e31b0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/HGe2RUrMj283z2OMDCRHi:A9iIxuERzA83h09RZxY/HI5y8aOMWRHi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596449526171674.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596449526171674.txt
Size 75KB
SHA256 9358a1773e3157fee8a1eb20fcee03e264174d8fda43658b3fca76365239009d
MD5 d9420975efb02eb52abd9f55088244c2
SHA1 e65ada2fbee328259da3e25789a2c00a19453598
SHA512 3491f492f843497a760306e5a9dbb5981177f2e74131854bf5b093b012381e49ef3b1a9dd0ccfcaf442b098a280693817affe6f3e6a44dbb1cf270788181be02
SSDEEP 1536:0CvZug4npJx//nk2c8ME4NqVNFH39Gg/ujTIvInvwNtxiSlsA9/MFLDZchuAv:0KZmnpfk2c8MaVlGgGgvWw4MsA9/i1w5
MD5 SHA1 SHA512 SSDEEP

Submit Download

cbfpxbsciafq.exe

Path C:\Windows\cbfpxbsciafq.exe
Size 368KB
SHA256 7659872c938b820b351446509964ed4fcbc405b58e43694722f00bb42b277dd6
MD5 501d52bcc05636268a66a6e9f1c5c4ad
SHA1 2199071c4190b6aae6ec7dc65ced83301883d714
SHA512 d72db00dad74a6d15d59cd7dbb401f5f86706242b95a6c57dc12c9b33590fefe951b56043eae3f0125bd5240baad46edd919872820e40a8dac5109a3a7e222b8
SSDEEP 6144:GQNUdPR6oncUtPLJoJi8ju8FQNXsyR36GeHba2grj9F4SENppTUHtnvR3aF3J9PQ:jNUdc6wA8P2cyF6T7a2gH9F4dzhUl6rP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1052-12-0x0000000000400000-0x00000000005AF000-memory.dmp

Download

memory/1052-20-0x0000000000400000-0x00000000005AF000-memory.dmp

Download

memory/2444-19-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-10348-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-26-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-24-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-21-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-17-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-1628-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-3825-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-6442-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-18-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-9395-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-68-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-10349-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-10356-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/2444-10365-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3428-13-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3428-5-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3428-6-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3428-2-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/3428-3-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/4268-0-0x00000000007C0000-0x00000000007C3000-memory.dmp

Download

memory/4268-4-0x00000000007C0000-0x00000000007C3000-memory.dmp

Download

memory/4268-1-0x00000000007C0000-0x00000000007C3000-memory.dmp

Download