8314338955eea2aa003277561086290bc5095a81acced4bbd6b54f9f6887b43c

Analysis

max time kernel
146s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe
Size 338KB
Sample240612-p4sfaavhpg
SHA256 8314338955eea2aa003277561086290bc5095a81acced4bbd6b54f9f6887b43c
MD5 a0bc7ffada538c7f9b3ddbd59b75bedf
SHA1 15452e55a77ca1c7a55edbbdf2bdf3a3d234f663
SHA512 e2eaa3d5ef63d2f4bf2504f98e4762d713a28ab58b135907d3726fce40d6f8157d007d6a0d77af74cc4478c160de0404d6916f5d1a2dbeb8c2abf24256c350fb
SSDEEP 6144:WSizHT/ObUnIelanG4Ma4cketvLZQxVfREPTTk0xSr:r6HSAnIelK5vlsfqa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+jydnm.txt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So , there are two ways you can choose: wait for a miracle and get your price doubled , or start obtaining BITCOIN NOW !!!!! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files , except make a payment For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below * http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/5B4630527A281218 * http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/5B4630527A281218 * http://rbg4hfbilrf7to452p89hrfq.boonmower.com/5B4630527A281218 If for some reasons the addresses are not available, follow these steps * Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en * After a successful installation, run the browser * Type in the address bar: xlowfznrg4wf7dli.onion/5B4630527A281218 * Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/5B4630527A281218 http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/5B4630527A281218 http://rbg4hfbilrf7to452p89hrfq.boonmower.com/5B4630527A281218

URLs

http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/5B4630527A281218
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/5B4630527A281218
http://rbg4hfbilrf7to452p89hrfq.boonmower.com/5B4630527A281218
http://xlowfznrg4wf7dli.onion/5B4630527A281218

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (882) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	ylvqwifgustt.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+jydnm.html	ylvqwifgustt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+jydnm.png	ylvqwifgustt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+jydnm.html	ylvqwifgustt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+jydnm.png	ylvqwifgustt.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe

Executes dropped EXE 2 IoCs

pid	Process
2580	ylvqwifgustt.exe
4940	ylvqwifgustt.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aroinics_svc = "C:\\Windows\\SYSTEM32\\CMD.EXE /C START C:\\Windows\\ylvqwifgustt.exe"	ylvqwifgustt.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3164 set thread context of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 2580 set thread context of 4940	2580	ylvqwifgustt.exe	92

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockWideTile.contrast-black_scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp8.scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-fullcolor.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\WideTile.scale-200.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\_ReCoVeRy_+jydnm.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-100_contrast-black.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\_ReCoVeRy_+jydnm.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\en-US\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-200.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_ReCoVeRy_+jydnm.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\_ReCoVeRy_+jydnm.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-100.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\WideTile.scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+jydnm.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\_ReCoVeRy_+jydnm.html	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-400.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\ormma.js	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-100.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\_ReCoVeRy_+jydnm.html	ylvqwifgustt.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Triedit\en-US\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\_ReCoVeRy_+jydnm.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-24.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteSmallTile.scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_contrast-white.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\MedTile.scale-200.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailSmallTile.scale-150.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.scale-400.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircle.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\_ReCoVeRy_+jydnm.html	ylvqwifgustt.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-fullcolor.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-200.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_ReCoVeRy_+jydnm.html	ylvqwifgustt.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-white_scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\SearchPlaceholder-light.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-100.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MediumTile.scale-100_contrast-black.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCacheMini.scale-125.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\_ReCoVeRy_+jydnm.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\MoveToFolderToastQuickAction.scale-80.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\_ReCoVeRy_+jydnm.txt	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.scale-200.png	ylvqwifgustt.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\MedTile.scale-125.png	ylvqwifgustt.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ylvqwifgustt.exe	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe
File created	C:\Windows\ylvqwifgustt.exe	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	ylvqwifgustt.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3648	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe
4940	ylvqwifgustt.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe
Token: SeDebugPrivilege	4940	ylvqwifgustt.exe
Token: SeIncreaseQuotaPrivilege	4116	WMIC.exe
Token: SeSecurityPrivilege	4116	WMIC.exe
Token: SeTakeOwnershipPrivilege	4116	WMIC.exe
Token: SeLoadDriverPrivilege	4116	WMIC.exe
Token: SeSystemProfilePrivilege	4116	WMIC.exe
Token: SeSystemtimePrivilege	4116	WMIC.exe
Token: SeProfSingleProcessPrivilege	4116	WMIC.exe
Token: SeIncBasePriorityPrivilege	4116	WMIC.exe
Token: SeCreatePagefilePrivilege	4116	WMIC.exe
Token: SeBackupPrivilege	4116	WMIC.exe
Token: SeRestorePrivilege	4116	WMIC.exe
Token: SeShutdownPrivilege	4116	WMIC.exe
Token: SeDebugPrivilege	4116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4116	WMIC.exe
Token: SeRemoteShutdownPrivilege	4116	WMIC.exe
Token: SeUndockPrivilege	4116	WMIC.exe
Token: SeManageVolumePrivilege	4116	WMIC.exe
Token: 33	4116	WMIC.exe
Token: 34	4116	WMIC.exe
Token: 35	4116	WMIC.exe
Token: 36	4116	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4116	WMIC.exe
Token: SeSecurityPrivilege	4116	WMIC.exe
Token: SeTakeOwnershipPrivilege	4116	WMIC.exe
Token: SeLoadDriverPrivilege	4116	WMIC.exe
Token: SeSystemProfilePrivilege	4116	WMIC.exe
Token: SeSystemtimePrivilege	4116	WMIC.exe
Token: SeProfSingleProcessPrivilege	4116	WMIC.exe
Token: SeIncBasePriorityPrivilege	4116	WMIC.exe
Token: SeCreatePagefilePrivilege	4116	WMIC.exe
Token: SeBackupPrivilege	4116	WMIC.exe
Token: SeRestorePrivilege	4116	WMIC.exe
Token: SeShutdownPrivilege	4116	WMIC.exe
Token: SeDebugPrivilege	4116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4116	WMIC.exe
Token: SeRemoteShutdownPrivilege	4116	WMIC.exe
Token: SeUndockPrivilege	4116	WMIC.exe
Token: SeManageVolumePrivilege	4116	WMIC.exe
Token: 33	4116	WMIC.exe
Token: 34	4116	WMIC.exe
Token: 35	4116	WMIC.exe
Token: 36	4116	WMIC.exe
Token: SeBackupPrivilege	4672	vssvc.exe
Token: SeRestorePrivilege	4672	vssvc.exe
Token: SeAuditPrivilege	4672	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3696	WMIC.exe
Token: SeSecurityPrivilege	3696	WMIC.exe
Token: SeTakeOwnershipPrivilege	3696	WMIC.exe
Token: SeLoadDriverPrivilege	3696	WMIC.exe
Token: SeSystemProfilePrivilege	3696	WMIC.exe
Token: SeSystemtimePrivilege	3696	WMIC.exe
Token: SeProfSingleProcessPrivilege	3696	WMIC.exe
Token: SeIncBasePriorityPrivilege	3696	WMIC.exe
Token: SeCreatePagefilePrivilege	3696	WMIC.exe
Token: SeBackupPrivilege	3696	WMIC.exe
Token: SeRestorePrivilege	3696	WMIC.exe
Token: SeShutdownPrivilege	3696	WMIC.exe
Token: SeDebugPrivilege	3696	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3696	WMIC.exe
Token: SeRemoteShutdownPrivilege	3696	WMIC.exe
Token: SeUndockPrivilege	3696	WMIC.exe
Token: SeManageVolumePrivilege	3696	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 3164 wrote to memory of 1196	3164	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	83
PID 1196 wrote to memory of 2580	1196	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	84
PID 1196 wrote to memory of 2580	1196	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	84
PID 1196 wrote to memory of 2580	1196	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	84
PID 1196 wrote to memory of 1044	1196	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	85
PID 1196 wrote to memory of 1044	1196	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	85
PID 1196 wrote to memory of 1044	1196	a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe	85
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 2580 wrote to memory of 4940	2580	ylvqwifgustt.exe	92
PID 4940 wrote to memory of 4116	4940	ylvqwifgustt.exe	93
PID 4940 wrote to memory of 4116	4940	ylvqwifgustt.exe	93
PID 4940 wrote to memory of 3648	4940	ylvqwifgustt.exe	98
PID 4940 wrote to memory of 3648	4940	ylvqwifgustt.exe	98
PID 4940 wrote to memory of 3648	4940	ylvqwifgustt.exe	98
PID 4940 wrote to memory of 4792	4940	ylvqwifgustt.exe	99
PID 4940 wrote to memory of 4792	4940	ylvqwifgustt.exe	99
PID 4792 wrote to memory of 5100	4792	msedge.exe	100
PID 4792 wrote to memory of 5100	4792	msedge.exe	100
PID 4940 wrote to memory of 3696	4940	ylvqwifgustt.exe	101
PID 4940 wrote to memory of 3696	4940	ylvqwifgustt.exe	101
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103
PID 4792 wrote to memory of 4856	4792	msedge.exe	103

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ylvqwifgustt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	ylvqwifgustt.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a0bc7ffada538c7f9b3ddbd59b75bedf_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\ylvqwifgustt.exe
    C:\Windows\ylvqwifgustt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\ylvqwifgustt.exe
      C:\Windows\ylvqwifgustt.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4940
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:3648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4792
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbad046f8,0x7ffcbad04708,0x7ffcbad04718
        6⤵
        
        PID:5100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        6⤵
        
        PID:4856
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        6⤵
        
        PID:4224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
        6⤵
        
        PID:1444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
        6⤵
        
        PID:3076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
        6⤵
        
        PID:3540
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
        6⤵
        
        PID:4024
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
        6⤵
        
        PID:2924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
        6⤵
        
        PID:4932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
        6⤵
        
        PID:2372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
        6⤵
        
        PID:3860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,710404593340716335,7010090558727969336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
        6⤵
        
        PID:3552
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\YLVQWI~1.EXE
        5⤵
        
        PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\A0BC7F~1.EXE
    3⤵
    PID:1044

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

_ReCoVeRy_+jydnm.html

Path C:\Program Files\7-Zip\Lang\_ReCoVeRy_+jydnm.html
Size 11KB
SHA256 cd3ac04eb8b4c2e61c4667fbc4b613546196e624e287c7925e991fed29b99377
MD5 9e5a01b6b162c9a1db46be497fb28fc7
SHA1 841b580d3a3678602ecc096e6481116ac82d66be
SHA512 d79dc7bb2e85a0051ab729f3130d5e2b6650d6ffda83a4ff21b0a584ce46d256457d236af35f4781e9a9aab22a4ac2b2ecf71b0ab17326140495769ba5afcf36
SSDEEP 96:B1NdADl1ZMOJtERWRg9Guvzc38POGaMkC0cMRCV60a0zEKwd8/9/NwZoH2YMlfoG:BCJCn/Hp+AOyNX/qdCAukSh2
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ReCoVeRy_+jydnm.png

Path C:\Program Files\7-Zip\Lang\_ReCoVeRy_+jydnm.png
Size 63KB
SHA256 8b1d21f5115484a28759bee1ba00c10b227d406209f9c8d5cf921102aa2189a7
MD5 b935965cd21a190a554931ac4937a6c3
SHA1 033679cca2fd1d4192a0c5c9b1ac2a8fa52b785f
SHA512 b5bba4cdcf8879d95b1d3b38607ce6f0ef76cb6fe2f1121af2300b14d4bbbcca8238af434094a2df986a7ad1ccc574605f1a164cc1820c2d0eddf3bf02a6f81b
SSDEEP 1536:U5sG5kTymSc3Cwjm7rOdncZcznd1ekeHjRJ8LdnpPPigBhP79ZZZZZZZZZZZZZZ6:UgvPmnOdn+crleT8BnpigBR9ZZZZZZZI
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ReCoVeRy_+jydnm.txt

Path C:\Program Files\7-Zip\Lang\_ReCoVeRy_+jydnm.txt
Size 1KB
SHA256 fc1df58808a3c23e597cead5f19bfcdd032b369c879ac258ad7ee8a706a1a4dd
MD5 e65649560ec7bf84cafc820a4f8247eb
SHA1 33b7c4b9b782252df42fdd25ab939c5010cbdfa9
SHA512 eb44ed823feddc30052a35da60b3eb941d780aae00a80ba9f6e51f0232a8ce04c7da92d6377479b3ad81602095d03f62429167fe4ee2c0676e92149bab005c30
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 560B
SHA256 b54b8407032886cfb60cba64f7ba798e42d98c637e0e4b390c11abafa10cdf11
MD5 e43cc1dbab697b91687b170d27d6cf54
SHA1 a84cd0c4f63f2ec5254f0133bdb60bf0b2848106
SHA512 fa6840d02160a3fed2f0afb1ae0e95b2d291b6dacec2787f20f97b92108ed0021d4c84f99a3f655e3f53d84b3c911eb36a1e88f5a6d73deb9c6b5d9978f51552
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 560B
SHA256 5064dd21ad9c129f40b4793dfdcdce8def90dc56198a5086e35a842406ca4b30
MD5 40cc93f98d7050b00d57dadf43e40730
SHA1 4faf9904ca2c1e186b683e2678ae63441ff3a21e
SHA512 077d23585fc1d42e7628f260022f3bdde2d1035512d0d7c5a2ec1bab7ce23191a1cf323a42f8791b3b45c55294d5bc78673fc8349498f57f15d36a5f0a4446b3
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 416B
SHA256 95b4c76ab34f5ba8f2d91c021dab6552dee14f04bd6bb58329693c16f811fc95
MD5 cf9fff2ee45c427eab29d53aacc030eb
SHA1 9730b9b8e8791eb4e970f572cfb52bd510c7a24c
SHA512 c672dc6b1256cba6f87c0e01eb5466db3be2bfc8d139e85a6874d92f343bdce6283ebdc267f5014ed53313e44059b3fb3d568202f0a109c4d47aae103409c935
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 61663b66ac37e783cc75981dd8eb9dfb2ef1925f5b15f95efff793d66470f241
MD5 4d462a3719295f9a1d1943769818106e
SHA1 9d95e77b9423620d80ed4990e516707f5d227fe9
SHA512 d3b0f46e49082be80732c9f0b865beca2b7d52d770e5200b744c03a1752a24f39a627db61fc464c721b9642fbb668615ce43b7bf450b3e302ba0d3119619c1e4
SSDEEP 96:njkhp1nPcj0wpvWMoiVmdeHmQI5UWQyV+VD7AiEwb:njkrRcj0GWMXurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f96d992386adab807b6395b081946789247c4f300a87ff6830abc597acc12c4b
MD5 75473c6197c851b4239532af7799aea8
SHA1 2715d4d1ac23d73c7079467502c6ba35a42c9e26
SHA512 72a32f5b47b09e4137fa24e64d4992a612e75748ac38100ccb8fd3ce47e7eca83aa36c39cb7356afa3f7a125a87f2e325a1de4bfaf7a4524f28029ece52fe742
SSDEEP 96:njkhp1nPEj0wpvWMoiVmdeHmQI5UWQyV+VDCziEwb:njkrREj0GWMXuro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef9a0335e5cc504c69160ae892daa541bb77f18a46af46c366e5b2d0cfc2f548
MD5 1c3fa02987f63b0cf56ed1be6ae7f41f
SHA1 12752b8be814d2d316ff68b836bfcfc2c2297a5e
SHA512 fff2a6aca00b0f7674dc43bd0d1936a2ca559ec214069ccaf11b6115f1346046198fa5a8718efa185e6c3a3d22f2b27933929c39716003eb0bbd4b0a8b50ba40
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQ9e2RUsjIKbNa:A9iIxuERzA83h09RZxYQZ3Na
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596380890952339.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596380890952339.txt
Size 47KB
SHA256 5a23dc7af56767804b3b26f2f187e2e0caf021be7b9130d8bc152c3cce909342
MD5 e8af2c70ed4e339b6814b0c6b1d8f3b6
SHA1 21a94a51425b820ca5cff894e0f9104324a84ba4
SHA512 b43d21f72d02a70efa1f1d190a59a475ef1c341a430f8bb0e4bd167f148e3551374d09c7072953b761c103c08a8cb0301636219cc0d82956fe196436035381ed
SSDEEP 768:5m1p23MplA9tOAIoOfWjz3ynTLPs0napxrYOs+NefYZ3bGq8XGMIsmWq6HZQzYYv:5m1gMw3IXfWjCLPTapxrYOtEYZLGq8Xw
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133596427278316214.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133596427278316214.txt
Size 75KB
SHA256 4e0e1b72d3e43897bcc5c096a6fa41daf1d8666b917c1dd5b04f2ce1b7d4f510
MD5 1be4dbce4ccbe0561bafb9b5055ba47c
SHA1 e727573a219bc35704cbe243e56ccf8da608fc19
SHA512 9ecd31a6fc50e33c467855a45334c8b1bcedd63091e5a23989abc4a8b91e7405d8b76d38ca916c3062d032a99b4d4aabbb364f3a85234ced7edfc6a79d5f92ff
SSDEEP 1536:p/DTSWwr2kseiLvDSLP2/IOnnLuh6jnVRj+/vppWydoTlzNFfOt:p7W7xsLLv4e/IYNjnV8JpWrlZFS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylvqwifgustt.exe

Path C:\Windows\ylvqwifgustt.exe
Size 338KB
SHA256 8314338955eea2aa003277561086290bc5095a81acced4bbd6b54f9f6887b43c
MD5 a0bc7ffada538c7f9b3ddbd59b75bedf
SHA1 15452e55a77ca1c7a55edbbdf2bdf3a3d234f663
SHA512 e2eaa3d5ef63d2f4bf2504f98e4762d713a28ab58b135907d3726fce40d6f8157d007d6a0d77af74cc4478c160de0404d6916f5d1a2dbeb8c2abf24256c350fb
SSDEEP 6144:WSizHT/ObUnIelanG4Ma4cketvLZQxVfREPTTk0xSr:r6HSAnIelK5vlsfqa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1196-2-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1196-6-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1196-5-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1196-3-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/1196-13-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/2580-12-0x0000000000400000-0x00000000004A7000-memory.dmp

Download

memory/3164-4-0x0000000000610000-0x0000000000616000-memory.dmp

Download

memory/3164-1-0x0000000000610000-0x0000000000616000-memory.dmp

Download

memory/3164-0-0x0000000000610000-0x0000000000616000-memory.dmp

Download

memory/4940-17-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-9403-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-10458-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-10459-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-10467-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-10468-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-5701-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-3168-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-2860-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-25-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-23-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-20-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-19-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-18-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4940-10551-0x0000000000400000-0x0000000000486000-memory.dmp

Download