teslacrypt | 36f910cf4a63afa86b711c14d4aecca3f4887232ba341d7581a0e5baa0fd916c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
Size

384KB
MD5

adef96848ae6e61ed0d3782f6711239b
SHA1

581aaca2d5fafadef12a0ad1556d7e149a71da50
SHA256

36f910cf4a63afa86b711c14d4aecca3f4887232ba341d7581a0e5baa0fd916c
SHA512

4860fe56a5dc55087a8e152d5b4d87f00941721d2ae2787e6e3bc6b79db5df228537d66d2750f95aab6d0ab685c28a51e223141bb3256bc91fc89abb2e4a7d94
SSDEEP

6144:FtguKU1XD9oEmWMF6L2IzjAqXuxoaqHwdfOUavNJ3en9THb3IA/OYILI:kuRBoOc4js11GUfVsNJ3entMAWp

Score

10^/10

teslacrypt defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+mthqd.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6DC472B792A4CAA5 2. http://tes543berda73i48fsdfsd.keratadze.at/6DC472B792A4CAA5 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6DC472B792A4CAA5 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/6DC472B792A4CAA5 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6DC472B792A4CAA5 http://tes543berda73i48fsdfsd.keratadze.at/6DC472B792A4CAA5 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6DC472B792A4CAA5 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/6DC472B792A4CAA5

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6DC472B792A4CAA5

http://tes543berda73i48fsdfsd.keratadze.at/6DC472B792A4CAA5

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6DC472B792A4CAA5

http://xlowfznrg4wf7dli.ONION/6DC472B792A4CAA5

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (874) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exessyxddomtoqv.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	ssyxddomtoqv.exe

Drops startup file 6 IoCs

Processes:

ssyxddomtoqv.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+mthqd.html	ssyxddomtoqv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+mthqd.html	ssyxddomtoqv.exe

Executes dropped EXE 2 IoCs

Processes:

ssyxddomtoqv.exessyxddomtoqv.exe

pid process

3760 ssyxddomtoqv.exe
2388 ssyxddomtoqv.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3760	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ssyxddomtoqv.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xxocnpngnutw = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\ssyxddomtoqv.exe\""	ssyxddomtoqv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exessyxddomtoqv.exe

description	pid	process	target process
PID 4584 set thread context of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 3760 set thread context of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe

Drops file in Program Files directory 64 IoCs

Processes:

ssyxddomtoqv.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-125.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\2px.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-400.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\Recovery+mthqd.html	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-200.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\MapLightTheme.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\F1EDBDC1-D9A9-48D7-8932-1D30457683D7\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_24x24x32.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailSmallTile.scale-150.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-200.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-400.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\WideTile.scale-100.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100_contrast-white.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_0_Loud.m4a	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-100.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pt-PT\Recovery+mthqd.html	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\logo.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MoveToFolderToastQuickAction.scale-80.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-Toolkit\Images\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gl\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-32.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+mthqd.html	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-20.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-24.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-100.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-400.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-100_contrast-white.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageSmallTile.scale-400.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\PaySquare150x150Logo.scale-200.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-400_contrast-black.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\THMBNAIL.PNG	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_contrast-white.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\Recovery+mthqd.html	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileLargeSquare.scale-200.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-40.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.scale-100.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\Recovery+mthqd.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-ES\View3d\Recovery+mthqd.txt	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\Recovery+mthqd.html	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-60.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\WideTile.scale-200.png	ssyxddomtoqv.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\Recovery+mthqd.html	ssyxddomtoqv.exe

Drops file in Windows directory 2 IoCs

Processes:

adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\ssyxddomtoqv.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
File opened for modification	C:\Windows\ssyxddomtoqv.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

ssyxddomtoqv.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings ssyxddomtoqv.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

5104 NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	ssyxddomtoqv.exe

pid	process
5104	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ssyxddomtoqv.exe

pid	process
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe
2388	ssyxddomtoqv.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4760 msedge.exe
4760 msedge.exe
4760 msedge.exe
4760 msedge.exe
4760 msedge.exe
4760 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exessyxddomtoqv.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1476	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
Token: SeDebugPrivilege	2388	ssyxddomtoqv.exe
Token: SeIncreaseQuotaPrivilege	2020	WMIC.exe
Token: SeSecurityPrivilege	2020	WMIC.exe
Token: SeTakeOwnershipPrivilege	2020	WMIC.exe
Token: SeLoadDriverPrivilege	2020	WMIC.exe
Token: SeSystemProfilePrivilege	2020	WMIC.exe
Token: SeSystemtimePrivilege	2020	WMIC.exe
Token: SeProfSingleProcessPrivilege	2020	WMIC.exe
Token: SeIncBasePriorityPrivilege	2020	WMIC.exe
Token: SeCreatePagefilePrivilege	2020	WMIC.exe
Token: SeBackupPrivilege	2020	WMIC.exe
Token: SeRestorePrivilege	2020	WMIC.exe
Token: SeShutdownPrivilege	2020	WMIC.exe
Token: SeDebugPrivilege	2020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2020	WMIC.exe
Token: SeRemoteShutdownPrivilege	2020	WMIC.exe
Token: SeUndockPrivilege	2020	WMIC.exe
Token: SeManageVolumePrivilege	2020	WMIC.exe
Token: 33	2020	WMIC.exe
Token: 34	2020	WMIC.exe
Token: 35	2020	WMIC.exe
Token: 36	2020	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2020	WMIC.exe
Token: SeSecurityPrivilege	2020	WMIC.exe
Token: SeTakeOwnershipPrivilege	2020	WMIC.exe
Token: SeLoadDriverPrivilege	2020	WMIC.exe
Token: SeSystemProfilePrivilege	2020	WMIC.exe
Token: SeSystemtimePrivilege	2020	WMIC.exe
Token: SeProfSingleProcessPrivilege	2020	WMIC.exe
Token: SeIncBasePriorityPrivilege	2020	WMIC.exe
Token: SeCreatePagefilePrivilege	2020	WMIC.exe
Token: SeBackupPrivilege	2020	WMIC.exe
Token: SeRestorePrivilege	2020	WMIC.exe
Token: SeShutdownPrivilege	2020	WMIC.exe
Token: SeDebugPrivilege	2020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2020	WMIC.exe
Token: SeRemoteShutdownPrivilege	2020	WMIC.exe
Token: SeUndockPrivilege	2020	WMIC.exe
Token: SeManageVolumePrivilege	2020	WMIC.exe
Token: 33	2020	WMIC.exe
Token: 34	2020	WMIC.exe
Token: 35	2020	WMIC.exe
Token: 36	2020	WMIC.exe
Token: SeBackupPrivilege	2872	vssvc.exe
Token: SeRestorePrivilege	2872	vssvc.exe
Token: SeAuditPrivilege	2872	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4048	WMIC.exe
Token: SeSecurityPrivilege	4048	WMIC.exe
Token: SeTakeOwnershipPrivilege	4048	WMIC.exe
Token: SeLoadDriverPrivilege	4048	WMIC.exe
Token: SeSystemProfilePrivilege	4048	WMIC.exe
Token: SeSystemtimePrivilege	4048	WMIC.exe
Token: SeProfSingleProcessPrivilege	4048	WMIC.exe
Token: SeIncBasePriorityPrivilege	4048	WMIC.exe
Token: SeCreatePagefilePrivilege	4048	WMIC.exe
Token: SeBackupPrivilege	4048	WMIC.exe
Token: SeRestorePrivilege	4048	WMIC.exe
Token: SeShutdownPrivilege	4048	WMIC.exe
Token: SeDebugPrivilege	4048	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4048	WMIC.exe
Token: SeRemoteShutdownPrivilege	4048	WMIC.exe
Token: SeUndockPrivilege	4048	WMIC.exe
Token: SeManageVolumePrivilege	4048	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exeadef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exessyxddomtoqv.exessyxddomtoqv.exemsedge.exe

description	pid	process	target process
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 4584 wrote to memory of 1476	4584	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
PID 1476 wrote to memory of 3760	1476	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	ssyxddomtoqv.exe
PID 1476 wrote to memory of 3760	1476	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	ssyxddomtoqv.exe
PID 1476 wrote to memory of 3760	1476	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	ssyxddomtoqv.exe
PID 1476 wrote to memory of 3708	1476	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	cmd.exe
PID 1476 wrote to memory of 3708	1476	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	cmd.exe
PID 1476 wrote to memory of 3708	1476	adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe	cmd.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 3760 wrote to memory of 2388	3760	ssyxddomtoqv.exe	ssyxddomtoqv.exe
PID 2388 wrote to memory of 2020	2388	ssyxddomtoqv.exe	WMIC.exe
PID 2388 wrote to memory of 2020	2388	ssyxddomtoqv.exe	WMIC.exe
PID 2388 wrote to memory of 5104	2388	ssyxddomtoqv.exe	NOTEPAD.EXE
PID 2388 wrote to memory of 5104	2388	ssyxddomtoqv.exe	NOTEPAD.EXE
PID 2388 wrote to memory of 5104	2388	ssyxddomtoqv.exe	NOTEPAD.EXE
PID 2388 wrote to memory of 4760	2388	ssyxddomtoqv.exe	msedge.exe
PID 2388 wrote to memory of 4760	2388	ssyxddomtoqv.exe	msedge.exe
PID 4760 wrote to memory of 4720	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4720	4760	msedge.exe	msedge.exe
PID 2388 wrote to memory of 4048	2388	ssyxddomtoqv.exe	WMIC.exe
PID 2388 wrote to memory of 4048	2388	ssyxddomtoqv.exe	WMIC.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe
PID 4760 wrote to memory of 4024	4760	msedge.exe	msedge.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

ssyxddomtoqv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ssyxddomtoqv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	ssyxddomtoqv.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\adef96848ae6e61ed0d3782f6711239b_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\ssyxddomtoqv.exe
    C:\Windows\ssyxddomtoqv.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Windows\ssyxddomtoqv.exe
      C:\Windows\ssyxddomtoqv.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2388
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:5104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa988346f8,0x7ffa98834708,0x7ffa98834718
        6⤵
        
        PID:4720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
        6⤵
        
        PID:4024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
        6⤵
        
        PID:4340
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
        6⤵
        
        PID:2200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
        6⤵
        
        PID:4408
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
        6⤵
        
        PID:5088
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
        6⤵
        
        PID:3712
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
        6⤵
        
        PID:4472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
        6⤵
        
        PID:3440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
        6⤵
        
        PID:184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
        6⤵
        
        PID:4744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1456,14433697443973922843,14920626582976363406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
        6⤵
        
        PID:2776
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4048
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\SSYXDD~1.EXE
        5⤵
        
        PID:4448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\ADEF96~1.EXE
    3⤵
    PID:3708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+mthqd.html

Filesize
11KB

MD5
b07f38f7976d86cf0565e2470e2c7b31

SHA1
48ea227ba800c87bf8739ec53c0ea15dc5ee3170

SHA256
1075739b8de0a6a1cfd67993cb07f65504192055ecf7d981bf28d6cd09b4fcc5

SHA512
dd6add312ba54257e399b0f6d58288dc0c54292285e49aceaf8f76dc685f2a92d4a386611bd27575e4c0dfa28ba456e1fbd84e4ff0dfb9793f61c346b3a5084c

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+mthqd.png

Filesize
64KB

MD5
5aa52bbc0ee019f2c4303178d8cf06ea

SHA1
5108e1a1cb52f86447872aa5ed3fd6ed3306d996

SHA256
5a75f8e9b39af6974803323fa74cdac86084746bbef0b4d9458102ec590a9bbe

SHA512
4cc8e48261c42e40e8c323c68409b3979873211f36672d365e9befd6a3ae74e6af80fdad4afc116058addee572056ba6399c9ca5de911921fdb8f7cfa72a165f

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+mthqd.txt

Filesize
1KB

MD5
eb2645bf745192f2ac407a0f2b20d50f

SHA1
ab113606249770f204f193601e84cce3c5c4cd1f

SHA256
98d629766711d3bd5914ad75cf4586f11cf1af831fd97c0d765e29fb7b9a7286

SHA512
f6b6bfc7cc6109b98c787cffe509cb5d6c5a379ef3c91488ef1ec27bd4d3b1a6d9bc42d1730197d45f4ae06b66aabdd583567acb7db475c540595f429cc199aa

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
cec0a40b735ac6cbb02c4e6b82922335

SHA1
a3e6e9893a6550205d0b59cbed5ea09e9a1d3584

SHA256
3f544de3653cf300fcd53bf64449903ef18e249a484324890043d18d5fbf8e98

SHA512
6a541c519868c93a265a6a7f6b76a3ad21f8d10666ecb23adc93cdad08470e4e79c4d28781a03d9f6c39ba089ba3996b1654af49160182c86fa75393fc34df0f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
36e87e6236b7b8b9e68242203e1bde9b

SHA1
e3b51036a0b1c30e6fbe41332b20a172d516ce6f

SHA256
0e84ab399c8d1aee88433c33998e36146e7710efdbfd4b7c2362b7813e2f8b3c

SHA512
48d540067e59a078f762d878e768417b961f5813bbecfc749d0ce14ad67034d8861bf49f66e47fb809c466d296f2a15fa82aa7847e643a750550f762f34d1a2c

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
51b03bc9d23a844df312d07bab588d77

SHA1
68680449edab7521f4dab87319520411f9e0e493

SHA256
49f073ec914dc763b57273438b1993913c279f3615181cb5511b33d6dff37bfd

SHA512
050f84fd321e5d943bb3674f490228c86ce82c22772060743b5342204449ae0ba1fec0b0d32a27e456cb532e62d9869aa5185251268023075f77582881b91eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9899d002-5a8e-4606-992a-f1b96e2a0777.tmp

Filesize
11KB

MD5
3c3f5b374a295ce52e4abf7607fa23f5

SHA1
9aa34282a46a753d326f83737df835205f597ab8

SHA256
16973f5cfadb5e211f9adfb2ca27f270361b37792f1b08ceff680c63e70726f9

SHA512
e9c037373731ff4ffdf814b02fa265a67f1d41a1478c6fdf5b771944d238619aade393a9214a74e3a6bb2f02e621bd2a75f74e306381eb1f65b7a437189488e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81b70d2f7360b0dd1e934283bde4ce96

SHA1
60b18b0fb8bf815bea64d64fd9fafd8c7a96a4cb

SHA256
b282d945e53fb579bf74c1a1b0a2ad4371a008f18973516474f07125394c0b0a

SHA512
6ebfb385c14378412776a22c3af475026035a585e95970bf3fa64c28f1984caf3630b2816cffb22ad2bf129bd3d9148f63dd0f502e7de84f37c7c13e9ac4065f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b4ecf70f4a6da3193725922514e5697

SHA1
3650efa0a39aa5840dbe0e62d17d742e90735cfc

SHA256
04e2e27c75b1f5f6ffcedb3ddde08a27ef2c5c96d79046658a762bb9d39f3eed

SHA512
d8b78b8eab0e3676cf00600a88c1be638035b3191a4c7f4fdf3fb3e14e0d55fb176bbfd2b1bca57251c59137f952ffded85637609e303c24f87824ae58122b88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133626047837275686.txt

Filesize
77KB

MD5
e4b94e1533c9d8af3d4d6890918ef1a6

SHA1
357e8808dafca229819a119123a716f1340ec3c4

SHA256
b8888663e2391a94c3d1dbd50d5636233be4e20d87b7417d060d67c00b5c2e9a

SHA512
08150a32e0da16de02db3de884699c27fbd2d91a7b1a64f95d1f817055da6e467240d201b292165a2a5a53aea863d7e320940d365bd69d173769b9133915f17b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133626089299944182.txt

Filesize
75KB

MD5
6730324d542e2b7345bde4b3f274bb1e

SHA1
92725ab42d7bb897d810550a5072f38f8278520b

SHA256
9ada438a10e7607214e5119785659666bceace5fb6310cc8c2513ba89bdfabc8

SHA512
5a37211e062d456194bf86bbc0ab5edc107077a438035d9a016a27fdd111a504f616d61f831b0f12f22a98ebd5200676bf6ec1e98c3628ed33d7c2ece8110200

Download Submit
C:\Windows\ssyxddomtoqv.exe

Filesize
384KB

MD5
adef96848ae6e61ed0d3782f6711239b

SHA1
581aaca2d5fafadef12a0ad1556d7e149a71da50

SHA256
36f910cf4a63afa86b711c14d4aecca3f4887232ba341d7581a0e5baa0fd916c

SHA512
4860fe56a5dc55087a8e152d5b4d87f00941721d2ae2787e6e3bc6b79db5df228537d66d2750f95aab6d0ab685c28a51e223141bb3256bc91fc89abb2e4a7d94

Download Submit
\??\pipe\LOCAL\crashpad_4760_GUDXWJWHMJKGPVDR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1476-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1476-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1476-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1476-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1476-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-10400-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-2512-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-5009-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-25-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-23-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-8360-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-10391-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-10392-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-513-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-10401-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-20-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2388-10440-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3760-12-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4584-0-0x0000000000A10000-0x0000000000A13000-memory.dmp

Filesize
12KB

Download
memory/4584-4-0x0000000000A10000-0x0000000000A13000-memory.dmp

Filesize
12KB

Download
memory/4584-1-0x0000000000A10000-0x0000000000A13000-memory.dmp

Filesize
12KB

Download