hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/ransomwares/ViraLock[.]zip

Resubmissions

02-08-2024 15:50

240802-s99tasvdre 6

02-08-2024 15:45

240802-s7jjbsvdlb 10

Analysis

max time kernel
46s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 15:50

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/ViraLock.zip

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
42	raw.githubusercontent.com
43	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
3092	msedge.exe
3092	msedge.exe
8	identity_helper.exe
8	identity_helper.exe
4112	msedge.exe
4112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3960	[email protected]

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3960	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 1124	3092	msedge.exe	81
PID 3092 wrote to memory of 1124	3092	msedge.exe	81
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 4856	3092	msedge.exe	83
PID 3092 wrote to memory of 440	3092	msedge.exe	84
PID 3092 wrote to memory of 440	3092	msedge.exe	84
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85
PID 3092 wrote to memory of 5076	3092	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/ViraLock.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd16d946f8,0x7ffd16d94708,0x7ffd16d94718
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,12377871382978990424,7752884408311355510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5104

C:\Users\Admin\Downloads\Petya.A\[email protected]
"C:\Users\Admin\Downloads\Petya.A\[email protected]"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fe654dc0654d3ffd403f6c8ad1f7cb2b

SHA1
1c6e16edc83ffdca98661fa508e1b4cc2fbfacb0

SHA256
97f336065e43fe5c12d4fe76dab7b3debc7f05c7a5fb3e4eb518f11091f01d51

SHA512
bc7050aab8fa8c7e8c40626bac1df67633d2db3bd0e02f578213dbc5209494639d304cae96fb120e2af44519dfb66582f158b1fd05b5e1ab2246949767fc1f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d44757b2d186f94a4332b25cc834a44

SHA1
ad66fd2f365ba74d2bafafc2e37ab2700790f23f

SHA256
cec406353ff0f013a64d8c5d8e6e724ff6194ba1c6296bbc49211b31c153ea41

SHA512
ac5773397fe3bbfbf7cc2c5f2a145ae6a71940ecfbe61b4ff14e0c4e8ce1ccdcac9e5f928da08058ad2bc8002e5bbf27d65ef4327c3fff0029d3c87100bebb97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9aedc9ddf925c50780a9cff0c1f9c112

SHA1
2fed716f4a88bf35923ad98d507701cf981a1ea0

SHA256
1c25a6450dbb2646622a35944dd1b499077a26f20f2ad55b6c534538cd0654dd

SHA512
bf394f1eda3bdb47bfc6c9bb8f00f911df552e1bebaafa6ecaba53d8d7450bd0cf9cbb32bafc06a97bbf7291db17f7507d6a37c49e624335917c6e0bf8bd1864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d328c5cb0b44a432d535ba221e4b400

SHA1
67c9cb1d5e1d121ee7cb4ac801c1da2a558914b4

SHA256
03cbfc875b5f66b2be26d416a3a109716c01773a4b6ccb4c016df8352963b83b

SHA512
37144e91077dda2214f8dce565ccf395916eee6628f42f2a540341b1f1b17d8bb6b769028403fac0ff94ac00d47fa104ee7c3602f4f5796bd53a7413b4fcb4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
70367b8c1a09a5d3795ccc6254288044

SHA1
212148d498d867ee568007efaceab7208766b8bc

SHA256
24bd2f699d0e5d6a706230c256f5c8656ca11aa179f018383dece4ca4dccccdf

SHA512
7710b10d237804a64f4a44ff19650d8c178c23051104cd056d99465d2fa84634e6c375ff4b40e08b8086b4ca632c28a1381063245b56c07e79ee2d444c4c8d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b8c1.TMP

Filesize
874B

MD5
17f4da341fe3d6d9f9685b89426c215f

SHA1
f4d6acc2af6862b76b22d45c5d35a5583c985315

SHA256
196942802a936607a9a1efcc661f290ea7f340b4fde5e97dfa3ca8b86e5431e1

SHA512
530350de82c2d76e2fbc572b84885e8da1e558066943b889f8f284e00ac29fa9ea2f9a3bd7d6da34e50cf510b5addd5a51fbfd44e9a1cc7431d24a1cd9f9b431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3627ec14508dc06d3fa65b76771bda22

SHA1
ce43897e382df798df1b4f50166cad5d6baf6523

SHA256
53b095a38499783d95894b804bf50125b3813cee21f0d8139eefd9a9f63e68f0

SHA512
93ddc9af546c81a2a1e6652a887d265ef839d29d4cfd23d2741ecd6c75f8e25015cdc5aaf9948d7d02203e266d933a18772e6700e8b16d248b2b1d00172dead8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2c1ae44146fff86e2820771aa7fc4b3b

SHA1
e28327c0282b6600751f7376f9d04ebc7cd79107

SHA256
811514056b1468ffa36e73e2f1fa42672afea6f7cbf4c786957c58be45cbcdd2

SHA512
3394e82699fd057b6e9607c0bbcd02e77cfba1de01135c03e63b22bb6978f064986464202085d57c6e2a373453e6869e7bde9e7f0ea85cf299c82c1269c3ee25

Download Submit
C:\Users\Admin\Downloads\Petya.A.zip

Filesize
128KB

MD5
1559522c34054e5144fe68ee98c29e61

SHA1
ff80eeb6bcf4498c9ff38c252be2726e65c10c34

SHA256
e99651aa5c5dcf9128adc8da685f1295b959f640a173098d07018b030d529509

SHA512
6dab1f391ab1bea12b799fcfb56d70cfbdbde05ad350b53fcb782418495fad1c275fe1a40f9edd238473c3d532b4d87948bddd140e5912f14aff4293be6e4b4c

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads