troldesh | e1838e460e19fe98e9cc54bb694e491cc2f4b37ab06e3ea1f7540a0262a82189

Resubmissions

04/08/2024, 08:00

240804-jwfhvsvcpc 3

04/08/2024, 07:57

240804-jte5bazfrl 6

04/08/2024, 07:46

240804-jmc2dazekk 10

Analysis

max time kernel
217s
max time network
229s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2024, 07:46

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

music-note-1275650_960_720.webp
Size

7KB
MD5

866f908684d6f1d93f2c8efd1b065a58
SHA1

ba5e7051fa2a8273c5cd397b1131b5deed98e089
SHA256

e1838e460e19fe98e9cc54bb694e491cc2f4b37ab06e3ea1f7540a0262a82189
SHA512

353811cffa56ae87937ba5ba52431088554240f508fc0a452fa59b8fe01438699ed28ae1943e9f7564c84eead208f6be9d7b04afb1eb1128640d46ef4e95a07a
SSDEEP

192:rhx7CtG7VryH5F+W2DFhIHILq9hPS/SlzZ:rX7EGRr+IWGhPq95OC

Score

10^/10

troldesh discovery evasion persistence ransomware trojan upx

Malware Config

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
Disables Task Manager via registry modification
evasion

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5052-481-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/5052-483-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/5052-485-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/5052-482-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/5052-501-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/5052-529-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/5052-532-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/5052-535-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/5052-559-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral2/memory/5052-563-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	[email protected]

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\A:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\N:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
99	raw.githubusercontent.com
100	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Desktop\Wallpaper	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5052	taskkill.exe
944	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{D293D15F-BEDA-45FC-9647-3EEA952B6C5E}	[email protected]
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{9131F5B6-962C-4E81-8352-2FFB87287F23}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	[email protected]

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
2872	msedge.exe
2872	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe
2204	msedge.exe
2204	msedge.exe
996	msedge.exe
996	msedge.exe
5052	[email protected]
5052	[email protected]
5052	[email protected]
5052	[email protected]
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
744	msedge.exe
744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	taskmgr.exe
Token: SeSystemProfilePrivilege	4976	taskmgr.exe
Token: SeCreateGlobalPrivilege	4976	taskmgr.exe
Token: 33	4976	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4976	taskmgr.exe
Token: SeDebugPrivilege	5052	taskkill.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeShutdownPrivilege	1244	[email protected]
Token: SeCreatePagefilePrivilege	1244	[email protected]
Token: SeIncreaseQuotaPrivilege	524	WMIC.exe
Token: SeSecurityPrivilege	524	WMIC.exe
Token: SeTakeOwnershipPrivilege	524	WMIC.exe
Token: SeLoadDriverPrivilege	524	WMIC.exe
Token: SeSystemProfilePrivilege	524	WMIC.exe
Token: SeSystemtimePrivilege	524	WMIC.exe
Token: SeProfSingleProcessPrivilege	524	WMIC.exe
Token: SeIncBasePriorityPrivilege	524	WMIC.exe
Token: SeCreatePagefilePrivilege	524	WMIC.exe
Token: SeBackupPrivilege	524	WMIC.exe
Token: SeRestorePrivilege	524	WMIC.exe
Token: SeShutdownPrivilege	524	WMIC.exe
Token: SeDebugPrivilege	524	WMIC.exe
Token: SeSystemEnvironmentPrivilege	524	WMIC.exe
Token: SeRemoteShutdownPrivilege	524	WMIC.exe
Token: SeUndockPrivilege	524	WMIC.exe
Token: SeManageVolumePrivilege	524	WMIC.exe
Token: 33	524	WMIC.exe
Token: 34	524	WMIC.exe
Token: 35	524	WMIC.exe
Token: 36	524	WMIC.exe
Token: SeIncreaseQuotaPrivilege	524	WMIC.exe
Token: SeSecurityPrivilege	524	WMIC.exe
Token: SeTakeOwnershipPrivilege	524	WMIC.exe
Token: SeLoadDriverPrivilege	524	WMIC.exe
Token: SeSystemProfilePrivilege	524	WMIC.exe
Token: SeSystemtimePrivilege	524	WMIC.exe
Token: SeProfSingleProcessPrivilege	524	WMIC.exe
Token: SeIncBasePriorityPrivilege	524	WMIC.exe
Token: SeCreatePagefilePrivilege	524	WMIC.exe
Token: SeBackupPrivilege	524	WMIC.exe
Token: SeRestorePrivilege	524	WMIC.exe
Token: SeShutdownPrivilege	524	WMIC.exe
Token: SeDebugPrivilege	524	WMIC.exe
Token: SeSystemEnvironmentPrivilege	524	WMIC.exe
Token: SeRemoteShutdownPrivilege	524	WMIC.exe
Token: SeUndockPrivilege	524	WMIC.exe
Token: SeManageVolumePrivilege	524	WMIC.exe
Token: 33	524	WMIC.exe
Token: 34	524	WMIC.exe
Token: 35	524	WMIC.exe
Token: 36	524	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1948	WMIC.exe
Token: SeSecurityPrivilege	1948	WMIC.exe
Token: SeTakeOwnershipPrivilege	1948	WMIC.exe
Token: SeLoadDriverPrivilege	1948	WMIC.exe
Token: SeSystemProfilePrivilege	1948	WMIC.exe
Token: SeSystemtimePrivilege	1948	WMIC.exe
Token: SeProfSingleProcessPrivilege	1948	WMIC.exe
Token: SeIncBasePriorityPrivilege	1948	WMIC.exe
Token: SeCreatePagefilePrivilege	1948	WMIC.exe
Token: SeBackupPrivilege	1948	WMIC.exe
Token: SeRestorePrivilege	1948	WMIC.exe
Token: SeShutdownPrivilege	1948	WMIC.exe
Token: SeDebugPrivilege	1948	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe
4976	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1244	[email protected]
1244	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2872	3020	cmd.exe	85
PID 3020 wrote to memory of 2872	3020	cmd.exe	85
PID 2872 wrote to memory of 3304	2872	msedge.exe	87
PID 2872 wrote to memory of 3304	2872	msedge.exe	87
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 1444	2872	msedge.exe	89
PID 2872 wrote to memory of 4140	2872	msedge.exe	90
PID 2872 wrote to memory of 4140	2872	msedge.exe	90
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91
PID 2872 wrote to memory of 2012	2872	msedge.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\music-note-1275650_960_720.webp
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\music-note-1275650_960_720.webp
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffb9ad146f8,0x7ffb9ad14708,0x7ffb9ad14718
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=216 /prefetch:8
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6236 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14842903741839305350,17161536005375679224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
    3⤵
    PID:1456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:620

C:\Users\Admin\AppData\Local\Temp\Temp1_NoMoreRansom.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_NoMoreRansom.zip\[email protected]"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:3640

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4976

C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\[email protected]"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='UR NEXT'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:524
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'UR NEXT'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /f /r /t 0
    3⤵
    PID:1728

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa393b855 /state1:0x41c64e6d
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windows\csrss.exe

Filesize
1.4MB

MD5
63210f8f1dde6c40a7f3643ccf0ff313

SHA1
57edd72391d710d71bead504d44389d0462ccec9

SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
33a0734d97c0134923bca3821d9b72ea

SHA1
b1f6a6e0595e1f9883773bb37a78e9c9a4014c25

SHA256
a8aafc7e193acf8026c7b72e3e5156e37abf07deaa9df5524d79c8fe8f21d743

SHA512
38a6050923b770eb6d4248a1b4a7e1441f84f1c672ce55d1483232168babe6b13f3f8847d688164c041d05177b8ff353f13ab353e588d0aea1438c586de1c8b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
895B

MD5
4b052978cab531bf2440feae3100e46d

SHA1
9d71bd7e0407e5c769843cae821359af1b7d10a9

SHA256
8d9c954271ff7cbf4e75cf4c126eeeb0ba642b9dea362c879aed964fbc8d0783

SHA512
7b2f499bdd1a7d1dd8baf6b9caa4d9c91f596ea3f1bf19f2d1f11fa5516981e062f58d8eb1d8425386b7a59178fb720e7407c9ddba4cd666603d5165b9f3fb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19f546a8886f72a4a43e19d6f70fa2de

SHA1
cb10b66deb4460d46bd8ff9ee70968bbfe2e1896

SHA256
8ef1ebdf4864be29e9fc23f5089963a8476e5fda86682bcdc9a2e59981a1703f

SHA512
952d7cd70da5db7e126d7654771fcacc9a57b09a563c0cd412c4e0fba5362c948e190c76718ecd0f4b35efe5221a1e226f241711b4facfa9c01378ec5e77f93c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23b595a4d3e47a7aba4d0810f26b06bd

SHA1
2adfa5762604af76d4691895ab2ea6523666de3e

SHA256
1b1eb6bc0f518e1b67244b467d22712de01dac44a11a9653fa3725c3bad49bf2

SHA512
93975b1b83a99287548e3a7f64e1e1a5b1582a01da2024531c3087ca0b7cb02e5600aaadd4a5c501682373ec43621c5de873b7af35f60d2a5f6dfdff82ea8d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
680443b7e2806170deb7d3e2d0516fdb

SHA1
5f27a565acaf728e23dc409c512aa1074820fdbd

SHA256
9fecb87b6c24a89c57e7099c36b6966b719d595413079c21a517d44b3a2fb00f

SHA512
d93623a009933a6ff2eda77fd3ef63724700ac8b87a7328fa673b43ad1d3cdd4d4a03671e8719e8f809c01b5ad616fa853137f7badc50e2f61c3ecc7e84deddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
99e77c9fd9d5b5cec2a7b95665ea49dc

SHA1
14d35128df0e6a8b9942fb9fb2c6b393205613d7

SHA256
5c69ed23e5bc461aa12b99ff0c9027b1f80bc3c5d101d9ff0bb967dbe0b6a0ea

SHA512
f79472fbd14225703c821929969cd711cde7da92a9ee5d9576997e7bfffe4796e2d460d67e5f519efec4193f60cfa9f32568e2dc42d6580a876c8616980bdaf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d410abdb15452a5f383f12cfcd4bef47

SHA1
45a4b2b69348d715d49fc3a805759b2b9fdddf64

SHA256
b26a6863ae7fbe912ef58438d0d7a8e0c50f0807a9ca993b9a2f5f804f74d28f

SHA512
1fa39b081de11f52cded105d7c4b4ed15e093145d7ff484dbbe17081a1ebb1f3345e9ce824f82ca2671f0a81405166f66d7f474b39361da706293d19f4ba9d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2f766d0d1065fda1cdfd667d4a6e2e27

SHA1
d9b4b7388ee2361ae7087e9f430f74cdd7499227

SHA256
f0f9205e4ac29735c5893ed597589d27297aec735c31489a49326b7391dbf065

SHA512
0131ea84aedc4d427b6a218619df271358af4623f809ec6a1cc37e8365408e1e419c05586b9bedac9abe07bcdeef4d64f8b7bb46b0a8a45b1f80470e050e56aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
baa6fe1959c0bfaa53832c4d6165b53d

SHA1
a20260114887dd3445f9820830ccaceabde955fd

SHA256
035d349a4d07354da0a471af1f36217cbb2def4a9f33d4aa9211017f50d44495

SHA512
1802f15fc0adefe30b7dc5a6e0dccf7bf651d04c36cb20f27745113f25151a337255429424f9669f0ca1c2f434598b65e4ba6fbcbaea72fc1a9bc10a000da96c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
44860e1b872327547d4612694668e79b

SHA1
ac0401c1e8b1a5a1d66de40966185defaa160223

SHA256
2ce7b5555f7bfe609ca4e8627caf8e834c33e8f2912d3b5258e6a8b741adfce8

SHA512
aebb40455fd6b9863e6dced72e18e25958b62de528fe3de9f705d5e9f27674c44dbca86d603f6ece8b573b313d9dbc8da1b71b5aa35d1284c0cf6cc47b5045d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a6e84ab8ba444119355a707eb501ae58

SHA1
4e5145a94481fd0ec15b7063a7763d33f8056363

SHA256
fec0ce264320030d82c1d5048e69007457bc2f351c01449249874538a0d32ac0

SHA512
05f9480e405d21f680fb0c7aa2606140993a41cd36704ed4855c9f1d308d07ecd92c8cacd7220bcff9b53b612de248881ac67a117e9e42e2800c909ea6f0995e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2139e96cf902399f4dcc25ba3a653bab

SHA1
1e9ffe3df2973656276e27dbb7fb376fab9fbb77

SHA256
8550deae6476a06773313eea64ea53ebfb63c5132f3b2d50487431e62dc91d4f

SHA512
65b2ef974c5811ac7adf4e6489025d86bda8867a2c0e5d188e1af8bc21c02292e6ed321851f564a7cf72444f7cfa9c3b7f102805f7738a6b60bd557f28dda7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c3078f10634fffab0a715d943a013e9

SHA1
718d48d2461b0f0f3b2fb9d97f20571adbfa53fc

SHA256
7b50679259753a978e0a5fdc291fc07d7e563bc2ab0095a0fe6a225e60e604f5

SHA512
6261c823092aa10932f29cabe4b75ec03d91309c2467d54d3eef10661ea9c24adcf60040a1ef8db1ba656a5ecfba298e586ec288bb62cab8f4164ff9fb7d5f56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589248.TMP

Filesize
1KB

MD5
91da900b66de1a85ec4d7ddc1134bfa7

SHA1
5c1be1172d6b0938d0efeea0cc36dff249c26cf6

SHA256
430c9a26e59e2790dd0e523de41f94608ddbd7095a25340acf7c5177b0200610

SHA512
367b988e7d331343d7842b779ce789b17a7b1a37309579f7eddb909dd1f8736ac0fc88c620910c21e4bddcaea1e6a2121a520bf848bc2f04b6eec0dc09e79615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb4ed3cc799f651a57d7534c27aedf65

SHA1
1160c07c01297d44dbee7d89e7c31afebaaf0f37

SHA256
7645c2e1f256e1fad1ff77e0cab5978d0c549e62cffb236c0f8d20ad9256d20a

SHA512
3b34db846f1fe9481fe5c225f11b51d5ff8c97ab7a05a6a11b5ab79ca327b9773c9b6cac92aa4f5a263973a6fac3acbdee1951143830e14135975cd65705840b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
234eea7f1cc8c46fc530507a2a89aac0

SHA1
6820b0cf6aab12ba90fccb79971711cad12ad9e8

SHA256
ee5f25be1e234b588a20691cca3411a837156900e57e772c610e3699734f5909

SHA512
5b86cb2103a6bc1a9f99355449b88ee5542dc3c3bb8048e069136da07e810f9ccc844e50c6d87d6f9b3d00286dadbbb185ca6aac555b18db1337a3082ca66be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b556a3502dfbe3c4725abfa2fb118e6

SHA1
755bda29a742ae5904802eb487560d50893d4498

SHA256
aece74fce850d70265c1c43c2384de1b5f7674f0eee2ba56dc0c47e31b48cc6f

SHA512
dcb1d1c9f1575d485f09ed09cb62137f3fd35034319a53ab01a32f09cac61402d07339bd0fbbd14257ef742b5562d5feaaaffa2313eeda692699451d9c29c47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
39baee9232b74a4e06e429c55193d6ec

SHA1
f5afa9003968968cb79361aa2a383422d0fa4839

SHA256
0a539da9676b6a366af2382641202cf557e79b997693a22132d4eebd034e1c53

SHA512
4dc81c6af0a2a27fb30744e075f48c44db9429fec1b654104662e6b00febfb7d347f2aad7cabdc0f9fb808652cfd082092fa3620c5c2a516a35b26fc6ffa121d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
0711e4f4ae5d3859f1c3288ef878328b

SHA1
061a48c5e30d3dbb209b83f69998d327d0cb6711

SHA256
91e518a46636abb0a37cedc83577022dcd9f4c014051cc0e6dcdb4703bcc33e5

SHA512
461e48bb10582dd8d05a87aaa70ee40fd15014b5e1a411f97e3379a2c67a787f56a8f449ebda61af4d2cf3dc1342ea9b9cc5103c46159db475639ff6544999ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.2\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\one.rtf

Filesize
403B

MD5
6fbd6ce25307749d6e0a66ebbc0264e7

SHA1
faee71e2eac4c03b96aabecde91336a6510fff60

SHA256
e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

SHA512
35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

Download Submit
C:\Users\Admin\AppData\Local\Temp\rniw.exe

Filesize
76KB

MD5
9232120b6ff11d48a90069b25aa30abc

SHA1
97bb45f4076083fca037eee15d001fd284e53e47

SHA256
70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

SHA512
b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

Download Submit
C:\Users\Admin\AppData\Local\Temp\windl.bat

Filesize
771B

MD5
a9401e260d9856d1134692759d636e92

SHA1
4141d3c60173741e14f36dfe41588bb2716d2867

SHA256
b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

SHA512
5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

Download Submit
C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\Downloads\000.zip

Filesize
119KB

MD5
d113bd83e59586dd8f1843bdb9b98ee0

SHA1
6c203d91d5184dade63dbab8aecbdfaa8a5402ab

SHA256
9d3fe04d88c401178165f7fbdf307ac0fb690cc5fef8b70ee7f380307d4748f8

SHA512
0e763ff972068d2d9946a2659968e0f78945e9bf9a73090ec81f2a6f96ac9b43a240544455068d41afa327035b20b0509bb1ad79a28147b6375ed0c0cf3efec5

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom.zip

Filesize
916KB

MD5
f315e49d46914e3989a160bbcfc5de85

SHA1
99654bfeaad090d95deef3a2e9d5d021d2dc5f63

SHA256
5cbb6442c47708558da29588e0d8ef0b34c4716be4a47e7c715ea844fbcf60d7

SHA512
224747b15d0713afcb2641f8f3aa1687516d42e045d456b3ed096a42757a6c10c6626672366c9b632349cf6ffe41011724e6f4b684837de9b719d0f351dfd22e

Download Submit
memory/1244-674-0x000000000BD70000-0x000000000BD80000-memory.dmp

Filesize
64KB

Download
memory/1244-677-0x000000000CCC0000-0x000000000CCD0000-memory.dmp

Filesize
64KB

Download
memory/1244-680-0x000000000CCC0000-0x000000000CCD0000-memory.dmp

Filesize
64KB

Download
memory/1244-679-0x000000000BD70000-0x000000000BD80000-memory.dmp

Filesize
64KB

Download
memory/1244-678-0x000000000BD70000-0x000000000BD80000-memory.dmp

Filesize
64KB

Download
memory/1244-676-0x000000000CCC0000-0x000000000CCD0000-memory.dmp

Filesize
64KB

Download
memory/1244-675-0x000000000BD70000-0x000000000BD80000-memory.dmp

Filesize
64KB

Download
memory/1244-672-0x000000000BD70000-0x000000000BD80000-memory.dmp

Filesize
64KB

Download
memory/1244-673-0x000000000BD70000-0x000000000BD80000-memory.dmp

Filesize
64KB

Download
memory/1244-665-0x000000000BBD0000-0x000000000BC08000-memory.dmp

Filesize
224KB

Download
memory/1244-666-0x000000000BBA0000-0x000000000BBAE000-memory.dmp

Filesize
56KB

Download
memory/1244-647-0x0000000006460000-0x0000000006A04000-memory.dmp

Filesize
5.6MB

Download
memory/1244-637-0x0000000000CE0000-0x000000000138E000-memory.dmp

Filesize
6.7MB

Download
memory/4976-543-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/4976-548-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/4976-538-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/4976-537-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/4976-536-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/4976-546-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/4976-545-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/4976-544-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/4976-547-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/4976-542-0x00000246F3CA0000-0x00000246F3CA1000-memory.dmp

Filesize
4KB

Download
memory/5052-563-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5052-535-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5052-532-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5052-559-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5052-483-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5052-501-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5052-481-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5052-529-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5052-485-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5052-482-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads