Malware Analysis Report

2024-10-16 03:14

Sample ID 240825-ygjz3ashpm
Target c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118
SHA256 63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806
Tags
discovery execution ransomware suncrypt
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806

Threat Level: Known bad

The file c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery execution ransomware suncrypt

SunCrypt Ransomware

Blocklisted process makes network request

Drops startup file

Drops desktop.ini file(s)

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-25 19:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-25 19:45

Reported

2024-08-25 19:48

Platform

win7-20240708-en

Max time kernel

121s

Max time network

126s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YOUR_FILES_ARE_ENCRYPTED.HTML C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MN6S8FGK\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\N7ZQRMOO\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\C906A748\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZO1X14N3\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\T: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2808 wrote to memory of 3020 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2808 wrote to memory of 3020 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2808 wrote to memory of 3020 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 3020 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3020 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 3020 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2808 wrote to memory of 2788 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2808 wrote to memory of 2788 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2808 wrote to memory of 2788 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2808 wrote to memory of 2788 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2788 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2788 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2788 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2788 wrote to memory of 2712 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2712 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2712 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2712 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2712 wrote to memory of 2680 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9twidpjl.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF02A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF029.tmp"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r9mvnrci.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF603.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF602.tmp"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
RU 91.218.114.30:80 tcp
RU 91.218.114.30:80 tcp

Files

memory/2808-4-0x000007FEF5ABE000-0x000007FEF5ABF000-memory.dmp

memory/2808-5-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

memory/2808-6-0x0000000001E80000-0x0000000001E88000-memory.dmp

memory/2808-7-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

memory/2808-8-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

memory/2808-9-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

memory/2808-10-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\9twidpjl.cmdline

MD5 9f5b42e6bf7e2a7a5e9dbf51003aac5a
SHA1 cdf894d6db0b10555cbe2726307dcd494fe20f92
SHA256 81dff002c067625c8aa80936a3684658b1e4e499a304a452868e700ea92f0fd7
SHA512 5558635dc466864306aadad02ed23a489ea3a54a8e3253b704f283b0ead1bd150fc427862fec63ca0642d2d4415718a930d054f18917182717291be9fbd52058

\??\c:\Users\Admin\AppData\Local\Temp\9twidpjl.0.cs

MD5 caf98c9f9cc2c02cdc79eb3409a36bc5
SHA1 aae6131763eaace982ee93fb15ee0eff45a034d2
SHA256 dc072944363d6db027de28c9412f96e4655e460989789c99e3a1992daded7499
SHA512 74845d305b1de1a0decaca325bc98de0cebaee677b6a70d492a0ba3ade21e9f9f0e145687a1f6ff89ada6657f77c47a8f140bf1d610c661738a2c64ada3a132f

memory/3020-19-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RESF02A.tmp

MD5 a8e9ff88281daab74509deba3abf3525
SHA1 23951689e0a64979cb01aebc4e95e6c7567c5cf8
SHA256 2e1d32b76f9667490a3cc52da4c2b1bbe2fe4ca7c44f453e86fecfe255760d3f
SHA512 c7d105f630273413c727312bbba266ca18a617c0f1a3ac60210549fea27c7126d501a3db78120c6b91d1350bda87af5c9d93db78b854f271a6038c10bcdb7be2

\??\c:\Users\Admin\AppData\Local\Temp\CSCF029.tmp

MD5 f0cb4170aa230fcc6787f104b3489f44
SHA1 2e5023621562a7d0dab27016e02e4bc0a29298b0
SHA256 8df4b46a01402521473b9d5010e3c934ca15f961c62d3e1d8a5c878dfc49245c
SHA512 79b45c2c050b0013bf097ec3b1323e795c26d175c45f61d46029892cff17045d7696574ba4f397cdc9d45b6a5d5f7c7168c5a27718c3f23720afbbc9f52c5be2

memory/2808-26-0x0000000002A00000-0x0000000002A08000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9twidpjl.pdb

MD5 23336d894bb3d56a1bed5a8a472b438e
SHA1 097f13f0401b9de1bea7305f3e4d2b4db36eaefa
SHA256 f40acc652f11af1916c7112076c06cbdebc022920f857fece508efe02acb59dc
SHA512 10480e4a8f351a77d2e7f80ffdeebdc83570d75e8311f4f33cf29d53ca49973fd11fdbd52a4c2709582214896b43674cb0f982c71cf8b0aad4e1a5d8f44c562c

C:\Users\Admin\AppData\Local\Temp\9twidpjl.dll

MD5 fc3c5a6c3f83b52e3f8378acff24f0b6
SHA1 b510f0f1929ab8c8010f4c0393081515729b7912
SHA256 0812f8dc81d142d5e114ab4de98e43a05e3a3cb15d77a4bfc3416d01bd40e978
SHA512 0d32883b07a1217cb3fa5c92bb8270bea4c9516fabd02c7bc6788e15830eb9d8e23febad0891657e28872694ef55f75c8a3521a3be4e2bf528033d4c46d39611

memory/3020-24-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

memory/2808-29-0x000007FEF5800000-0x000007FEF619D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0Q7OXTPJY2KH2MF061BN.temp

MD5 f2e6f740f9140bdd6aa3eba14b4f9468
SHA1 764fc09d735b6b526bae0f933bb50084fddb2d5f
SHA256 a379342e5957438b10523583a833461bff6a96c7bbbfc3cac3d4e2b0efcd0e99
SHA512 34a7eff0432e537f92b1ccdecfb878236a3d477935ff44839728373ea8e853962f5bdd0daefcdc7166882e27383125e9b8a3e0caf6aa40a243230fa7716c214c

\??\c:\Users\Admin\AppData\Local\Temp\r9mvnrci.cmdline

MD5 82744ec330e6986a3879e36a85b9f8ba
SHA1 76b731cf38acff926af22f1662c6d0b3c3ed45cf
SHA256 59e6008b1805b10531fae28c51d6d7c9e4ff0746666220a13c7b038571790d06
SHA512 3da3eb869968ab34bc15a0c20d535cc2b59750ca2bd3e77c53146e6db19e41368871c7aa45ea58774b1b506b399ae73e3172fe1ce7925153c23b8a38cbc051cb

C:\Users\Admin\AppData\Local\Temp\r9mvnrci.pdb

MD5 61110c09fa5a42c648d5b094fcf8ac11
SHA1 829898621cb0ff1564119ea9debd7c1afd1e2841
SHA256 a01bceb607cc388c54d6bba3b6461d615fd113b3a15ebe8bbfdabfc3c20e1a6e
SHA512 e57eb3ad14532530f88892519c0f5f18f2432dcb927666fd5639a053b1d34cae4e953e854474eee93a1929626f56b7b96754b48593ce02261eebb13df7debd39

C:\Users\Admin\AppData\Local\Temp\r9mvnrci.dll

MD5 76a0066ba8b3db90e3622ca883f7cac8
SHA1 8be25a5c314333be2f341160f8a18ced1afd2c11
SHA256 2888a15ea4d368be21d1283ac6f7d0909d9c1cdc78dcf627798e5a3828049071
SHA512 b3e8cf9fedc952124cc30a672bd0081fdf78e4f8f9181090fbe6bd2c1f9f8d28c891aaa6d48855781563f18fe50b22eb47485c7158a5607a797876e577a8bd66

C:\Users\Admin\AppData\Local\Temp\RESF603.tmp

MD5 c8f2bf02b4520d8ba83907eb1a5bc0da
SHA1 620070f9ae931f80c53c2069255d112f2d8dae53
SHA256 1375f2225074e8f805bb49538d3ba3cd3414cc4a201cddd20ca80fa6d7757594
SHA512 47d04e9a0f23e28d90723455845f0942a141efaf1af5b7746c4254afb9a46b55dc97250ba321cbf30dd389c07137e41d6cbafde1ad984f5ac0e7dbed4e7698d4

\??\c:\Users\Admin\AppData\Local\Temp\CSCF602.tmp

MD5 fa439550e147698fbaf4d5578ab37b90
SHA1 487bddf1b4c3139a3d533547e02831bab6b242ff
SHA256 3d74887f65630adc0b537bd80b6ca4d3699a64fb5b7f77b6619417c82f2b8d63
SHA512 9ae919c11fec5a116a71553d3dc7c026cfc4bfa7951c4db6c29f9e31b887625f22469ba954bd70bbe3e0356373bd1a35f359d896a44d3d324cc7fdc1f0a2e90d

memory/2788-47-0x00000000028A0000-0x00000000028CE000-memory.dmp

memory/2788-48-0x00000000028A0000-0x00000000028CE000-memory.dmp

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\YOUR_FILES_ARE_ENCRYPTED.HTML

MD5 0194a99090f18b0bdd758a3176f53d46
SHA1 482a6399a8fd3e2402fed108a351f308be68847b
SHA256 43997f9e6d4f10288ee0272bae74eb43ef71742b860bb1c1618d7fd09d0b26a3
SHA512 754e49ac30976d88876edbbb433979d8c291503ba9bacd1ff0cde889a9526eda316e9d3820b4e163f55b63e4965bd0070f9b84c5a3fa07c2320667d40153ab60

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-25 19:45

Reported

2024-08-25 19:48

Platform

win10v2004-20240802-en

Max time kernel

96s

Max time network

141s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1

Signatures

SunCrypt Ransomware

ransomware suncrypt

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YOUR_FILES_ARE_ENCRYPTED.HTML C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 216 wrote to memory of 1360 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 216 wrote to memory of 1360 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 1360 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 1360 wrote to memory of 1236 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 216 wrote to memory of 3016 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 216 wrote to memory of 3016 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 216 wrote to memory of 3016 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3016 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 3016 wrote to memory of 2012 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 2012 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2012 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2012 wrote to memory of 2044 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v5ce4nke\v5ce4nke.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2D3.tmp" "c:\Users\Admin\AppData\Local\Temp\v5ce4nke\CSCD47D0E97AE694601AF9668CDE0ADDFDF.TMP"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\c171bcd34151cbcd48edbce13796e0ed_JaffaCakes118.ps1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xukq50uf\xukq50uf.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1E6.tmp" "c:\Users\Admin\AppData\Local\Temp\xukq50uf\CSCE7A642356BDA4343B891C9AF9905057.TMP"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
RU 91.218.114.30:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 52.111.227.13:443 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/216-1-0x00007FFE8CBA0000-0x00007FFE8CE69000-memory.dmp

memory/216-0-0x00007FFE8CBA0000-0x00007FFE8CE69000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fdvananl.20m.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/216-11-0x00000244678B0000-0x00000244678D2000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\v5ce4nke\v5ce4nke.0.cs

MD5 caf98c9f9cc2c02cdc79eb3409a36bc5
SHA1 aae6131763eaace982ee93fb15ee0eff45a034d2
SHA256 dc072944363d6db027de28c9412f96e4655e460989789c99e3a1992daded7499
SHA512 74845d305b1de1a0decaca325bc98de0cebaee677b6a70d492a0ba3ade21e9f9f0e145687a1f6ff89ada6657f77c47a8f140bf1d610c661738a2c64ada3a132f

\??\c:\Users\Admin\AppData\Local\Temp\v5ce4nke\v5ce4nke.cmdline

MD5 62b294053216e282db2e368fdd12c83f
SHA1 8424c423642982d2d21f1d24e1c4a5cd1a97210d
SHA256 fec856365bc822072b7a32a0a7786bac3ec60417c99fe78af701f7f377f6542f
SHA512 b3a9b209892cb4889980609e47c369bcfe588d79ca488c8acbc0290342b146927169444ca4b6ba0c0b24d4d3489ba911e1557725b660cc0ee322638e1d1c8d52

\??\c:\Users\Admin\AppData\Local\Temp\v5ce4nke\CSCD47D0E97AE694601AF9668CDE0ADDFDF.TMP

MD5 4d74eda8cdac3a75bd7f2a6e4025ffde
SHA1 74d2aba32cc311df9bce261863f3ec475bcd74bc
SHA256 0f086d81d2e753dac4eb03748b7a02bd588929fb7e2010d5352efc1337173cbc
SHA512 8b4faac08214896b32edc38517fb32af158c4406f9b8b749ebb24347c16743f5a2f557ef26ac4883455a9d3c89d0fd54ec6648d6b61760a8e120d1ee2fa3771c

C:\Users\Admin\AppData\Local\Temp\RESC2D3.tmp

MD5 3c88b2cbb0a67a94329ff961b02e8ba9
SHA1 2b6d9b9972fff368d48cb332fd9c5732c27cf795
SHA256 dd5969e1eaa8554605de3fafac6f1a3ccd5979ee69a1c32996694e061f1184e9
SHA512 a1f0ea01a5e2bdbc5c188ab2fc7dad0582033709b01d78fe7849df46f223dd408bb3e8e0259b066ec2b99ed7504a3373855630933903949263c25ae10fdd9297

C:\Users\Admin\AppData\Local\Temp\v5ce4nke\v5ce4nke.dll

MD5 76b5524178c57ea5d45263f4e10d8550
SHA1 82f2efebb3ac36cec74464436277f565cba755fb
SHA256 1701c4fa09e2d643e3c39e41bc1f6236f5a06d09941b714858fff658ec635835
SHA512 c842fe22d47b68790ddef2f65cdea71161d86e8d125d85a0403ceff30d31260a400402da27da611dde84f4e68f10ab6aa921b373c69f9975f849019a25f79500

memory/216-24-0x00000244678A0000-0x00000244678A8000-memory.dmp

memory/216-26-0x00007FFE8CBA0000-0x00007FFE8CE69000-memory.dmp

memory/216-29-0x00007FFE8CBA0000-0x00007FFE8CE69000-memory.dmp

memory/3016-32-0x0000000004B30000-0x0000000004B66000-memory.dmp

memory/3016-33-0x00000000051A0000-0x00000000057C8000-memory.dmp

memory/3016-34-0x00000000050C0000-0x00000000050E2000-memory.dmp

memory/3016-35-0x00000000058C0000-0x0000000005926000-memory.dmp

memory/3016-36-0x0000000005930000-0x0000000005996000-memory.dmp

memory/3016-46-0x00000000059A0000-0x0000000005CF4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e4a3180819763d43e6a3e39adbab718
SHA1 2cec2b94108074bcf7599d6fab7133b2e11f7e52
SHA256 c6ddcdc2ff8910fc6dfc6bb2ae667ab9f27ef885a1e6ae9b9bef60f485d091a2
SHA512 d62867351af1ba3076dbc1c99d610f034cc2ec9e4a0bdd27638640793a6b450321f17ca7c6147548fa341c52469a66345827afb1f0282f2f0b0304a7fa82e4cd

memory/3016-48-0x0000000005F60000-0x0000000005F7E000-memory.dmp

memory/3016-49-0x0000000005FA0000-0x0000000005FEC000-memory.dmp

memory/3016-50-0x00000000085F0000-0x0000000008C6A000-memory.dmp

memory/3016-51-0x00000000064C0000-0x00000000064DA000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\xukq50uf\xukq50uf.cmdline

MD5 835f838faa454ceb76b42430c4c3072a
SHA1 9b02e89f46958125603fed1a6a441e4f0e6e95ca
SHA256 2fd8de591c0fa2087cd65a01e62e81461406ad57a5573fd28914915b7ebe25b0
SHA512 c0500658224d5ce50bfe5b81101c874e7011370efcf816fea7faf4f413f298c5d0fac477d485e17edf3eda3516852d8a334f9d6b92a32f52cc4d8adb6d6a1a9d

\??\c:\Users\Admin\AppData\Local\Temp\xukq50uf\CSCE7A642356BDA4343B891C9AF9905057.TMP

MD5 bf209955c6cc210f40af1b5fba3d2db6
SHA1 836f032d9132bf2e74e62c53c14c19b14711a225
SHA256 3b95b978013fc5935a0f2cca1330b1d7e737061a845e0a387a453b710e386b42
SHA512 7087b32001c859ed26b0909339f85e14971177ef27fd9d9d02abe3791ffeb5fcd2fa8860cc16b87c2c8bc8ebc597a49c8e618b486ce678302e85c1d78b53d725

C:\Users\Admin\AppData\Local\Temp\RESD1E6.tmp

MD5 5fc7cad3afb9ccf0e0a33f98ad6f3d00
SHA1 d09b7dcb828b83db2af32db9ae7d2d72dcdd976a
SHA256 fc4052cbe785da0c13147e44c9751d850f079fee08e09312a68a7f716ccca7d8
SHA512 c6c29d2863badb296ce2f3cf665092e47236b6bf9b0a10d2da16adacc51edfdadf2693cea1836a49c0e996c53f5a2f633e0cbb8d6fc0af516bf819e62b39b20c

C:\Users\Admin\AppData\Local\Temp\xukq50uf\xukq50uf.dll

MD5 a6f9deb734da0b394f1abbe3b0cd33f7
SHA1 29d1c9e6c009f9e375a2f9febbfa011c1bdec511
SHA256 4078c993ebd91e481c22a22bfe9fe8d38926cb46f74e671575a1f7748871eb1e
SHA512 a5d81cb8b11e18d1988c7a69084eb3e8c9d2040d7221da83b6d005bf6fde1778c9751ca94d9e9ea0856ade06bcd65f2cf39dd29a6453774460656cfe7715220c

memory/3016-64-0x0000000006540000-0x0000000006548000-memory.dmp

memory/3016-66-0x0000000000400000-0x000000000042E000-memory.dmp

memory/3016-68-0x0000000000400000-0x000000000042E000-memory.dmp

C:\ProgramData\Microsoft\AppV\Setup\YOUR_FILES_ARE_ENCRYPTED.HTML

MD5 0194a99090f18b0bdd758a3176f53d46
SHA1 482a6399a8fd3e2402fed108a351f308be68847b
SHA256 43997f9e6d4f10288ee0272bae74eb43ef71742b860bb1c1618d7fd09d0b26a3
SHA512 754e49ac30976d88876edbbb433979d8c291503ba9bacd1ff0cde889a9526eda316e9d3820b4e163f55b63e4965bd0070f9b84c5a3fa07c2320667d40153ab60

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 49e7d5f2a296b59afec08bc314bed998
SHA1 7f898bf195ffd46ce2d19fad0ce33155f6e47f5f
SHA256 394832dfefa5e2e6204b60708a2ca33bb9d2f529664419bc050975f4b80faefe
SHA512 f64579fdac0bfebad4c20ad575b8ea45136e295fba950da4cbf84402228a3897b2e2deb4eb4605deb5df93321b1dc15c8a878da36016d7e5e060182142fdf839