Overview

overview

10

Static

static

3

KatyushaRa...re.exe

windows7-x64

10

KatyushaRa...re.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/09/2024, 17:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    KatyushaRansomware.exe

  • Size

    2.4MB

  • MD5

    7f87db33980c0099739de40d1b725500

  • SHA1

    f0626999b7f730f9003ac1389d3060c50068da5a

  • SHA256

    d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6

  • SHA512

    1bf8e63a09ee7618102982a1d8c39c2eada1e7c52452d0cadb0df9010421799171880580dd6e4d5fb371d314ee7676d438ab827ef1695bb9de95835ac7cb47f8

  • SSDEEP

    49152:tzlhgyBIjVpPZHZlPpLPk0vglJIAc/8KYBsxdO0G7x+dP1Y+:zy9jRZlFknvzcEKY8dOD7x8NY

Score
10/10
mimikatzdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\_how_to_decrypt_you_files.txt

Ransom Note
=====================================HOW TO DECRYPT YOU FILES==================================== All your documents, photos, databases and other important personal files were encrypted!! Please send 0.5 bitcoins to my wallet address: 3ALmvAWLEothnMF5BjckAFaKB5S6zan9PK If you paid, send the ID and IDKEY to my email: [email protected] I will give you the key and tool If there is no payment within three days we will no longer support decryption If you exceed the payment time, your data will be open to the public download We support decrypting the test file. Send two small than 2 MB files to the email address: [email protected] Your ID:24221205 Your IDKEY: ================================================================================ s51h8v7ybyp0C0LQ+OcJxh0ml8DI2VIg4gNKHjuusLLQzDFxotgJfpk10m85MDua bmFyxOgfi9G+hwmYnpCM0BSUWS1U/dZoGjeCewEWmDtZOk8k8v6nOGkZ240ekHLr kW2GGfXVAg8OXeBGu2l74aVAkeZrYydUwc4PAb/ycUwJ0/c5BWnBRlQE1snOdI84 Cm7AyD70rdy0fPxoyqRC8Ewzzk1F7Cz/ibbxNvueU1r5lS8I3KXSe+u72eI6sa6h sR0qoFHru1FBySQKvabnAhiintj05t1QJiEuUsO1P3n2M1slOZStEynLV5oEULNn pTpFcfWIZxFu/xWZX9Glcg== ================================================================================ Payment site https://www.bithumb.com/ Payment site http://www.coinone.com/ Payment site https://www.gopax.co.kr/ Payment site http://www.localbitcoins.com/ Officail Mail:[email protected]
Emails
Wallets

3ALmvAWLEothnMF5BjckAFaKB5S6zan9PK

URLs

https://www.bithumb.com/

http://www.coinone.com/

https://www.gopax.co.kr/

http://www.localbitcoins.com/

Signatures

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (3124) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 14 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\KatyushaRansomware.exe
    "C:\Users\Admin\AppData\Local\Temp\KatyushaRansomware.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:/windows/temp/zkts.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3488
      • \??\c:\windows\temp\zkts.exe
        c:/windows/temp/zkts.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3896
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:/windows/temp/m64.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3868
      • \??\c:\windows\temp\m64.exe
        c:/windows/temp/m64.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4040
    • C:\Windows\temp\ktsi.exe
      "C:\Windows\temp\ktsi.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM mysqld.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3592
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM mysqld.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2424
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM httpd.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM httpd.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2960
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM sqlservr.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM sqlservr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2632
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM sqlwriter.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM sqlwriter.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4812
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM w3wp.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1400
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM w3wp.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:220
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM sqlagent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2568
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM sqlagent.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:404
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM fdhost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4428
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM fdhost.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5068
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM fdlauncher.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4572
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM fdlauncher.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3272
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM reportingservicesservice.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5000
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM reportingservicesservice.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4704
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM omtsreco.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3444
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM omtsreco.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3840
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM tnslsnr.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4468
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM tnslsnr.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2756
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM oracle.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1604
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM oracle.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3824
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM emagent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2504
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM emagent.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1720
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /F /IM mysqld-nt.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2116
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM mysqld-nt.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1108
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet&vssadmin delete shadows /all /quiet
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4296
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet&vssadmin delete shadows /all /quiet
        3⤵
          PID:4452
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:4872
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:5008
        • C:\Windows\SysWOW64\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\_how_to_decrypt_you_files.txt
          3⤵
          • System Location Discovery: System Language Discovery
          • Opens file in notepad (likely ransom note)
          PID:2032
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" c:/ProgramData/_how_to_decrypt_you_files.txt
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:4680
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4680 CREDAT:17410 /prefetch:2
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:668
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4576
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1240
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\SelectCompare.pdf"
        1⤵
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1832
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          2⤵
          • System Location Discovery: System Language Discovery
          PID:868
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=825C9ABFED41933749F2F30E99174AD1 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3092
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4CAA2A21A9C5DFC9EA8C095E2380E451 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4CAA2A21A9C5DFC9EA8C095E2380E451 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1420
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0637F13746DB6B41374554B70E54FE2A --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
            • System Location Discovery: System Language Discovery
            PID:828
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A865A6471069911C2DC06BEDE53049FD --mojo-platform-channel-handle=1988 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1696
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA4DDE22F94F93BDFB2A7AD7ECBC53DC --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4004
      • C:\Windows\System32\CompPkgSrv.exe
        C:\Windows\System32\CompPkgSrv.exe -Embedding
        1⤵
          PID:1288

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.katyusha
          Filesize

          160B

          MD5

          3173bbd2ae64894e4afba3f47a28128d

          SHA1

          23e62000a94b9799dd33cd45f83913bc58c07ba9

          SHA256

          05ac352e33925f173e6afa1891dc20a261418a328f69330758690aa6bd60acd8

          SHA512

          3a64aa8498cf9d8978f042ca7bcd78df312255be1c355568127641e7dde8af80a3122dd3d67b8abe4563eb7caff250409b3e5f81c3a438a085063d6db17da875

          Download Submit

        • C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.katyusha
          Filesize

          128B

          MD5

          be1081b75d684e6592b87990510dec2e

          SHA1

          717fbb6f08cdcca881c9addc506e6b04789ae8db

          SHA256

          3e7e6f9f7b46cf16c6b98b707160384c4c6838938f0cc0f76004806a736631b4

          SHA512

          5d36a8162a0d46a5ad30df30e6ece8091d0fcc755e3e2c9554502fc2a2bfbecf9f1461c04bb227acca97e87e3d6e5792624276fa0180069fd5ec0ffd6f5c6936

          Download Submit

        • C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.katyusha
          Filesize

          128B

          MD5

          5e79b329be54997222be5997f2ab9e7b

          SHA1

          a4d88e21648158140a7c81f21557abd44c071844

          SHA256

          c95a3f27a00f52188992819779ddf71ba304604ca14572953898482154d82480

          SHA512

          3d001deeda072cebbe3b4b920b4f87b4f8c6b9e467800e99eb7af48c4f4b1dd7daa20f9d72f7ae3b9aa3cdbe3f58b57ca7b04eac3bb7c767a2f8ae5efd0f1a3c

          Download Submit

        • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\OWSHLP10.CHM.katyusha
          Filesize

          16B

          MD5

          354041862b7a7385fe499708e2e62737

          SHA1

          99970688220f9866a899b7a42b6d7a17b9671795

          SHA256

          921117a4f7aadfb221165e56412dd7d7989b1d17fd254d89c82f74abddf3c741

          SHA512

          8fe6064ff9fb4990b7862a154a31f511584c3c253619310b6326f7d758dabc2d29c33c2098f7f8c9af1f02f7314975c1a6ada28ade8f298d2621c749c165204b

          Download Submit

        • C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.katyusha
          Filesize

          831KB

          MD5

          5d8ad4eb774bb9924ff1c7562249e39f

          SHA1

          2c52af413c0a08d8c9b908f73401a4941f4aba6a

          SHA256

          24b3cf4514d50cc9d196c925900c4d3bdc7ac68cc9285e5f1beb704599371af9

          SHA512

          1c3d5907ee436423c1ef0cf41ac0108ea67905734eac4da296b5a92f9cb7d9596d69fc0385fb8a842a87d2b0b579159cea8a5ceb793a6fbbb0f03d8a777b34c7

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          471B

          MD5

          9b8ac9d890f8dda853d1c95079ac73f5

          SHA1

          e265a8851607e6e5b25489a85181774840ad4c12

          SHA256

          07a9f21865eb7c1380f39a1b00ba4fca51890507feb94b033a602478dada2d48

          SHA512

          4da957e5b350ce6013cc0e739b36dc6592937204c1336f39b1be4a39870ce062e836cf05a0d7ed5fc62e5af702b2f50accb536ee14381386af510129a3beaf61

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          404B

          MD5

          f8c0d3173b78d1b71517cdcd7e62471b

          SHA1

          ed9676b4f2a8896b283e5227f3a67ddaec1ca77d

          SHA256

          1eced8641dee8b32e74b3da08d57fb3c88b14872905b63825c629858f98dc64b

          SHA512

          77fba9843dcf13ce875703bf19aaea6199afa30fb40ca5dba0f85938c3ccd632095e74ab38f2d0bf97ea65891be3cf53426527e6f8ee78c74e03a6bb9f1c6add

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver3AC2.tmp
          Filesize

          15KB

          MD5

          1a545d0052b581fbb2ab4c52133846bc

          SHA1

          62f3266a9b9925cd6d98658b92adec673cbe3dd3

          SHA256

          557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

          SHA512

          bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JACP9GNT\suggestions[1].en-US
          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\pub.key
          Filesize

          450B

          MD5

          6e4df4a230f62f0af9066d018218eba6

          SHA1

          dbe9633e08d9f982ad71d552bffc3227ef2b7465

          SHA256

          6289a5cbc6e1c7e591b2342d58c52c3af37334a89699d5f3e338f536326ef610

          SHA512

          9217f301d9da6565cce9a96d6ca20e5bb84718e5425d0a8e8b7aa6c51a5603de0f998ebd50ccb88820442804d7edfa10056688d6d50e3803a24952773ec4ed39

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\~DF6AE63D5CE59A4850.TMP
          Filesize

          16KB

          MD5

          e1e2326ceaef7f6bb7ecdd4a1cde69c6

          SHA1

          6aca04d6e88d8947c388e61935652d1e33c2c29c

          SHA256

          b27c8d650bdeceb7e52b4d7fb5d967b32bfdad7131b2a7be02c70bc9a30da3ef

          SHA512

          51503d7a9913c04ad12fccb2b05041564f3678d7872dafb6fb9ed3b3ceb2f4eaf87b592eec47d29d7ff415687b87504a1603b4a85b4d24c3d53fba42dd4cd250

          Download Submit

        • C:\Windows\Temp\ktsi.exe
          Filesize

          328KB

          MD5

          dd2e5fd5109c54cc90b30b88ec0c585a

          SHA1

          927dc541fd29ef6341b041321fe06bf04b0efcd7

          SHA256

          a3dabb63f11e208a0d1d9b43b3d2575e2dc2a7d87c14eb654d3062f3bc0ad12d

          SHA512

          20b19f742daf20de510b0232fb5f5bb231487d5e9da05b8e7037df79b7110c53b4db2e7969a6b978606e8dfd15b6d40eeae84e64b289f2b0f68dddbc8061441e

          Download Submit

        • C:\Windows\Temp\m64.exe
          Filesize

          363KB

          MD5

          2d2e3b0d8a9723eb49bd6f817cbe2e22

          SHA1

          0de80d21c389061e69dd3a0c61ac3ba225b9bb44

          SHA256

          db995430707d2d34de8e5ce5fb4b22a87422f5a7b4d38960ed6615d4ea3d9495

          SHA512

          1cc074eb26526b5572b1b1013a0330ed68ba130e95943d22d9f429d0cfa878e6b5fd48aa970af493f2f92908714cff278b921de96864be42285c43438f261bf3

          Download Submit

        • C:\Windows\Temp\zkts.exe
          Filesize

          1.8MB

          MD5

          5d74e736c5c4224b813bea351093c27f

          SHA1

          740e59ec36ebec339f9245071f366cf601edbad7

          SHA256

          7f5f134fd3ec2c14956acd7362c76e66759b8ecc51f986ef80bbf9f7f94b89fe

          SHA512

          0628bf7d60b8e6428a0a5203fab8084788a6cafac159eff0f866a6b2b3934c44cee94b8a6f6f6f293b758384dbea3cca083df2131cc2d3e8ccf58c5769975524

          Download Submit

        • C:\_how_to_decrypt_you_files.txt
          Filesize

          1KB

          MD5

          5069149d6ab203ce4f8bd7d9db3a6b5f

          SHA1

          71a85334850fb6ddbd63717b3b4e232684872486

          SHA256

          b875a4177b4eefd45dd61ff4a783725ff6a3b1fb2c9650357d82a62df862ddb1

          SHA512

          cb10731692b6a35330f8c6344797bb647cbf8426a1a1f8f59fa6aae439e77be009393b1ab4fc358feaaccd03a6be857fdd06dbf409dc1537d6c5ee647628a80b

          Download Submit

        • \??\c:\windows\temp\m32.exe
          Filesize

          322KB

          MD5

          0b5469b69a0d2e205640b78157ca225a

          SHA1

          b2d7079a39fe7bbb835090ec74512d4bfa5c44cf

          SHA256

          4179a1bff4c698ea6958bacb1f1734b9ab804cef35ecaf0e2a2b4b2eadf8e935

          SHA512

          d6f2bf2a03a274df9034aeed0c4dfaa09c0d005a827cd782a67aef8b8f91a66fa9636d5ddbf8cf569ae392ef3a250c86314620f818f42c1be4a50e5645e43ca2

          Download Submit

        • memory/216-3250-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3261-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-2954-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3306-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3305-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-363-0x00000000006F9000-0x00000000006FA000-memory.dmp

          Filesize

          4KB

          Download

        • memory/216-3219-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3220-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3221-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-234-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3304-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3303-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3237-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3238-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-0-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3302-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-3267-0x0000000000400000-0x00000000006FB000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/216-1-0x00000000006F9000-0x00000000006FA000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4040-59-0x0000000140000000-0x0000000140106000-memory.dmp

          Filesize

          1.0MB

          Download

        • memory/4040-61-0x0000000140000000-0x0000000140106000-memory.dmp

          Filesize

          1.0MB

          Download

        • memory/4848-2181-0x0000000000400000-0x0000000000504000-memory.dmp

          Filesize

          1.0MB

          Download

        • memory/4848-69-0x0000000000400000-0x0000000000504000-memory.dmp

          Filesize

          1.0MB

          Download

        • memory/4848-3216-0x0000000000400000-0x0000000000504000-memory.dmp

          Filesize

          1.0MB

          Download

        • memory/4848-2176-0x0000000000400000-0x0000000000504000-memory.dmp

          Filesize

          1.0MB

          Download