teslacrypt | 1506227b3ca0429e22ae401eed7eea7b7eedb4a50f80d496bfb0a93c50c13d5b

Analysis

max time kernel
149s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2024 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
Size

384KB
MD5

f296876ebba9dbd1085b55b219b3e869
SHA1

d9ddcb36580ccee4687b5efcb8c7d6a3bdbc7703
SHA256

1506227b3ca0429e22ae401eed7eea7b7eedb4a50f80d496bfb0a93c50c13d5b
SHA512

9b0942e8f993faf6d18689bab8ae368b2da5eedee1bee0acdfd5f9444bc15027d447fc8ae72989ee52f58771865907ece85d32a6a312b5a9c7fe70b4db0d0e4d
SSDEEP

6144:HQMHIy84D4yxhkLAlsC+erjEU0R+f5DerHWQL1ZFGjg0AWO5rGMlukVt45yl07gc:HWF4D4YkE+ugTk6TQBABNKkVtEyl/

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+smtwb.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/5414880CDDAB060 2. http://kkd47eh4hdjshb5t.angortra.at/5414880CDDAB060 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/5414880CDDAB060 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/5414880CDDAB060 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/5414880CDDAB060 http://kkd47eh4hdjshb5t.angortra.at/5414880CDDAB060 http://ytrest84y5i456hghadefdsd.pontogrot.com/5414880CDDAB060 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/5414880CDDAB060

URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/5414880CDDAB060

http://kkd47eh4hdjshb5t.angortra.at/5414880CDDAB060

http://ytrest84y5i456hghadefdsd.pontogrot.com/5414880CDDAB060

http://xlowfznrg4wf7dli.ONION/5414880CDDAB060

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (864) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

nmehoqgasvgn.exef296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	nmehoqgasvgn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe

Drops startup file 6 IoCs

Processes:

nmehoqgasvgn.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+smtwb.png	nmehoqgasvgn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+smtwb.png	nmehoqgasvgn.exe

Executes dropped EXE 2 IoCs

Processes:

nmehoqgasvgn.exenmehoqgasvgn.exe

pid process

3416 nmehoqgasvgn.exe
3312 nmehoqgasvgn.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
3416	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nmehoqgasvgn.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vqoxrdoloiqh = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\nmehoqgasvgn.exe\""	nmehoqgasvgn.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

Processes:

f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exenmehoqgasvgn.exe

description	pid	process	target process
PID 4424 set thread context of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 3416 set thread context of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe

Drops file in Program Files directory 64 IoCs

Processes:

nmehoqgasvgn.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-32_altform-lightunplated.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-200.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-30_altform-unplated.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-256_altform-unplated.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Recovery+smtwb.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-60_altform-unplated.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_contrast-white.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Recovery+smtwb.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-200_contrast-black.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxSmallTile.scale-100.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-200.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-48.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\SmallTile.scale-200.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\Recovery+smtwb.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-125.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-200_contrast-white.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-unplated.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-72_altform-unplated.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd2.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\Recovery+smtwb.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-40_altform-lightunplated.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-150.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\Recovery+smtwb.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-125.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\Recovery+smtwb.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-400.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Windows Media Player\Visualizations\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleLargeTile.scale-100.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-96.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCacheMini.scale-100.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-125.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-250.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\Recovery+smtwb.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\Recovery+smtwb.html	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+smtwb.txt	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-100.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-400.png	nmehoqgasvgn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Recovery+smtwb.txt	nmehoqgasvgn.exe

Drops file in Windows directory 2 IoCs

Processes:

f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\nmehoqgasvgn.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
File opened for modification	C:\Windows\nmehoqgasvgn.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exef296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exenmehoqgasvgn.execmd.exenmehoqgasvgn.exeNOTEPAD.EXEcmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nmehoqgasvgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nmehoqgasvgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

nmehoqgasvgn.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings nmehoqgasvgn.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1640 NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	nmehoqgasvgn.exe

pid	process
1640	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

nmehoqgasvgn.exe

pid	process
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe
3312	nmehoqgasvgn.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3896 msedge.exe
3896 msedge.exe
3896 msedge.exe
3896 msedge.exe
3896 msedge.exe
3896 msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exenmehoqgasvgn.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3652	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
Token: SeDebugPrivilege	3312	nmehoqgasvgn.exe
Token: SeIncreaseQuotaPrivilege	4512	WMIC.exe
Token: SeSecurityPrivilege	4512	WMIC.exe
Token: SeTakeOwnershipPrivilege	4512	WMIC.exe
Token: SeLoadDriverPrivilege	4512	WMIC.exe
Token: SeSystemProfilePrivilege	4512	WMIC.exe
Token: SeSystemtimePrivilege	4512	WMIC.exe
Token: SeProfSingleProcessPrivilege	4512	WMIC.exe
Token: SeIncBasePriorityPrivilege	4512	WMIC.exe
Token: SeCreatePagefilePrivilege	4512	WMIC.exe
Token: SeBackupPrivilege	4512	WMIC.exe
Token: SeRestorePrivilege	4512	WMIC.exe
Token: SeShutdownPrivilege	4512	WMIC.exe
Token: SeDebugPrivilege	4512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4512	WMIC.exe
Token: SeRemoteShutdownPrivilege	4512	WMIC.exe
Token: SeUndockPrivilege	4512	WMIC.exe
Token: SeManageVolumePrivilege	4512	WMIC.exe
Token: 33	4512	WMIC.exe
Token: 34	4512	WMIC.exe
Token: 35	4512	WMIC.exe
Token: 36	4512	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4976	WMIC.exe
Token: SeSecurityPrivilege	4976	WMIC.exe
Token: SeTakeOwnershipPrivilege	4976	WMIC.exe
Token: SeLoadDriverPrivilege	4976	WMIC.exe
Token: SeSystemProfilePrivilege	4976	WMIC.exe
Token: SeSystemtimePrivilege	4976	WMIC.exe
Token: SeProfSingleProcessPrivilege	4976	WMIC.exe
Token: SeIncBasePriorityPrivilege	4976	WMIC.exe
Token: SeCreatePagefilePrivilege	4976	WMIC.exe
Token: SeBackupPrivilege	4976	WMIC.exe
Token: SeRestorePrivilege	4976	WMIC.exe
Token: SeShutdownPrivilege	4976	WMIC.exe
Token: SeDebugPrivilege	4976	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4976	WMIC.exe
Token: SeRemoteShutdownPrivilege	4976	WMIC.exe
Token: SeUndockPrivilege	4976	WMIC.exe
Token: SeManageVolumePrivilege	4976	WMIC.exe
Token: 33	4976	WMIC.exe
Token: 34	4976	WMIC.exe
Token: 35	4976	WMIC.exe
Token: 36	4976	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exef296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exenmehoqgasvgn.exenmehoqgasvgn.exemsedge.exe

description	pid	process	target process
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 4424 wrote to memory of 3652	4424	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
PID 3652 wrote to memory of 3416	3652	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	nmehoqgasvgn.exe
PID 3652 wrote to memory of 3416	3652	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	nmehoqgasvgn.exe
PID 3652 wrote to memory of 3416	3652	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	nmehoqgasvgn.exe
PID 3652 wrote to memory of 4644	3652	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	cmd.exe
PID 3652 wrote to memory of 4644	3652	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	cmd.exe
PID 3652 wrote to memory of 4644	3652	f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe	cmd.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3416 wrote to memory of 3312	3416	nmehoqgasvgn.exe	nmehoqgasvgn.exe
PID 3312 wrote to memory of 4512	3312	nmehoqgasvgn.exe	WMIC.exe
PID 3312 wrote to memory of 4512	3312	nmehoqgasvgn.exe	WMIC.exe
PID 3312 wrote to memory of 1640	3312	nmehoqgasvgn.exe	NOTEPAD.EXE
PID 3312 wrote to memory of 1640	3312	nmehoqgasvgn.exe	NOTEPAD.EXE
PID 3312 wrote to memory of 1640	3312	nmehoqgasvgn.exe	NOTEPAD.EXE
PID 3312 wrote to memory of 3896	3312	nmehoqgasvgn.exe	msedge.exe
PID 3312 wrote to memory of 3896	3312	nmehoqgasvgn.exe	msedge.exe
PID 3896 wrote to memory of 536	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 536	3896	msedge.exe	msedge.exe
PID 3312 wrote to memory of 4976	3312	nmehoqgasvgn.exe	WMIC.exe
PID 3312 wrote to memory of 4976	3312	nmehoqgasvgn.exe	WMIC.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe
PID 3896 wrote to memory of 3876	3896	msedge.exe	msedge.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

nmehoqgasvgn.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nmehoqgasvgn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	nmehoqgasvgn.exe

C:\Users\Admin\AppData\Local\Temp\f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f296876ebba9dbd1085b55b219b3e869_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\nmehoqgasvgn.exe
    C:\Windows\nmehoqgasvgn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\nmehoqgasvgn.exe
      C:\Windows\nmehoqgasvgn.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3312
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:1640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3896
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff116e46f8,0x7fff116e4708,0x7fff116e4718
        6⤵
        
        PID:536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        6⤵
        
        PID:3876
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        6⤵
        
        PID:1660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
        6⤵
        
        PID:2748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
        6⤵
        
        PID:1612
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
        6⤵
        
        PID:1944
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
        6⤵
        
        PID:1000
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
        6⤵
        
        PID:2572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
        6⤵
        
        PID:3528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
        6⤵
        
        PID:4396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
        6⤵
        
        PID:1564
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6695707402642244713,17864069682804444062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
        6⤵
        
        PID:3472
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\NMEHOQ~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\F29687~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+smtwb.html

Filesize
9KB

MD5
5be45b1a7908e15acfad7e6bbb3078f3

SHA1
2191c74ae3cb535d3db14ee09309ba94a593beec

SHA256
5f40ca2b16c7102dd0c62acd29043ff887b043347d48cd57fc83727cff07f70b

SHA512
65c0ccdf9857d2db4d6849f8498fbe62e59ec729a052f8eb33cacaa21d67b1cd5a6ca7468846c728cbefb1d8ad5ee9d9998b11f7c916c2e0fcf4f90ab7f5e937

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+smtwb.png

Filesize
63KB

MD5
316c699aa9afe167d6d56d978b63510b

SHA1
1ccf5dc5cd530feb060d14f3067918962ae572cc

SHA256
6a18e71ba4e0b1286f2e738e6e34e486d006aa9051db864185a53f1ba4c3a9b5

SHA512
5a343e1dfc360d278b7e0e691a9cd303c32b538e933f4e8acde1d40aa24be56f4d5dbb2bd5699f32c1c43afbd354a7c325dd46f72040c59329cf01a15e51dfd1

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+smtwb.txt

Filesize
1KB

MD5
346df044d4662952dcf7587fafd7d394

SHA1
8c2edc2cf4c3c853b4ab49c32b030148324597da

SHA256
093590baec265dcd87320bb11b8ffce9202231f8941e9e0457db17d78ece9b3c

SHA512
e3636cfca62a198437e72b27387ce2d303f41e50e781621fe0be029947a070155349d0d2c01b1200c69fa0fcf96ed7c89b69df565658251eff0bd0afe7bcb0e7

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
d4d8b4e31835fd18312fd16368ce2271

SHA1
f78a6fcd13f74f1fc23d96255015c2ea6d638b00

SHA256
b3850931812cf54620073ea9899b678b28859b18973773f24bbdb87d04114d62

SHA512
a2864c89511626700f8a7c852047155f2f75b4007aeb7549a02890d3512cf94c30bec66ea78e3d653373c27574819cde1a44b6a5f296cd53b9dd6eaa92a62c1d

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
c2c0e5e9e4e94082cd0ed8bac1206e26

SHA1
4fd3c296332b2307e3e93dedf9c8ca44dbc17285

SHA256
2e95cf6dcb7020b1f38c0fb9339622f1a6fcabaa461723ac701df9b54640ff98

SHA512
ea006bd2485dc580cc2f04ba85880ac8521429f71570aca61b1a77e5090b0f1994bd2dba300256bd02e44024f2caf18dda28badb1d6800a916bf586b358ac6b6

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
24ad1eb07136cb3b754928e22129c9ef

SHA1
b47221df9cb567fc1b9b817779484b4d3170dd7b

SHA256
6b9af5a871d2d6ff31b9c2b7038fd8b96b2ca6966ad6a5c02e14f08733856598

SHA512
14b5f47725177e33697929513e2867c628a239be8194c42e1b3bb57ced7064f158b0c9e6ca0a1a02652cd5793a7f92774706f3be2d566f372c05a50e889ef861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d609a647dbf3aa3e4c5e8bcdf933a63

SHA1
609865ece0a2f943d2fd4599c30d6858996400e3

SHA256
215d0612ae59a53edf288e3eaeaa38f26d44d261596d264bd19aecd883c675ea

SHA512
05ae9a4683c0a822096a030666805c733508921e68270312b9ac7865800738dbca3bc4578f40c2cec61d9f6512ff32ba5e9ecdb42758397748b07e55d80ff04c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40049bfeb30d769323f68fc56173f5f3

SHA1
aad5687d0a48f0edc3181886a7bdf5ce55c73cc3

SHA256
6a1f85604a32dc0a553d408bde5db4d0dfb45b747a4651626e349652153f95cd

SHA512
a799713eb91972bb581554d386eaa2675fe865cdcb4fd676a5f9368f3c448a14f9d108551e86174e9e4afad1a1c774aa398915dd0f9936724b1880968383a704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
89d4f4ee281bb538487c52008b6b0f29

SHA1
8e9892b163cf79d45e96e56703671a9a1abb8b85

SHA256
4459c5f4f099d6f01abd0c89afcfe0d28e73b55cf04a17aa2f09948b49edd523

SHA512
3bbcb8e632781497d0bee2b27dc1388691a6a411e7c06c4d584cdc8b37d41a0a3213202fb48f048cddc02badd4867bbb877395726dba18a8f3fa8d80d04478fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754057554938.txt

Filesize
77KB

MD5
888804e9376d2dd6121c2e60a54f9619

SHA1
80ff4f329157248fd6bb08652c13272adbf7d85c

SHA256
a2499d422dbf8cbdc5608e5b43a122aee549d38f8b488bd5c218d59e1a4bef37

SHA512
64fa326ef52726542972e29b3f33aea875a5c9d0796005b2da0e2a0bc2a785e0c4de6c6beaaa7358533de9b461e7d531e43edc29fc71f0fbff0bddbf26ad5895

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670756429722460.txt

Filesize
47KB

MD5
62e35134921722372384ed051fc2d0aa

SHA1
ef8c441c2d7136589d56c90b2ad6579b162c978b

SHA256
70d363f9440212dfc7cc9bd9f19396da6e23d171c4c9f871832a5cc6781198fa

SHA512
ebdb4fcd89e5c8509f87b379f65d1654e2f243527562862958a6d6f77045c239c93d1ee403faa0a8e3a7565f892e8fe4e723756260e61f53aa502a480e119b29

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670764200529937.txt

Filesize
74KB

MD5
40049306cfb96dd0cfcdcec89c944f82

SHA1
407c2769805f7166a85686a2fab80a1e72c23fdb

SHA256
8fe5073780654f843228f42528895dea999b43566d073fc3fe3197edbd267c20

SHA512
c17b5c741991eb2edeb591b1a58f8b8f1bbe638571802dc358fe5cb30c8714a354fce58dcd5482f76e107e27f7710f083de4887cfb71971dac20c95df58296eb

Download Submit
C:\Windows\nmehoqgasvgn.exe

Filesize
384KB

MD5
f296876ebba9dbd1085b55b219b3e869

SHA1
d9ddcb36580ccee4687b5efcb8c7d6a3bdbc7703

SHA256
1506227b3ca0429e22ae401eed7eea7b7eedb4a50f80d496bfb0a93c50c13d5b

SHA512
9b0942e8f993faf6d18689bab8ae368b2da5eedee1bee0acdfd5f9444bc15027d447fc8ae72989ee52f58771865907ece85d32a6a312b5a9c7fe70b4db0d0e4d

Download Submit
\??\pipe\LOCAL\crashpad_3896_ACZQKVWFIWARPFYA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3312-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-10671-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-831-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-23-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-20-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-2957-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-2961-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-5989-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-10724-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-10681-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-9487-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-25-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-10672-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3312-10680-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3416-12-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/3652-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3652-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3652-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3652-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3652-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4424-4-0x00000000006B0000-0x00000000006B4000-memory.dmp

Filesize
16KB

Download
memory/4424-0-0x00000000006B0000-0x00000000006B4000-memory.dmp

Filesize
16KB

Download
memory/4424-1-0x00000000006B0000-0x00000000006B4000-memory.dmp

Filesize
16KB

Download