troldesh | hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/ransomwares/NoMoreRansom[.]zip

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/NoMoreRansom.zip

Score

10^/10

troldesh discovery persistence ransomware trojan upx

Malware Config

Signatures

Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
49	raw.githubusercontent.com
48	raw.githubusercontent.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4648-207-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-208-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-210-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-209-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-223-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-274-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-284-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-293-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5972-295-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/5972-319-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-322-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/6136-323-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/6136-324-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-327-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/6136-328-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-331-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/2676-333-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/2676-334-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/460-338-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-339-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/460-340-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-343-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/2060-347-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-349-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/2060-350-0x0000000000400000-0x00000000005DE000-memory.dmp	upx
behavioral1/memory/4648-355-0x0000000000400000-0x00000000005DE000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2028	msedge.exe
2028	msedge.exe
1044	identity_helper.exe
1044	identity_helper.exe
3016	msedge.exe
3016	msedge.exe
4648	[email protected]
4648	[email protected]
4648	[email protected]
4648	[email protected]
5472	mspaint.exe
5472	mspaint.exe
5972	[email protected]
5972	[email protected]
5972	[email protected]
5972	[email protected]
6136	[email protected]
6136	[email protected]
6136	[email protected]
6136	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
2676	[email protected]
460	[email protected]
460	[email protected]
460	[email protected]
460	[email protected]
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
2060	[email protected]
2060	[email protected]
2060	[email protected]
2060	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5472	mspaint.exe
5660	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2564	2028	msedge.exe	82
PID 2028 wrote to memory of 2564	2028	msedge.exe	82
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 4484	2028	msedge.exe	83
PID 2028 wrote to memory of 2172	2028	msedge.exe	84
PID 2028 wrote to memory of 2172	2028	msedge.exe	84
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85
PID 2028 wrote to memory of 4580	2028	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/NoMoreRansom.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc103f46f8,0x7ffc103f4708,0x7ffc103f4718
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17511852202526887251,1645474732377239305,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3716

C:\Users\Admin\AppData\Local\Temp\Temp1_NoMoreRansom.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_NoMoreRansom.zip\[email protected]"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4648

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\StepFind.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:5524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5660

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5972

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6136

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2676

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:460

C:\Users\Admin\Desktop\[email protected]
"C:\Users\Admin\Desktop\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
89620ab50328cace72693b2db3f9b8ea

SHA1
245ff622e691b7a79cc17525e9700d322c6f4893

SHA256
57e5d28d3b657888efedf9b5e2fc47c983ff3f3c10168c54b61b39c87867b860

SHA512
cec6d71b21d6788db647ef43de6bc517ea4559ad5525994fe71e4cea567132c07d9455c3d443766584216d57cccf33ec15f42a539a0e23b81c501fb5004ed6c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
492B

MD5
9a6ce27b8d0b8451401204291e83d579

SHA1
0a94eaae0e37289b3ab5c634d886579f01f8cbab

SHA256
475dd5afca6828b19833bdabdc3d287a2a147dd8d6e8abeb42f5927e3ed903af

SHA512
bcc5cb6b95208daf67402adbab62269fa29f6406d88c5759344887c109285ab59625f94f139fe92fa4dcea2151d7e3d2455484272ed6399370e4452724497785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5fbce2a26ac92c6c70183f44c9cc1890

SHA1
cb3597590c06c4d342b1dab140237cee8d409bc6

SHA256
436f37b32421bf5d6bc038b10395fb48e9f93552048818b01aa81ac2dcc96dc9

SHA512
cad63cd4b8a137ff390aef4c85115bc6475d0b85648dca03fd3f2ea9c8ce00da696dcc05f72a4083ad95379a158468e20429460eeb41c8cfc161f1d0e69605f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1219c4bd0923551fc844896792bc016e

SHA1
08903ba70b620b4ba1b8587846678f8745042455

SHA256
abaf6476b6c4b396c1df44e05b8804179ffb328a40e0ecff3efd11a0f6a3c55a

SHA512
b05875cf0ece9507a0cd548befe791995b76f6aca874fb1988faca32de194cbfa8fa7d42fc23536ae2163c8fce0b5c72f3f8efb52abb1ac3518fc635bc62cd6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f6bc306ce53202c209f8c6c567582b3d

SHA1
bef4b88df003da2e5b3055bc6ae35300382fc9f4

SHA256
826bd5b20d75e0cb6f03d0e0ed6bf20fa61e7df00c2b0a22b2e96ec716514e1b

SHA512
8a0c324fdd4618686b52465a4e6a715a90da8fd7552b1ae894d5e285304a2ba96f861904218dd8ec1aca17c82ca4283c46adb68c3cce2505f9c8f7f5f75e1f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
3a85b1b32b6e6cb1106f7b781bffd03f

SHA1
880805faf10f93c63f2afa1bf00b1bbef1fce9fc

SHA256
f91c0cb1da9b1f28ff7fe9ffe2c382f2cb9c650a29e5b559257f22ae9dccd755

SHA512
c343a1f9e2ac8efe45ad83adc919019afd61b94d66ac7645a32a9c896ba3f8b19418baf65f550a9d1e54fa648059c490d6bd547bd81ee8552bc0fd2a48c8801e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
b116e702c9ad3d754ab215e08c209908

SHA1
16fbb229dcbd4b3f77f813f83ebd1496cbacb1e5

SHA256
21739726481116a45f6d01d4375ef40ea17750c961f55df30ee4c4d7f475c440

SHA512
a0cd67e9dbd63d1140c0adbc7317d8d4a1befa80aac1ca33cc75970dbcced735e30e1bad548cbc05df9486c4a95561cfd8d1c765391b7a65be5231cd95e90339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d9e5.TMP

Filesize
874B

MD5
b781142d0451e8df80d028aea4ab1be2

SHA1
2b74bf1d018a2a46be3ab0d9d0493bc8a085b926

SHA256
1db6b4cbe02aa4d2063a534f94016884b8ba276547a3bdc9b3e1790c0133f1a8

SHA512
d9a8e651c04bb47db9dfc88650372e4c5ebdfe1064432462b36ff50cb6a556a51978984e53196bd99a50c94a9d0cfd27f3764ec212049a72977d66a51f4d5c1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
27c669ae047457b69cb06ed52c0b245a

SHA1
3c235cca6a97b6bde7de43e6748d4d420c30cf9d

SHA256
89cbfc2f867e216fda43c542c885994b21287942ad4663967bd60c6d69b7d50c

SHA512
bbfd3c30d9ebea917fd6fab721cffc6c8fc16f75a8401ae997b1f6e1fa0a1d72874f6acde0a8577a419efa73b1ca44449ca4d070b0824a2e504c6fb4320972b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
45af02cb6dbd39257ff4b719c1ac484f

SHA1
250165472b6d10046519f09d785db719c904c8ad

SHA256
8cac40977a773ea795e65ed13252bc4f8c26928a0448d9d6fabd280013c29fe3

SHA512
eea48af513016876b52f4f47821064a6137d7c903bf0ce305209d9b7c05371ad871b82c758e0b0d28acdec19cecf06146fd3d722d2b8b872c98b6f981c7d56dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ace519e911b939bb48580985dd08493a

SHA1
591ae838d385e34f89a87625a4039bb37f3b85d7

SHA256
10857a96db798efc05960c71beba566a7ff4f96c66395d472b5f10b39dad41b8

SHA512
923efc8220313e4afec826975b9eeb91585f6c7ab4208c224b1abb8795510945136a1887dff66508ffc931bb45ad742e9f94da8604f6ea6e65ee5d6c92b468c1

Download Submit
C:\Users\Admin\Downloads\NoMoreRansom.zip

Filesize
916KB

MD5
f315e49d46914e3989a160bbcfc5de85

SHA1
99654bfeaad090d95deef3a2e9d5d021d2dc5f63

SHA256
5cbb6442c47708558da29588e0d8ef0b34c4716be4a47e7c715ea844fbcf60d7

SHA512
224747b15d0713afcb2641f8f3aa1687516d42e045d456b3ed096a42757a6c10c6626672366c9b632349cf6ffe41011724e6f4b684837de9b719d0f351dfd22e

Download Submit
memory/460-338-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/460-340-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2060-347-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2060-350-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2676-333-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2676-334-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-343-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-274-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-355-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-208-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-207-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-339-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-223-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-349-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-284-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-293-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-209-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-327-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-210-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-322-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4648-331-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5524-268-0x0000018CED970000-0x0000018CED971000-memory.dmp

Filesize
4KB

Download
memory/5524-266-0x0000018CED970000-0x0000018CED971000-memory.dmp

Filesize
4KB

Download
memory/5524-253-0x0000018CE4D60000-0x0000018CE4D70000-memory.dmp

Filesize
64KB

Download
memory/5524-257-0x0000018CE4DA0000-0x0000018CE4DB0000-memory.dmp

Filesize
64KB

Download
memory/5524-264-0x0000018CED8F0000-0x0000018CED8F1000-memory.dmp

Filesize
4KB

Download
memory/5524-269-0x0000018CEDA00000-0x0000018CEDA01000-memory.dmp

Filesize
4KB

Download
memory/5524-272-0x0000018CEDA10000-0x0000018CEDA11000-memory.dmp

Filesize
4KB

Download
memory/5524-271-0x0000018CEDA10000-0x0000018CEDA11000-memory.dmp

Filesize
4KB

Download
memory/5524-270-0x0000018CEDA00000-0x0000018CEDA01000-memory.dmp

Filesize
4KB

Download
memory/5972-295-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/5972-319-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/6136-324-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/6136-323-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/6136-328-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download