teslacrypt | 543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
Size

368KB
MD5

0d3571a8ca8ef2fede9e3e11b8761582
SHA1

f2b0416e2afe93050816f62646ecae6080a9e559
SHA256

543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb
SHA512

1474d517cf92cd4dcec62bb656ae918f383fd4e146dd951c9613e7cb300870e32606c3607872bb17d84e2de5c13d23bf51bc16e8f2f576acd4bae9fe3e2b661c
SSDEEP

6144:lysifNvmGSKiUuyWvY1ZEYVG3I825tkB9GqlzXwOwNM5s8Fy:8BQUuy6kP5tU1lzXwBqbs

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_RECoVERY_+rfaah.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8B209C3EB36837C 2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8B209C3EB36837C 3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/8B209C3EB36837C If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/8B209C3EB36837C 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8B209C3EB36837C http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8B209C3EB36837C http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/8B209C3EB36837C *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/8B209C3EB36837C

URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8B209C3EB36837C

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8B209C3EB36837C

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/8B209C3EB36837C

http://xlowfznrg4wf7dli.ONION/8B209C3EB36837C

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (858) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exesgnlsimuisty.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	sgnlsimuisty.exe

Drops startup file 6 IoCs

Processes:

sgnlsimuisty.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+rfaah.html	sgnlsimuisty.exe

Executes dropped EXE 2 IoCs

Processes:

sgnlsimuisty.exesgnlsimuisty.exe

pid process

2548 sgnlsimuisty.exe
2984 sgnlsimuisty.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
2548	sgnlsimuisty.exe
2984	sgnlsimuisty.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

sgnlsimuisty.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fnvyxnfwhbiq = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\sgnlsimuisty.exe\""	sgnlsimuisty.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

Processes:

0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exesgnlsimuisty.exe

description	pid	process	target process
PID 3916 set thread context of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 2548 set thread context of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe

Drops file in Program Files directory 64 IoCs

Processes:

sgnlsimuisty.exe

description	ioc	process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-400_contrast-black.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageWideTile.scale-125.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Schema\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteMediumTile.scale-200.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-150.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare-Dark.scale-400.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-100.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-150_contrast-white.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated_contrast-high.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-20_altform-unplated.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\LargeTile.scale-100.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Windows Mail\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\people\eliseGibson.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-125.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-100.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-20.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-125.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-200.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-100.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-60_altform-unplated.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-125.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-200_contrast-white.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-54_altform-unplated.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-black_scale-100.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ja-JP\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Planet.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\_RECoVERY_+rfaah.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\Google\Chrome\_RECoVERY_+rfaah.txt	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer10Sec.targetsize-20.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSplashScreen.scale-100.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ml-IN\View3d\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\Fonts\_RECoVERY_+rfaah.html	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-80_altform-lightunplated.png	sgnlsimuisty.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\2.jpg	sgnlsimuisty.exe

Drops file in Windows directory 2 IoCs

Processes:

0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\sgnlsimuisty.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
File opened for modification	C:\Windows\sgnlsimuisty.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

NOTEPAD.EXEcmd.exe0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exesgnlsimuisty.execmd.exesgnlsimuisty.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgnlsimuisty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgnlsimuisty.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

sgnlsimuisty.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings sgnlsimuisty.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2860 NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	sgnlsimuisty.exe

pid	process
2860	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sgnlsimuisty.exe

pid	process
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe
2984	sgnlsimuisty.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

224 msedge.exe
224 msedge.exe
224 msedge.exe
224 msedge.exe
224 msedge.exe
224 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exesgnlsimuisty.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3812	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
Token: SeDebugPrivilege	2984	sgnlsimuisty.exe
Token: SeIncreaseQuotaPrivilege	5064	WMIC.exe
Token: SeSecurityPrivilege	5064	WMIC.exe
Token: SeTakeOwnershipPrivilege	5064	WMIC.exe
Token: SeLoadDriverPrivilege	5064	WMIC.exe
Token: SeSystemProfilePrivilege	5064	WMIC.exe
Token: SeSystemtimePrivilege	5064	WMIC.exe
Token: SeProfSingleProcessPrivilege	5064	WMIC.exe
Token: SeIncBasePriorityPrivilege	5064	WMIC.exe
Token: SeCreatePagefilePrivilege	5064	WMIC.exe
Token: SeBackupPrivilege	5064	WMIC.exe
Token: SeRestorePrivilege	5064	WMIC.exe
Token: SeShutdownPrivilege	5064	WMIC.exe
Token: SeDebugPrivilege	5064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5064	WMIC.exe
Token: SeRemoteShutdownPrivilege	5064	WMIC.exe
Token: SeUndockPrivilege	5064	WMIC.exe
Token: SeManageVolumePrivilege	5064	WMIC.exe
Token: 33	5064	WMIC.exe
Token: 34	5064	WMIC.exe
Token: 35	5064	WMIC.exe
Token: 36	5064	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5064	WMIC.exe
Token: SeSecurityPrivilege	5064	WMIC.exe
Token: SeTakeOwnershipPrivilege	5064	WMIC.exe
Token: SeLoadDriverPrivilege	5064	WMIC.exe
Token: SeSystemProfilePrivilege	5064	WMIC.exe
Token: SeSystemtimePrivilege	5064	WMIC.exe
Token: SeProfSingleProcessPrivilege	5064	WMIC.exe
Token: SeIncBasePriorityPrivilege	5064	WMIC.exe
Token: SeCreatePagefilePrivilege	5064	WMIC.exe
Token: SeBackupPrivilege	5064	WMIC.exe
Token: SeRestorePrivilege	5064	WMIC.exe
Token: SeShutdownPrivilege	5064	WMIC.exe
Token: SeDebugPrivilege	5064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5064	WMIC.exe
Token: SeRemoteShutdownPrivilege	5064	WMIC.exe
Token: SeUndockPrivilege	5064	WMIC.exe
Token: SeManageVolumePrivilege	5064	WMIC.exe
Token: 33	5064	WMIC.exe
Token: 34	5064	WMIC.exe
Token: 35	5064	WMIC.exe
Token: 36	5064	WMIC.exe
Token: SeBackupPrivilege	1328	vssvc.exe
Token: SeRestorePrivilege	1328	vssvc.exe
Token: SeAuditPrivilege	1328	vssvc.exe
Token: SeIncreaseQuotaPrivilege	452	WMIC.exe
Token: SeSecurityPrivilege	452	WMIC.exe
Token: SeTakeOwnershipPrivilege	452	WMIC.exe
Token: SeLoadDriverPrivilege	452	WMIC.exe
Token: SeSystemProfilePrivilege	452	WMIC.exe
Token: SeSystemtimePrivilege	452	WMIC.exe
Token: SeProfSingleProcessPrivilege	452	WMIC.exe
Token: SeIncBasePriorityPrivilege	452	WMIC.exe
Token: SeCreatePagefilePrivilege	452	WMIC.exe
Token: SeBackupPrivilege	452	WMIC.exe
Token: SeRestorePrivilege	452	WMIC.exe
Token: SeShutdownPrivilege	452	WMIC.exe
Token: SeDebugPrivilege	452	WMIC.exe
Token: SeSystemEnvironmentPrivilege	452	WMIC.exe
Token: SeRemoteShutdownPrivilege	452	WMIC.exe
Token: SeUndockPrivilege	452	WMIC.exe
Token: SeManageVolumePrivilege	452	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exesgnlsimuisty.exesgnlsimuisty.exemsedge.exe

description	pid	process	target process
PID 3916 wrote to memory of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 3916 wrote to memory of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 3916 wrote to memory of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 3916 wrote to memory of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 3916 wrote to memory of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 3916 wrote to memory of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 3916 wrote to memory of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 3916 wrote to memory of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 3916 wrote to memory of 3812	3916	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
PID 3812 wrote to memory of 2548	3812	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	sgnlsimuisty.exe
PID 3812 wrote to memory of 2548	3812	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	sgnlsimuisty.exe
PID 3812 wrote to memory of 2548	3812	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	sgnlsimuisty.exe
PID 3812 wrote to memory of 2372	3812	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	cmd.exe
PID 3812 wrote to memory of 2372	3812	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	cmd.exe
PID 3812 wrote to memory of 2372	3812	0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe	cmd.exe
PID 2548 wrote to memory of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe
PID 2548 wrote to memory of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe
PID 2548 wrote to memory of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe
PID 2548 wrote to memory of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe
PID 2548 wrote to memory of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe
PID 2548 wrote to memory of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe
PID 2548 wrote to memory of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe
PID 2548 wrote to memory of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe
PID 2548 wrote to memory of 2984	2548	sgnlsimuisty.exe	sgnlsimuisty.exe
PID 2984 wrote to memory of 5064	2984	sgnlsimuisty.exe	WMIC.exe
PID 2984 wrote to memory of 5064	2984	sgnlsimuisty.exe	WMIC.exe
PID 2984 wrote to memory of 2860	2984	sgnlsimuisty.exe	NOTEPAD.EXE
PID 2984 wrote to memory of 2860	2984	sgnlsimuisty.exe	NOTEPAD.EXE
PID 2984 wrote to memory of 2860	2984	sgnlsimuisty.exe	NOTEPAD.EXE
PID 2984 wrote to memory of 224	2984	sgnlsimuisty.exe	msedge.exe
PID 2984 wrote to memory of 224	2984	sgnlsimuisty.exe	msedge.exe
PID 224 wrote to memory of 4596	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 4596	224	msedge.exe	msedge.exe
PID 2984 wrote to memory of 452	2984	sgnlsimuisty.exe	WMIC.exe
PID 2984 wrote to memory of 452	2984	sgnlsimuisty.exe	WMIC.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe
PID 224 wrote to memory of 2356	224	msedge.exe	msedge.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

sgnlsimuisty.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	sgnlsimuisty.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	sgnlsimuisty.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0d3571a8ca8ef2fede9e3e11b8761582_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\sgnlsimuisty.exe
    C:\Windows\sgnlsimuisty.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\sgnlsimuisty.exe
      C:\Windows\sgnlsimuisty.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2984
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5064
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:2860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ff92e3046f8,0x7ff92e304708,0x7ff92e304718
        6⤵
        
        PID:4596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        6⤵
        
        PID:2356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
        6⤵
        
        PID:2744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
        6⤵
        
        PID:5108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
        6⤵
        
        PID:2180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
        6⤵
        
        PID:3104
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
        6⤵
        
        PID:3840
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
        6⤵
        
        PID:864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
        6⤵
        
        PID:3352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
        6⤵
        
        PID:4940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
        6⤵
        
        PID:2664
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4525905613846771580,15344451061278286442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
        6⤵
        
        PID:1508
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:452
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\SGNLSI~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\0D3571~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_RECoVERY_+rfaah.html

Filesize
11KB

MD5
5d0925513a7c909a4da8c5a0bc717451

SHA1
12715bf1db7687bb10ae15e15d3ad5893b8fc365

SHA256
650ddef2748bd9cab08d9d4ee6c54f1cdcaa5578d9a8b76c4f1a397e18a4fb3a

SHA512
957da26e5cc2b625d65214cf1426d416ece105fa241fe6932cd77c45ddae7778954c17a9e0c0aff4848f58fac8efa4cfda3c3b5c2942ee5f597285ef8b0f011e

Download Submit
C:\Program Files\7-Zip\Lang\_RECoVERY_+rfaah.png

Filesize
64KB

MD5
be61d7bf3eb5348994814e46e17de61d

SHA1
2775d3f26d9cc8a2d9c28b59b37a20e776f34960

SHA256
4b487ed32d9bad6e0827a4974ca269a82d03ce00215e9edec008752d19f432d1

SHA512
044b50ce5f4c86046c522e6c1b10558757dc15d23a69a983f96a441baa720fb4116732e699b4da7253893a7a2514520fc170fbb224aaff56f3cca69d314d10b4

Download Submit
C:\Program Files\7-Zip\Lang\_RECoVERY_+rfaah.txt

Filesize
1KB

MD5
eca7d87b4b7d5eb604874c11d30ce585

SHA1
376db7a17b8db0fd3e3833cbfdc1ebe9f2e790e4

SHA256
03d46bd3b046ebd17c9e69ab5ea287fdea60aff02aeedd45b1b181e06ae6691c

SHA512
4a0a72811534371241e1924ec361c78203525d245a46c5299b2e5622ad0f3467cff85f34bc3f1f47126eb56812a95f988badf32edf54e07e3c2470f186c8c298

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
7d55af7471a95242af01339044a38743

SHA1
cbcb391a8f86aa9679a0aad108143efc5c4f9db7

SHA256
e11386c9f57eb33d01007154a6d5353e9c1c22542b78eb862ff9ab5a08f8927f

SHA512
3fb8b9f0894507ced10ca7baf5543d98d1dec661186ea7cd0ce71aafc89078521ec28fb09a93005fbd14e1bead504d23c4dac987637016474e69a4e94c6f2886

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
5cec491a726ea6ad8de66e6808124f43

SHA1
c066b02a245553308ef4259da7a0ca044c263659

SHA256
006b6801ed84a8126c9e11cd2592db152fb4baaa7f7bfc2df01b7a78c9a7ae8c

SHA512
db5c600ba23be56f3b9014fec69d6fc869e4d1d2ac0ee75b252eaf737d59a665a7a2577011e5a9a56dd0991f55f463cdf25e4d078b1758effbdf27d77e0d74dd

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
6ec7a316c41cc491ce005a83f6e6a753

SHA1
df7e8d6a945609ed3ce5a249586a91a827448ef6

SHA256
16dad0a5d1bac5af220c4fc12d9aa531d5dca2febe94774b4ced77b51152e78c

SHA512
d52a7bbdde7442df836b5765d952f96efe64a2a2da61e87359e43c01cad412fe1bf5e56daea9a40a74d2d02acb144e6a9e4bf6637db475b9df44cf98ced67912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a63641084c4b9c1298bb66f7c748fe20

SHA1
13cd07abafa3977cecb850913f38f8b6f6362037

SHA256
e058dfde16bf223d4506651624944aa6bee6722faefeca307f6a2a59d26ebab9

SHA512
1663984789c05757b7f076c39797c799c4cc1346383cc5e2edb5d047cccc4d0b31c2f84bbbb0f9721fccc4f89ceacacfdcf991465bfee99cd5c5c7880121df4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8792e45d6eaa61527062ac5b06a8523

SHA1
c8f6ea3dad8183fba15fc5c50a65c4b5ea299482

SHA256
d80b30fd7104aabf601551f7850329bcc86e28b0994183e9161ea195f1cf4afb

SHA512
cb20120a98eacfbf1a9f3fca24546a705668ae41b62184e7832fb5154251a5fee10834cf2cd63df5ab2b79122ecf99c5df8c94a970d8c0524f32451653f016b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
24491fcfece8384be112267e18986c9c

SHA1
d4b7a57abfca489060fc30fc795251d745d1e24f

SHA256
8be895d1647c653b605d654c8b165663a090f1d2a430805ef782b492fdf815a4

SHA512
2e0f49eebc3c8262d4c2fc8590152561f694c7b21ff9f1b0dc8e4d4edd0265959cbb168846ebc4daaeb4b3a95161a6a3006bd5aef5da80cf51539c869871f5bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754135044722.txt

Filesize
77KB

MD5
a3556cc4ada3185050b6d43ba27126c3

SHA1
8e64d41cd068ee37b466398505225df8f31ddcf7

SHA256
6398ae143531b3646f2c08da78a29e3c58b5f9fe90a0b24fe8a95619ce3e2a29

SHA512
98ce32226c5d0294414b9c3fefede366eccd42fa7260757e3f621f6d63da0dca833eec7dd868e15513497c5e7473d8a8e1704d378582eb9948c6a276a6b70258

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670756561672614.txt

Filesize
47KB

MD5
acde41305928bdfd9b2f2640a65a0afd

SHA1
f3721ef4d153f1597adcc9681e464b3eb2eb2a97

SHA256
9c5ac7d8efb3454c56a89192591922b8a8763c945cbec9f6b86dbc53e22a9c32

SHA512
8886f127a9c3521ccfc4e45527865329b92e451b2f2a8ebfbbbdc7cd22d280e75777c7727d6950a8a81069b7d9e0cc90286823b646b0686df2c67a27458a2f3b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670764757873191.txt

Filesize
74KB

MD5
1daaea0c090d8812b43dc6d81f37bed0

SHA1
01ddbb8e7a68dc0f4beb20392f8f8fd69e688ee0

SHA256
64d6bae14d7f4b4f8764ca52af2b9d517ca6cb932075b54552054313a1ad0dcd

SHA512
bb3f3f18633aa5adfa62c49ade14c9389e723c1bc9a8a7f01ff701fdff3b4a881e137918256fe29f9a99286c9ea7e70815dea95edf66ef842e8d834f07326e09

Download Submit
C:\Windows\sgnlsimuisty.exe

Filesize
368KB

MD5
0d3571a8ca8ef2fede9e3e11b8761582

SHA1
f2b0416e2afe93050816f62646ecae6080a9e559

SHA256
543144026b1a0c1bbfea07c5af4b9e5654c6eb3416f7ac70d676c6c8682bacbb

SHA512
1474d517cf92cd4dcec62bb656ae918f383fd4e146dd951c9613e7cb300870e32606c3607872bb17d84e2de5c13d23bf51bc16e8f2f576acd4bae9fe3e2b661c

Download Submit
\??\pipe\LOCAL\crashpad_224_WHDEZDDCZAJFRRIS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2548-12-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/2984-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-10666-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-23-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-20-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-2916-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-3098-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-6345-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-17-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-10720-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-10049-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-24-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-10667-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-10675-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2984-10677-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3812-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3812-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3812-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3812-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3812-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3916-4-0x0000000000990000-0x0000000000994000-memory.dmp

Filesize
16KB

Download
memory/3916-0-0x0000000000990000-0x0000000000994000-memory.dmp

Filesize
16KB

Download
memory/3916-1-0x0000000000990000-0x0000000000994000-memory.dmp

Filesize
16KB

Download