teslacrypt | 33e6272f8a84de06327c40ad72efd8537c82d5f9d86b082ef1f6cfe7031f7c3b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
Size

364KB
MD5

2b5c64d0ae335be2b30de30ed5cf9b71
SHA1

57a809107f1810a3ed01d4baf09f89a1fb562757
SHA256

33e6272f8a84de06327c40ad72efd8537c82d5f9d86b082ef1f6cfe7031f7c3b
SHA512

96ebf2562a60ef245aea06decf83298979368e4c4dabaa107068e430d7fe86af5f996cfffba95e7f1c5ef411e7d1265d24a84716be63eaedfd48ad3aac4dc4e8
SSDEEP

6144:REAU1eeD624pGSoJDZ2sqIrU5AsZBbgyg4s43yirHwlzKPm:RvU1eeD6282JtOI2D3bzsEHrQBKP

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+oqsrs.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/C4BE40509F94F2DE 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/C4BE40509F94F2DE 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/C4BE40509F94F2DE If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/C4BE40509F94F2DE 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/C4BE40509F94F2DE http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/C4BE40509F94F2DE http://yyre45dbvn2nhbefbmh.begumvelic.at/C4BE40509F94F2DE Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/C4BE40509F94F2DE

URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/C4BE40509F94F2DE

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/C4BE40509F94F2DE

http://yyre45dbvn2nhbefbmh.begumvelic.at/C4BE40509F94F2DE

http://xlowfznrg4wf7dli.ONION/C4BE40509F94F2DE

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (904) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exegwwgbswhampg.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	gwwgbswhampg.exe

Drops startup file 6 IoCs

Processes:

gwwgbswhampg.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe

Executes dropped EXE 2 IoCs

Processes:

gwwgbswhampg.exegwwgbswhampg.exe

pid process

2996 gwwgbswhampg.exe
1012 gwwgbswhampg.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
2996	gwwgbswhampg.exe
1012	gwwgbswhampg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

gwwgbswhampg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nkenmmo = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\gwwgbswhampg.exe"	gwwgbswhampg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

Processes:

2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exegwwgbswhampg.exe

description	pid	process	target process
PID 4784 set thread context of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 2996 set thread context of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe

Drops file in Program Files directory 64 IoCs

Processes:

gwwgbswhampg.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-400.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-400.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\165.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\SmallTile.scale-200.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-256_altform-lightunplated.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-125.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_1_Loud.m4a	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1949_20x20x32.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-150.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30_altform-unplated.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\Windows NT\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-white.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-125_contrast-black.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-colorize.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\loc\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\uk-UA\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-white\Settings.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\IDPValueAssets\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\View3d\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\THMBNAIL.PNG	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-200.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-200.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Toolkit\Images\dash.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\LargeTile.scale-200.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-125.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-150_contrast-black.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ha-Latn-NG\View3d\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Success.jpg	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-125.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bn-BD\View3d\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailMediumTile.scale-100.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-24_altform-lightunplated.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_altform-unplated.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\10px.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-us\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-125.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-125.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\_ReCoVeRy_+oqsrs.txt	gwwgbswhampg.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\_ReCoVeRy_+oqsrs.png	gwwgbswhampg.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+oqsrs.html	gwwgbswhampg.exe

Drops file in Windows directory 2 IoCs

Processes:

2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\gwwgbswhampg.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
File opened for modification	C:\Windows\gwwgbswhampg.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exe2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exegwwgbswhampg.execmd.exegwwgbswhampg.exeNOTEPAD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gwwgbswhampg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gwwgbswhampg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

gwwgbswhampg.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings gwwgbswhampg.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4860 NOTEPAD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	gwwgbswhampg.exe

pid	process
4860	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

gwwgbswhampg.exe

pid	process
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe
1012	gwwgbswhampg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1708 msedge.exe
1708 msedge.exe
1708 msedge.exe
1708 msedge.exe
1708 msedge.exe
1708 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exegwwgbswhampg.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4920	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
Token: SeDebugPrivilege	1012	gwwgbswhampg.exe
Token: SeIncreaseQuotaPrivilege	3284	WMIC.exe
Token: SeSecurityPrivilege	3284	WMIC.exe
Token: SeTakeOwnershipPrivilege	3284	WMIC.exe
Token: SeLoadDriverPrivilege	3284	WMIC.exe
Token: SeSystemProfilePrivilege	3284	WMIC.exe
Token: SeSystemtimePrivilege	3284	WMIC.exe
Token: SeProfSingleProcessPrivilege	3284	WMIC.exe
Token: SeIncBasePriorityPrivilege	3284	WMIC.exe
Token: SeCreatePagefilePrivilege	3284	WMIC.exe
Token: SeBackupPrivilege	3284	WMIC.exe
Token: SeRestorePrivilege	3284	WMIC.exe
Token: SeShutdownPrivilege	3284	WMIC.exe
Token: SeDebugPrivilege	3284	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3284	WMIC.exe
Token: SeRemoteShutdownPrivilege	3284	WMIC.exe
Token: SeUndockPrivilege	3284	WMIC.exe
Token: SeManageVolumePrivilege	3284	WMIC.exe
Token: 33	3284	WMIC.exe
Token: 34	3284	WMIC.exe
Token: 35	3284	WMIC.exe
Token: 36	3284	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3284	WMIC.exe
Token: SeSecurityPrivilege	3284	WMIC.exe
Token: SeTakeOwnershipPrivilege	3284	WMIC.exe
Token: SeLoadDriverPrivilege	3284	WMIC.exe
Token: SeSystemProfilePrivilege	3284	WMIC.exe
Token: SeSystemtimePrivilege	3284	WMIC.exe
Token: SeProfSingleProcessPrivilege	3284	WMIC.exe
Token: SeIncBasePriorityPrivilege	3284	WMIC.exe
Token: SeCreatePagefilePrivilege	3284	WMIC.exe
Token: SeBackupPrivilege	3284	WMIC.exe
Token: SeRestorePrivilege	3284	WMIC.exe
Token: SeShutdownPrivilege	3284	WMIC.exe
Token: SeDebugPrivilege	3284	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3284	WMIC.exe
Token: SeRemoteShutdownPrivilege	3284	WMIC.exe
Token: SeUndockPrivilege	3284	WMIC.exe
Token: SeManageVolumePrivilege	3284	WMIC.exe
Token: 33	3284	WMIC.exe
Token: 34	3284	WMIC.exe
Token: 35	3284	WMIC.exe
Token: 36	3284	WMIC.exe
Token: SeBackupPrivilege	2028	vssvc.exe
Token: SeRestorePrivilege	2028	vssvc.exe
Token: SeAuditPrivilege	2028	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2516	WMIC.exe
Token: SeSecurityPrivilege	2516	WMIC.exe
Token: SeTakeOwnershipPrivilege	2516	WMIC.exe
Token: SeLoadDriverPrivilege	2516	WMIC.exe
Token: SeSystemProfilePrivilege	2516	WMIC.exe
Token: SeSystemtimePrivilege	2516	WMIC.exe
Token: SeProfSingleProcessPrivilege	2516	WMIC.exe
Token: SeIncBasePriorityPrivilege	2516	WMIC.exe
Token: SeCreatePagefilePrivilege	2516	WMIC.exe
Token: SeBackupPrivilege	2516	WMIC.exe
Token: SeRestorePrivilege	2516	WMIC.exe
Token: SeShutdownPrivilege	2516	WMIC.exe
Token: SeDebugPrivilege	2516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2516	WMIC.exe
Token: SeRemoteShutdownPrivilege	2516	WMIC.exe
Token: SeUndockPrivilege	2516	WMIC.exe
Token: SeManageVolumePrivilege	2516	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exegwwgbswhampg.exegwwgbswhampg.exemsedge.exe

description	pid	process	target process
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4784 wrote to memory of 4920	4784	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
PID 4920 wrote to memory of 2996	4920	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	gwwgbswhampg.exe
PID 4920 wrote to memory of 2996	4920	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	gwwgbswhampg.exe
PID 4920 wrote to memory of 2996	4920	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	gwwgbswhampg.exe
PID 4920 wrote to memory of 1904	4920	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	cmd.exe
PID 4920 wrote to memory of 1904	4920	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	cmd.exe
PID 4920 wrote to memory of 1904	4920	2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe	cmd.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 2996 wrote to memory of 1012	2996	gwwgbswhampg.exe	gwwgbswhampg.exe
PID 1012 wrote to memory of 3284	1012	gwwgbswhampg.exe	WMIC.exe
PID 1012 wrote to memory of 3284	1012	gwwgbswhampg.exe	WMIC.exe
PID 1012 wrote to memory of 4860	1012	gwwgbswhampg.exe	NOTEPAD.EXE
PID 1012 wrote to memory of 4860	1012	gwwgbswhampg.exe	NOTEPAD.EXE
PID 1012 wrote to memory of 4860	1012	gwwgbswhampg.exe	NOTEPAD.EXE
PID 1012 wrote to memory of 1708	1012	gwwgbswhampg.exe	msedge.exe
PID 1012 wrote to memory of 1708	1012	gwwgbswhampg.exe	msedge.exe
PID 1708 wrote to memory of 4376	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4376	1708	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2516	1012	gwwgbswhampg.exe	WMIC.exe
PID 1012 wrote to memory of 2516	1012	gwwgbswhampg.exe	WMIC.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe
PID 1708 wrote to memory of 4404	1708	msedge.exe	msedge.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

gwwgbswhampg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	gwwgbswhampg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	gwwgbswhampg.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2b5c64d0ae335be2b30de30ed5cf9b71_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\gwwgbswhampg.exe
    C:\Windows\gwwgbswhampg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\gwwgbswhampg.exe
      C:\Windows\gwwgbswhampg.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1012
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3284
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:4860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd65cb46f8,0x7ffd65cb4708,0x7ffd65cb4718
        6⤵
        
        PID:4376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
        6⤵
        
        PID:4404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
        6⤵
        
        PID:3604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
        6⤵
        
        PID:3656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
        6⤵
        
        PID:4840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
        6⤵
        
        PID:2992
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
        6⤵
        
        PID:3728
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
        6⤵
        
        PID:4844
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
        6⤵
        
        PID:3056
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
        6⤵
        
        PID:4332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
        6⤵
        
        PID:4888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5521505004423148097,9264027375139632862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
        6⤵
        
        PID:2248
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\GWWGBS~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2B5C64~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+oqsrs.html

Filesize
12KB

MD5
42659dd832f9f3965ea23d92223bd733

SHA1
eebbcb68bc17c83f164883747e72112e4dee07e9

SHA256
ac0361d5d82b41def5259b3745b5ab9bf71ce70a4c41fbb78cef6dc345250e60

SHA512
1d63a1c14ad77ee79e3e622456318e561f285cde69e17b31cc98889f0f05e545d0f67528b2262ebc2ce17a83e00fcaa14a145bad22c53da490ce3b6da23ff4e1

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+oqsrs.png

Filesize
64KB

MD5
55d1691a252eb0ac44d3cd6e66a23760

SHA1
6ac66f42121333b53a049a1bd22dc47d995a96e8

SHA256
2e6ab2e2387c00709c098fa9b69ecdd925abcbcaa2df9031a5b02e005a43c12f

SHA512
28fae46ab2604ef4816193bb9ad942129db6fa70b8a5e6866ed96873211e902ca408f5b7e469520c3f40785a90d4acea462c313ba0d217a9b255d1fabe648907

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+oqsrs.txt

Filesize
1KB

MD5
41a9e83aad309e5f2aa1e668d49ef993

SHA1
bb6f4b42979eaea2400be2b1c0cb568a01b372b4

SHA256
402580fcd85d101d7996169a0606ddeb45d74302973e60282f2a218d51cc7a7b

SHA512
946c6f786f8b14092dfeb86f0c52a9357274fd4f53eedd95563988fa07ce08d0f0923e6ac08be7536cc95282280463e5dc2b7911f7d2c24512aa0e4f8f557906

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
23c8c2f471f744e6e0599779e8e87ec7

SHA1
ce98ba47811599178ffd1ae4218f0e053c2f5001

SHA256
665de6530ed11a803c03e583fa66c042d48c1ad20bcb398e983f46618bd7b1e4

SHA512
7620be1f73d278c827fc0522412dafd069e609aa143611735c2b1dd3210680c7dfb74bba2a4211243aee36c77d19c0a966aa6a3d0493c51f24d22c2d3b41ede0

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
a8e27e9139ed06611e2bfe980cdcae32

SHA1
67b23117e3bbe03ab1d8463fe2795675422a1671

SHA256
9f62e5af7fd5797b79be955874b57ec9106b69ab2a1615ed82d92e475f78dc42

SHA512
746aac269a994d4c7508a4484afa7266fa7122dde7f6281c952eb943c9c90da19e26e48cfb68ff79c2efd40624ec2a0750f6fce89078e55ece8e0c386123c902

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
541a6ea6a11d50683ed6e5a2568ea442

SHA1
4516eb96360a8ca11cd0e8f468e703a7888f2ce2

SHA256
df3a0813423df52ac2733198332937e2f031af25bf2d8aa9a65452e513cd894f

SHA512
88ef8aefd462a12782acf554bde2cd598edb2f4cd894864356c208aba21bd000f72a7383967067147c00d01b63d079d9a0bab9002fd7d0a10fa0bdac96fe5c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2149e7354a127f33a90c0175d503dbf1

SHA1
08c7614e58cde758db8902f8805fc53564305706

SHA256
025441e6322794a0a5ce08e790958631bc479415ab625656edde4c7de8687f46

SHA512
186793e3ce4679348fb121adad60139692507b19458ecf447e71cbfbade74e54b5566306ed3c3337ae5d14a26250dd8deb1125232b8df8dd125e48487b744d0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b13f4142a754274ea99b7853b24dff20

SHA1
87dc82a1856408cf61041529eb5f528e31a1b955

SHA256
688b63ffda31fb2a64808943ff52315aa97caf8043c5e212538bf9481dceacb1

SHA512
d36aa7ddcbe4a664c15d6ace9633220fef9b55f194b90a7fbe352d95df3f58118c782c6806002f9af746ac3546a2b16564b2d5d0cf227a9a5ddbbb5e639ff227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf6662c2f511c4c60d0f0e7f31d50b59

SHA1
2aabdbfd51156211369e963c305e69d30e0b4b88

SHA256
cf9974b773ee2b1fd871ea56893295831e245f812814a5c5aec9eca0b76b2a6e

SHA512
c1a2b9b076cf3febc16da3998af52ddc99dd3248c38bd503bfd37f6ed18d0ea4eb85585287b075f21902f2b1abea86681d6277b7a0724dd9576dbbf55cfbe9e6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662360645001.txt

Filesize
77KB

MD5
5e8ae34cfc16fd68591b44598ebf1bad

SHA1
b8a2e72080dc8c1cc08d0b2985425fdb0abce358

SHA256
0595fe25ed118bc2d375467d1456dc523d0200be355d87a1f4a4e34589eb4143

SHA512
51dd0ac114f63f6090a428e5f11c81891e4adf343413337837119fe951397a25149ea6d28e98195cc0fa10ca080a4e85f3f6fbe583b34f40b590bd4f6136e073

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663623337830.txt

Filesize
47KB

MD5
39153ff6792e71488c2e165908607561

SHA1
8891033e6b9f529f747a4c101a3bc60d9ebef8fd

SHA256
523dc81f05be2877ba3f1cf3bb1a5043c256a9830be815ca6407e8cb9c390cc8

SHA512
bf5380f1abc68c45855a4d79f716ed6a96808763340088512a2ebf87b1810c7b07d03d835d23f515a016dbc1d861fcfe43380dd7f8b602b628a9db15b5ccdc61

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671211214398.txt

Filesize
74KB

MD5
14cc4bc231a107c6bd609fe0004cdc32

SHA1
18f14979395f51663533e2de0c94c96da3f0a2ee

SHA256
cf16c216e5aa10984ebc4dae340f08844a4698266ef85aacc92f8b080d2f40c7

SHA512
d0e6394a4fcffe01b1c3fd9516131c41974433fef30892800f61c843eee31e305931f0e83c0f3f2cb85733ebd2be3166bc9069394f362d7f4631e2fa544cb990

Download Submit
C:\Windows\gwwgbswhampg.exe

Filesize
364KB

MD5
2b5c64d0ae335be2b30de30ed5cf9b71

SHA1
57a809107f1810a3ed01d4baf09f89a1fb562757

SHA256
33e6272f8a84de06327c40ad72efd8537c82d5f9d86b082ef1f6cfe7031f7c3b

SHA512
96ebf2562a60ef245aea06decf83298979368e4c4dabaa107068e430d7fe86af5f996cfffba95e7f1c5ef411e7d1265d24a84716be63eaedfd48ad3aac4dc4e8

Download Submit
\??\pipe\LOCAL\crashpad_1708_CRWUMZUTLBYYWEVD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1012-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-10726-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-25-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-23-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-20-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-2684-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-2691-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-5352-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-10777-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-8524-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-10725-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-396-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-10735-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1012-10736-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2996-12-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/4784-0-0x0000000002230000-0x0000000002234000-memory.dmp

Filesize
16KB

Download
memory/4784-4-0x0000000002230000-0x0000000002234000-memory.dmp

Filesize
16KB

Download
memory/4784-1-0x0000000002230000-0x0000000002234000-memory.dmp

Filesize
16KB

Download
memory/4920-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4920-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4920-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4920-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4920-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download