teslacrypt | 62aaa2a24236be5ae371e5851370f24e6261025cf4bf539b7c40bdefc6ad07e6

Analysis

max time kernel
136s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe
Size

369KB
MD5

3b240ca653bd5467b19e195889c07c6e
SHA1

bfb732fd34099fb9f4467cfab185a4bf3bb28e95
SHA256

62aaa2a24236be5ae371e5851370f24e6261025cf4bf539b7c40bdefc6ad07e6
SHA512

32242830aaf7fee32d16e86da4d602640fd360f24ae309bc5391c130ca384b951ac97f9ecc1f596bd7c7b3933c589dbd87ee872b4dfd8cda62835143e04e0296
SSDEEP

6144:fo07Ev9jgh+J0J+l/moekR1MlvlMa0FIe03ncsCMYZx/FqDN6TETpspvQrMX1r9:ftQVG+JIe/mGzMNlMVFC3Xi/YwOi

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_RECOVERY_+gcves.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/3C66E890F3AA6B1 2. http://tes543berda73i48fsdfsd.keratadze.at/3C66E890F3AA6B1 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/3C66E890F3AA6B1 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/3C66E890F3AA6B1 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/3C66E890F3AA6B1 http://tes543berda73i48fsdfsd.keratadze.at/3C66E890F3AA6B1 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/3C66E890F3AA6B1 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/3C66E890F3AA6B1

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/3C66E890F3AA6B1

http://tes543berda73i48fsdfsd.keratadze.at/3C66E890F3AA6B1

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/3C66E890F3AA6B1

http://xlowfznrg4wf7dli.ONION/3C66E890F3AA6B1

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (869) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	legnomeroaqb.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECOVERY_+gcves.txt	legnomeroaqb.exe

Executes dropped EXE 2 IoCs

pid	Process
1196	legnomeroaqb.exe
2724	legnomeroaqb.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ocwerexlxxgk = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\legnomeroaqb.exe\""	legnomeroaqb.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4812 set thread context of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 1196 set thread context of 2724	1196	legnomeroaqb.exe	93

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\da-DK\View3d\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-white.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-32_altform-lightunplated.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-100.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-72.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-100.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-100.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-24.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-24_altform-unplated.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarMediumTile.scale-200.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-125_contrast-white.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-150.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_24x24x32.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-200.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-150_contrast-white.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-16_altform-unplated.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\DisconnectPush.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1851_32x32x32.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-150.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-96.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Filter.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\es-ES\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\YelpLogo.svg	legnomeroaqb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\THMBNAIL.PNG	legnomeroaqb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxMetadata\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\de-DE\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-100.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_RECOVERY_+gcves.html	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-24_altform-unplated_contrast-black.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\_RECOVERY_+gcves.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-60_altform-unplated_contrast-black.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-20_contrast-black.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_contrast-black.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96.png	legnomeroaqb.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_RECOVERY_+gcves.txt	legnomeroaqb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SmallTile.scale-125_contrast-white.png	legnomeroaqb.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\legnomeroaqb.exe	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe
File opened for modification	C:\Windows\legnomeroaqb.exe	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	legnomeroaqb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	legnomeroaqb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	legnomeroaqb.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4788	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe
2724	legnomeroaqb.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe
Token: SeDebugPrivilege	2724	legnomeroaqb.exe
Token: SeIncreaseQuotaPrivilege	2076	WMIC.exe
Token: SeSecurityPrivilege	2076	WMIC.exe
Token: SeTakeOwnershipPrivilege	2076	WMIC.exe
Token: SeLoadDriverPrivilege	2076	WMIC.exe
Token: SeSystemProfilePrivilege	2076	WMIC.exe
Token: SeSystemtimePrivilege	2076	WMIC.exe
Token: SeProfSingleProcessPrivilege	2076	WMIC.exe
Token: SeIncBasePriorityPrivilege	2076	WMIC.exe
Token: SeCreatePagefilePrivilege	2076	WMIC.exe
Token: SeBackupPrivilege	2076	WMIC.exe
Token: SeRestorePrivilege	2076	WMIC.exe
Token: SeShutdownPrivilege	2076	WMIC.exe
Token: SeDebugPrivilege	2076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2076	WMIC.exe
Token: SeRemoteShutdownPrivilege	2076	WMIC.exe
Token: SeUndockPrivilege	2076	WMIC.exe
Token: SeManageVolumePrivilege	2076	WMIC.exe
Token: 33	2076	WMIC.exe
Token: 34	2076	WMIC.exe
Token: 35	2076	WMIC.exe
Token: 36	2076	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2076	WMIC.exe
Token: SeSecurityPrivilege	2076	WMIC.exe
Token: SeTakeOwnershipPrivilege	2076	WMIC.exe
Token: SeLoadDriverPrivilege	2076	WMIC.exe
Token: SeSystemProfilePrivilege	2076	WMIC.exe
Token: SeSystemtimePrivilege	2076	WMIC.exe
Token: SeProfSingleProcessPrivilege	2076	WMIC.exe
Token: SeIncBasePriorityPrivilege	2076	WMIC.exe
Token: SeCreatePagefilePrivilege	2076	WMIC.exe
Token: SeBackupPrivilege	2076	WMIC.exe
Token: SeRestorePrivilege	2076	WMIC.exe
Token: SeShutdownPrivilege	2076	WMIC.exe
Token: SeDebugPrivilege	2076	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2076	WMIC.exe
Token: SeRemoteShutdownPrivilege	2076	WMIC.exe
Token: SeUndockPrivilege	2076	WMIC.exe
Token: SeManageVolumePrivilege	2076	WMIC.exe
Token: 33	2076	WMIC.exe
Token: 34	2076	WMIC.exe
Token: 35	2076	WMIC.exe
Token: 36	2076	WMIC.exe
Token: SeBackupPrivilege	4800	vssvc.exe
Token: SeRestorePrivilege	4800	vssvc.exe
Token: SeAuditPrivilege	4800	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4344	WMIC.exe
Token: SeSecurityPrivilege	4344	WMIC.exe
Token: SeTakeOwnershipPrivilege	4344	WMIC.exe
Token: SeLoadDriverPrivilege	4344	WMIC.exe
Token: SeSystemProfilePrivilege	4344	WMIC.exe
Token: SeSystemtimePrivilege	4344	WMIC.exe
Token: SeProfSingleProcessPrivilege	4344	WMIC.exe
Token: SeIncBasePriorityPrivilege	4344	WMIC.exe
Token: SeCreatePagefilePrivilege	4344	WMIC.exe
Token: SeBackupPrivilege	4344	WMIC.exe
Token: SeRestorePrivilege	4344	WMIC.exe
Token: SeShutdownPrivilege	4344	WMIC.exe
Token: SeDebugPrivilege	4344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4344	WMIC.exe
Token: SeRemoteShutdownPrivilege	4344	WMIC.exe
Token: SeUndockPrivilege	4344	WMIC.exe
Token: SeManageVolumePrivilege	4344	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 4812 wrote to memory of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 4812 wrote to memory of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 4812 wrote to memory of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 4812 wrote to memory of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 4812 wrote to memory of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 4812 wrote to memory of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 4812 wrote to memory of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 4812 wrote to memory of 1756	4812	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	88
PID 1756 wrote to memory of 1196	1756	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	89
PID 1756 wrote to memory of 1196	1756	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	89
PID 1756 wrote to memory of 1196	1756	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	89
PID 1756 wrote to memory of 4904	1756	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	90
PID 1756 wrote to memory of 4904	1756	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	90
PID 1756 wrote to memory of 4904	1756	3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe	90
PID 1196 wrote to memory of 2724	1196	legnomeroaqb.exe	93
PID 1196 wrote to memory of 2724	1196	legnomeroaqb.exe	93
PID 1196 wrote to memory of 2724	1196	legnomeroaqb.exe	93
PID 1196 wrote to memory of 2724	1196	legnomeroaqb.exe	93
PID 1196 wrote to memory of 2724	1196	legnomeroaqb.exe	93
PID 1196 wrote to memory of 2724	1196	legnomeroaqb.exe	93
PID 1196 wrote to memory of 2724	1196	legnomeroaqb.exe	93
PID 1196 wrote to memory of 2724	1196	legnomeroaqb.exe	93
PID 1196 wrote to memory of 2724	1196	legnomeroaqb.exe	93
PID 2724 wrote to memory of 2076	2724	legnomeroaqb.exe	94
PID 2724 wrote to memory of 2076	2724	legnomeroaqb.exe	94
PID 2724 wrote to memory of 4788	2724	legnomeroaqb.exe	99
PID 2724 wrote to memory of 4788	2724	legnomeroaqb.exe	99
PID 2724 wrote to memory of 4788	2724	legnomeroaqb.exe	99
PID 2724 wrote to memory of 2904	2724	legnomeroaqb.exe	100
PID 2724 wrote to memory of 2904	2724	legnomeroaqb.exe	100
PID 2904 wrote to memory of 2764	2904	msedge.exe	101
PID 2904 wrote to memory of 2764	2904	msedge.exe	101
PID 2724 wrote to memory of 4344	2724	legnomeroaqb.exe	102
PID 2724 wrote to memory of 4344	2724	legnomeroaqb.exe	102
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104
PID 2904 wrote to memory of 4000	2904	msedge.exe	104

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	legnomeroaqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	legnomeroaqb.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3b240ca653bd5467b19e195889c07c6e_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\legnomeroaqb.exe
    C:\Windows\legnomeroaqb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\legnomeroaqb.exe
      C:\Windows\legnomeroaqb.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2724
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:4788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2904
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeaac946f8,0x7ffeaac94708,0x7ffeaac94718
        6⤵
        
        PID:2764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
        6⤵
        
        PID:4000
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
        6⤵
        
        PID:2124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
        6⤵
        
        PID:2008
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
        6⤵
        
        PID:2816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        6⤵
        
        PID:3192
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
        6⤵
        
        PID:296
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
        6⤵
        
        PID:3176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
        6⤵
        
        PID:3148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
        6⤵
        
        PID:4020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
        6⤵
        
        PID:3200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5635452452813203426,6448027828358606066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
        6⤵
        
        PID:2128
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\LEGNOM~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\3B240C~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_RECOVERY_+gcves.html

Filesize
11KB

MD5
ce5ddd5d3a6d990e92449787c63bf8f4

SHA1
427dc4f5947a4cc8233faff0c6e223c79c28b01a

SHA256
1821d82645e685826135214aae3cc842a56a31e5af707b1ff27f4fad7c179e1b

SHA512
b3b0de97d413b29d25a0f98304492d7ebd0922e54a02b52afdd3215bb6d22e0e447b4b425b061d80880f6002e7f30c5bf7f7d109c24e4884b37f1d815d23f5ed

Download Submit
C:\Program Files\7-Zip\Lang\_RECOVERY_+gcves.png

Filesize
62KB

MD5
297eafccea73c97fc5d37e444333d24c

SHA1
199b80bbdea97274ebc7b6eab0c9f4e09b5cb415

SHA256
706ea29dc951512f3cef6af0f9edeab8df8a5dc45ca1c78ea46d72de4dc75c83

SHA512
0c828db0ea1f9ca6ec44ba67f6300d7b73a4a81b23acf26ccc1cfe3bd186024afbc6ba5375d14fc5c9659e9772d659efd107d5b6669fcd7703286b6b65873f6d

Download Submit
C:\Program Files\7-Zip\Lang\_RECOVERY_+gcves.txt

Filesize
1KB

MD5
c199287d9ca5a01ae5e246d7202b105a

SHA1
b72518ae1fefe59ede9bbab3ac7d6a68bc67927f

SHA256
bd10718b7b671657c3a4383a18a8cf3a85681fab306c821833069fe642a88fb5

SHA512
c41d812624563690d394782665a9d89472a2f641774543b6f8d432bcf2638eed8154f724cad4bc2b39ee441fa9f2b5a1ef29655f9c95bbdb319e3dd7b3709c68

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
116454184638edba836f3ab7ec384292

SHA1
97cb3a0a6c3f31be72e89eb2d05be25771eba588

SHA256
27c7e018878244eb06223e6268d3147dbe3cda3df68e4d208ba96ed82fc77176

SHA512
a8feb57e7c421a00e82238b79efbc8c200602291a5f8296028ce8bf5940ed78ae0958f5b1dae1c3a10231af0c18482cd0d8751f6dd6dffb3aad65fb5ccc9e3de

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
e38f58df301f8cfdee1eaa7404a1c564

SHA1
13780b78cda8366844d88eaeeec71722bd439950

SHA256
aec5a7105ea49db4c9b0c8bd5ed131d9a5b17af9ae592d132a59ef484db99b34

SHA512
5413ce7a6d63363ead38b9651fa60e9ffd148efcf0cbfd057d6bef1d44645c50c04bbbbcdc31a044286bb67bb5e81e1ceb34d9d7f51ed2321a8f7304c2a365e1

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
7f4580d071c507ca6178af92a67766b7

SHA1
045eff101f596e159d5c107b3cd819e1a6c77b74

SHA256
e22f5dda264a214b4893e4d168f67f43502025ecdbd1987c7388bda070b4b1ac

SHA512
f8d88cfa6c07ed89d3c576dacb1617d6ca883740c55ab3fb70537b9640b8fd5afa3af1fe5beabc460d1c5542c53f5dda64b43f4e7ac85cf17f4796ae47e9549a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0de95a73-a49f-41d3-83d2-be666bdd53fb.tmp

Filesize
6KB

MD5
55f2dbdc89df6841a1180045b21995b7

SHA1
8b99b97430f85fe7eed25d7d3bde6abb228d671c

SHA256
e64e6b1134b20351881f236de78e86bf4201197af154bbabfa25d109b3d3304b

SHA512
454961a32dfe247245b5c36718056aa677a9a47c7b6daaafc484f01295fad56b74aeff40e8204349382432dd1bccedcee367e7360b1009f5b453b277a3ebc276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd81a203b9df68409606cf96bcf40fc4

SHA1
5cebfad515034a0c07903f9c9a5357acf9c2165d

SHA256
de8f2e2b3201ab4881b8c5fabbf4f8d438bcee98665b9def0c0792c303d9f181

SHA512
c7f07c3a3a4e37f9b7cc5e6db550135b1be3db3efc6ce46e37500a6e5fd2f8b043443c497044a0ef6eb8b55ee8ade5fde86a8e2dbd35f984f25ddbe698369bbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6c95856219716300f5f09d442a51359c

SHA1
2ee2fedab26aaf81b100894d90adc7777f6bb510

SHA256
faa9f49986ee3b30518afcb1c962d1d6d6f0f4116110264f86a497d091d9da3a

SHA512
0e9fddc709a1f89e1565cdc09ab376cdf5897b3bd00d657ac2ae147d87e263cdd2bc0b60893e7a3041db88fd8d51ff8f6f3bb311851aba7ce887a70576bf935b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656325443828.txt

Filesize
77KB

MD5
c9d35bcb7ac37741736ea4e49ec7328a

SHA1
f03fea006a0b75f677115eb2798f796db39c3c4c

SHA256
0fab7cc16269e6b53617ce358899c0f8ff078f3867ac7f211e575ae518ae5851

SHA512
1779bdf2ce2e960611e44e6edbc453319922c06f99eebc8a366a7134d643d6515894e09486b7a65e3f1666323b31e4105a868815b6596fe8bc4a081c66d25c45

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727657695736094.txt

Filesize
47KB

MD5
f6c5162d0166c2f256d0fa2c7d6a16e8

SHA1
933271632c8ab9294065d5ec569475e6652a4f2c

SHA256
30ce022784010289c68ae0b6e9263cecd08dd95fd1c7f89ed96bc8d0cf5ca44f

SHA512
cc6c679a0e40c54483fac20de7cab1e53fc8809329dcd1eca913c68f5dc26c4b49ab3e250b283a9126aaedc14ff47cb549cdccd6e9c21912d45aa86bf7c1311c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt

Filesize
74KB

MD5
e994a8890b3ac21f0b4980c1889a6e87

SHA1
8f7e5856adbe0c2cf4386edee8cf4dc517bebb95

SHA256
84e885a6d76401fbea23cbc262e12af98d57b94afd058053f0e3563507d5030e

SHA512
7643b8d8fe49516ed5b7c8275e35d839c174598bab5509614a9da716a63104cf2a6a915233be606927c0c5a1240cd8b68772e9719f0879136d8dd48418b6b858

Download Submit
C:\Windows\legnomeroaqb.exe

Filesize
369KB

MD5
3b240ca653bd5467b19e195889c07c6e

SHA1
bfb732fd34099fb9f4467cfab185a4bf3bb28e95

SHA256
62aaa2a24236be5ae371e5851370f24e6261025cf4bf539b7c40bdefc6ad07e6

SHA512
32242830aaf7fee32d16e86da4d602640fd360f24ae309bc5391c130ca384b951ac97f9ecc1f596bd7c7b3933c589dbd87ee872b4dfd8cda62835143e04e0296

Download Submit
memory/1196-12-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/1756-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1756-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1756-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1756-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1756-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-5560-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-2974-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-2864-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-2863-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-9008-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-10520-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-10521-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-10529-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-10531-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-25-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-23-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-20-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-17-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-10572-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2724-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4812-0-0x00000000006A0000-0x00000000006A3000-memory.dmp

Filesize
12KB

Download
memory/4812-4-0x00000000006A0000-0x00000000006A3000-memory.dmp

Filesize
12KB

Download
memory/4812-1-0x00000000006A0000-0x00000000006A3000-memory.dmp

Filesize
12KB

Download