teslacrypt | 1a4a1e76c6d2dc585ce77c9be7163163c0d614d5668a0c83601bb3d6f91376a0

Analysis

max time kernel
146s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
Size

384KB
MD5

65f583e82e837183c8962dfdbf5bdc35
SHA1

5181731fa74f097de73d81ff347fe2fec634887a
SHA256

1a4a1e76c6d2dc585ce77c9be7163163c0d614d5668a0c83601bb3d6f91376a0
SHA512

827817ae552ebc95dd541d62cc04af0cb798bc33af3960153f403a945f1cb139129fa6e40cd09f359bbc673ac6c11118eeecf1a33790873a9c070bc487e24a43
SSDEEP

6144:SzVGON09XRWtlggcMOEqmgWqvANwxcLSgL8J4bAvtqjPtW6wU25vB8ynNd98UW:pON09XotWgOfmgLA8cNYQAojtwU2xnv9

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+dbnry.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/8DD956EDAB2720F3 2. http://tes543berda73i48fsdfsd.keratadze.at/8DD956EDAB2720F3 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8DD956EDAB2720F3 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/8DD956EDAB2720F3 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/8DD956EDAB2720F3 http://tes543berda73i48fsdfsd.keratadze.at/8DD956EDAB2720F3 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8DD956EDAB2720F3 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/8DD956EDAB2720F3

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/8DD956EDAB2720F3

http://tes543berda73i48fsdfsd.keratadze.at/8DD956EDAB2720F3

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8DD956EDAB2720F3

http://xlowfznrg4wf7dli.ONION/8DD956EDAB2720F3

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	omgoiwkgjwxb.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+dbnry.txt	omgoiwkgjwxb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+dbnry.html	omgoiwkgjwxb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+dbnry.txt	omgoiwkgjwxb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+dbnry.html	omgoiwkgjwxb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+dbnry.png	omgoiwkgjwxb.exe

Executes dropped EXE 2 IoCs

pid	Process
1080	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ahxwqmscburi = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\omgoiwkgjwxb.exe\""	omgoiwkgjwxb.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 1080 set thread context of 4136	1080	omgoiwkgjwxb.exe	101

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\Recovery+dbnry.html	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\SmartSelect\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-100_contrast-black.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-200.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-36_altform-unplated.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-150.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-150_contrast-black.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-200.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlCone.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-lightunplated.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-150.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\MedTile.scale-125.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Recovery+dbnry.txt	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\Internet Explorer\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\Recovery+dbnry.html	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\MedTile.scale-200.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-36.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-125.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-256.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_contrast-white.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-400.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-150.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\Recovery+dbnry.txt	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-IN\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\Recovery+dbnry.html	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-24.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-200.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Notification_AppLogo_PowerStatus.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-150.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\LargeTile.scale-125.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\MedTile.scale-200.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Recovery+dbnry.txt	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+dbnry.html	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\IC_WelcomeBanner.scale-100.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\IC_WelcomeBanner.scale-400.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+dbnry.html	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SmallTile.scale-100.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-unplated.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-200.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-400.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-150.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\Recovery+dbnry.html	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-60_altform-unplated.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Images\Recovery+dbnry.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-125.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\Recovery+dbnry.txt	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-125.png	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Recovery+dbnry.txt	omgoiwkgjwxb.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d1.png	omgoiwkgjwxb.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\omgoiwkgjwxb.exe	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
File opened for modification	C:\Windows\omgoiwkgjwxb.exe	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgoiwkgjwxb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgoiwkgjwxb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	omgoiwkgjwxb.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3956	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe
4136	omgoiwkgjwxb.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
Token: SeDebugPrivilege	4136	omgoiwkgjwxb.exe
Token: SeIncreaseQuotaPrivilege	2068	WMIC.exe
Token: SeSecurityPrivilege	2068	WMIC.exe
Token: SeTakeOwnershipPrivilege	2068	WMIC.exe
Token: SeLoadDriverPrivilege	2068	WMIC.exe
Token: SeSystemProfilePrivilege	2068	WMIC.exe
Token: SeSystemtimePrivilege	2068	WMIC.exe
Token: SeProfSingleProcessPrivilege	2068	WMIC.exe
Token: SeIncBasePriorityPrivilege	2068	WMIC.exe
Token: SeCreatePagefilePrivilege	2068	WMIC.exe
Token: SeBackupPrivilege	2068	WMIC.exe
Token: SeRestorePrivilege	2068	WMIC.exe
Token: SeShutdownPrivilege	2068	WMIC.exe
Token: SeDebugPrivilege	2068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2068	WMIC.exe
Token: SeRemoteShutdownPrivilege	2068	WMIC.exe
Token: SeUndockPrivilege	2068	WMIC.exe
Token: SeManageVolumePrivilege	2068	WMIC.exe
Token: 33	2068	WMIC.exe
Token: 34	2068	WMIC.exe
Token: 35	2068	WMIC.exe
Token: 36	2068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2068	WMIC.exe
Token: SeSecurityPrivilege	2068	WMIC.exe
Token: SeTakeOwnershipPrivilege	2068	WMIC.exe
Token: SeLoadDriverPrivilege	2068	WMIC.exe
Token: SeSystemProfilePrivilege	2068	WMIC.exe
Token: SeSystemtimePrivilege	2068	WMIC.exe
Token: SeProfSingleProcessPrivilege	2068	WMIC.exe
Token: SeIncBasePriorityPrivilege	2068	WMIC.exe
Token: SeCreatePagefilePrivilege	2068	WMIC.exe
Token: SeBackupPrivilege	2068	WMIC.exe
Token: SeRestorePrivilege	2068	WMIC.exe
Token: SeShutdownPrivilege	2068	WMIC.exe
Token: SeDebugPrivilege	2068	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2068	WMIC.exe
Token: SeRemoteShutdownPrivilege	2068	WMIC.exe
Token: SeUndockPrivilege	2068	WMIC.exe
Token: SeManageVolumePrivilege	2068	WMIC.exe
Token: 33	2068	WMIC.exe
Token: 34	2068	WMIC.exe
Token: 35	2068	WMIC.exe
Token: 36	2068	WMIC.exe
Token: SeBackupPrivilege	1484	vssvc.exe
Token: SeRestorePrivilege	1484	vssvc.exe
Token: SeAuditPrivilege	1484	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4080	WMIC.exe
Token: SeSecurityPrivilege	4080	WMIC.exe
Token: SeTakeOwnershipPrivilege	4080	WMIC.exe
Token: SeLoadDriverPrivilege	4080	WMIC.exe
Token: SeSystemProfilePrivilege	4080	WMIC.exe
Token: SeSystemtimePrivilege	4080	WMIC.exe
Token: SeProfSingleProcessPrivilege	4080	WMIC.exe
Token: SeIncBasePriorityPrivilege	4080	WMIC.exe
Token: SeCreatePagefilePrivilege	4080	WMIC.exe
Token: SeBackupPrivilege	4080	WMIC.exe
Token: SeRestorePrivilege	4080	WMIC.exe
Token: SeShutdownPrivilege	4080	WMIC.exe
Token: SeDebugPrivilege	4080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4080	WMIC.exe
Token: SeRemoteShutdownPrivilege	4080	WMIC.exe
Token: SeUndockPrivilege	4080	WMIC.exe
Token: SeManageVolumePrivilege	4080	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 2396 wrote to memory of 3968	2396	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	95
PID 3968 wrote to memory of 1080	3968	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	96
PID 3968 wrote to memory of 1080	3968	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	96
PID 3968 wrote to memory of 1080	3968	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	96
PID 3968 wrote to memory of 3596	3968	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	97
PID 3968 wrote to memory of 3596	3968	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	97
PID 3968 wrote to memory of 3596	3968	65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe	97
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 1080 wrote to memory of 4136	1080	omgoiwkgjwxb.exe	101
PID 4136 wrote to memory of 2068	4136	omgoiwkgjwxb.exe	102
PID 4136 wrote to memory of 2068	4136	omgoiwkgjwxb.exe	102
PID 4136 wrote to memory of 3956	4136	omgoiwkgjwxb.exe	116
PID 4136 wrote to memory of 3956	4136	omgoiwkgjwxb.exe	116
PID 4136 wrote to memory of 3956	4136	omgoiwkgjwxb.exe	116
PID 4136 wrote to memory of 3960	4136	omgoiwkgjwxb.exe	117
PID 4136 wrote to memory of 3960	4136	omgoiwkgjwxb.exe	117
PID 3960 wrote to memory of 4872	3960	msedge.exe	118
PID 3960 wrote to memory of 4872	3960	msedge.exe	118
PID 4136 wrote to memory of 4080	4136	omgoiwkgjwxb.exe	119
PID 4136 wrote to memory of 4080	4136	omgoiwkgjwxb.exe	119
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121
PID 3960 wrote to memory of 456	3960	msedge.exe	121

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	omgoiwkgjwxb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	omgoiwkgjwxb.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\65f583e82e837183c8962dfdbf5bdc35_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\omgoiwkgjwxb.exe
    C:\Windows\omgoiwkgjwxb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\omgoiwkgjwxb.exe
      C:\Windows\omgoiwkgjwxb.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4136
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:3956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8db946f8,0x7ffc8db94708,0x7ffc8db94718
        6⤵
        
        PID:4872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        6⤵
        
        PID:456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
        6⤵
        
        PID:2224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2480 /prefetch:8
        6⤵
        
        PID:1708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        6⤵
        
        PID:1840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        6⤵
        
        PID:1204
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
        6⤵
        
        PID:1360
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
        6⤵
        
        PID:4320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
        6⤵
        
        PID:4988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
        6⤵
        
        PID:5092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
        6⤵
        
        PID:2952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7820487000952695053,5724715832761452710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
        6⤵
        
        PID:4196
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4080
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\OMGOIW~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\65F583~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+dbnry.html

Filesize
11KB

MD5
f92be7686b29e16570dd22b4e208ae4c

SHA1
6797f0fb11443b66f5caa17ab8963d806080ab58

SHA256
603de12d916f5c69f3bb42367fb357bc38dfb621f6747d4300413c8e23c9be19

SHA512
c9dcb16224ff3795cfe675a09dc9d24ceaf23119fcd413e0b40e76a5bdd9402461e9dc89917f614152fbd0ebd6e3a17cfd0f37bc6b67a127e24f6e4fe6c2099d

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+dbnry.png

Filesize
64KB

MD5
31366df6482f065435912d969312b4da

SHA1
4e4b02499a254aeb448f4ab623b44fb1843baff6

SHA256
548cb810eb8d8125bfe50851d8f60c4cd3895bd6ffe0428f61009ef052ac75a3

SHA512
1c3767a769cf542f229f54708b5c65a91aa6e64ca7dc8bcc79e2a8a873b74de528aad2b9edefe046ad9ee14fb11b8e56fd7d41f6834804edb35e612284255544

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+dbnry.txt

Filesize
1KB

MD5
4e046e4c31e07dbba3420c5915af2ed8

SHA1
20bd3d0c3fa4171e33f950218ead5919c70d4ec3

SHA256
89ccfccc43d86567b728f876e4da3ba6559372d121c9212a9254452cd54ac890

SHA512
07e296cbcf0aaa7540879463aadf41231d2db5bbadcdac71f9d6c2b475d2c18ab3769f178bed05d3b2bf0593b52356b8602006d53359be1cb7203502aadc7c57

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
586e1ef68558b4c2b896942717662e91

SHA1
80802d14b09b4da933d21185e47290befb09780a

SHA256
000910e7a9b65f8229f916c65eb2aea10a8afcd6645b6439e96f89f8d41010f6

SHA512
c73c2df6ae4867436a92f452bf5bba948fc507a868c11cb9dd1e8fb645897343fe4e87b66316e66a1f751a739d05341148594f66968325455d7c0b7da1d6221a

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
92c2c5209fa839e55b015ebe17f75886

SHA1
77eca820f17445f8aaf1431146dd4228b717dc6d

SHA256
1c800d7296f62c47b3c7dd359e7e349f725e3465bb4a99502e4ff8f36bae85a4

SHA512
ddb3a1c0a7f8820d1be8dd0e8e488ce5a0f4a9f97bba524e71bff1263f49f8edd0cc22298bafbd0f5e2d8c93a00a345cf0b58e4ca9ccbc0a3ae306e622e099fb

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
27dfdbbd9f2df5ebd93342b02286b6b8

SHA1
c614fe53c65c7311686b1d17660ae76cae6f61b2

SHA256
dd2b27508e132a4311fcee703a8becc64880dc363bb784c9ed863f0d3fbbb78c

SHA512
2af7e4a0eecfc820ebf30946664b54eb80d904890498ffe532fbedc0945b854dc749f23cbdf9cc6b7a88ad9781143c17cb2f7d9442948bf0cba76c30dba02c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\57f83090-9cdc-4ccb-aeb6-99bacabc0927.tmp

Filesize
5KB

MD5
3738bb28f2ca5395a27e5a551986ccd2

SHA1
9f9b8fd05ed3375dc9c3e1f06c31dbd9a8ef4432

SHA256
2b4baa7afecee7614d45668b292482d4c87a22b3d5f60a8478b457300cb4f58a

SHA512
78d53a456d03503e0a62a415588dc0356df178e0c459b6c98beba79ac812e6ed6e7306bcee99e39cade21a9846f5731e4fde268af43cdfb1f9c1e0230ed83160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6542302b71425724893f8cf28fabb575

SHA1
0d985a2361d23e37b5af71547f558db7e4335e7c

SHA256
bcb41101ffbf9fb3e75375379bfe39e444889bdc6bacffe67849a410d9babfb4

SHA512
dd6d319e576e43fcf0abbffd89194fb3c1d518f8e8c6facb0f24936ae1922653398d7371eafd91094d75f4dcc7d80f0aa9410edd906fea5dc8c02b5816ed07bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43de8345f1ae93dee0b5e0d8085592a7

SHA1
c69700e2cced6b42d26326ce8973457a7bd1eb63

SHA256
b853abed33a9c31479588240a5f857e763950da1425dac73931a68a7d7023675

SHA512
719f0de308d1b52b4f195e64d9381e37a728a49ba36374bed468d88d5b1fa4cbf141a188fde38d5279356e56aeefded080e2a6cdb275aa663ab9fda48e079a4c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662717143618.txt

Filesize
77KB

MD5
d31c49db95ea394c58275b0623e5c4b0

SHA1
d3dc3d9882266de4d422161ebc4fc44886234eb5

SHA256
7c8037952380843f0d7db49157b21a242414e50102441c28070c5587760069b9

SHA512
978b959b74d877f278bdd986949c3fe771ffe9f3b56377ef610c5d35eeb8fc10e64bcea85c3febd9eb66077acc4ced757d9d13c8a9ac8241b54d80ba4aa04bed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663983438946.txt

Filesize
47KB

MD5
49a3e17342c636c4e8efbff759327d91

SHA1
5ce600ddbd6d60191e98ae6773da34ca2c073765

SHA256
4ca7c4fb4472cde9aa4bd5e5fb930b832ff41995be0323d0c049eee7ed8de88f

SHA512
cce92de27079c8e9d4c831076890306467b8e40018cd3cd3f25ea11711248017f0a642556fc5559fba4aa347cc06fea01fe07b4d83f965a819c2f6abbc8cb8d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671578469739.txt

Filesize
74KB

MD5
e84205c3a8799112cc51f2ea1e422dfd

SHA1
6d594ef7a2daa0541f16909605abb15ee11dc34a

SHA256
92aa0b184d29f654d2d4698775e906b6e876e9118342fde22678e96993ddd4d0

SHA512
f746d938b8b10698f5b846b29bad0be08f8f1685152454111ee83fad2293ed6579bd93d571546d6c6d12f760ac34cb245cc65041adcd262b2f3c5ee9eae8dc52

Download Submit
C:\Windows\omgoiwkgjwxb.exe

Filesize
384KB

MD5
65f583e82e837183c8962dfdbf5bdc35

SHA1
5181731fa74f097de73d81ff347fe2fec634887a

SHA256
1a4a1e76c6d2dc585ce77c9be7163163c0d614d5668a0c83601bb3d6f91376a0

SHA512
827817ae552ebc95dd541d62cc04af0cb798bc33af3960153f403a945f1cb139129fa6e40cd09f359bbc673ac6c11118eeecf1a33790873a9c070bc487e24a43

Download Submit
memory/1080-12-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2396-4-0x0000000000CA0000-0x0000000000CA3000-memory.dmp

Filesize
12KB

Download
memory/2396-1-0x0000000000CA0000-0x0000000000CA3000-memory.dmp

Filesize
12KB

Download
memory/2396-0-0x0000000000CA0000-0x0000000000CA3000-memory.dmp

Filesize
12KB

Download
memory/3968-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3968-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3968-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3968-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3968-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-5330-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-8652-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-10511-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-10512-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-10520-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-10521-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-2598-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-2597-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-631-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-24-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-10563-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-22-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-20-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4136-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download