teslacrypt | 39a70938288eacf5eab1002150cb06a8299475ad6064fb131aa6e9118c66b4bc

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe
Size

340KB
MD5

6bcc066e2a81f34c7e052895001f44c6
SHA1

6f892ec0287ace1c4c7c86e3945b44de6c9d3ba8
SHA256

39a70938288eacf5eab1002150cb06a8299475ad6064fb131aa6e9118c66b4bc
SHA512

b11b924dfda23d28019879acbd790778049f4f711134b0003967408b28532544745d12081a9da538f9ecd84f3791b621d3d9c1b4a62699b22d7c56274a1f9f2c
SSDEEP

6144:2//b5dx5w2hahQGvPmZ8n0SylbvO+MeTHLlj9HhRbr3ET4b7ODRJT0luqig:SddvwdhHvPmZiyIXgLl3ZoMq4wO

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+vtfwp.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CF511D6BC291FBC 2. http://tes543berda73i48fsdfsd.keratadze.at/CF511D6BC291FBC 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CF511D6BC291FBC If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/CF511D6BC291FBC 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CF511D6BC291FBC http://tes543berda73i48fsdfsd.keratadze.at/CF511D6BC291FBC http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CF511D6BC291FBC *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/CF511D6BC291FBC

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/CF511D6BC291FBC

http://tes543berda73i48fsdfsd.keratadze.at/CF511D6BC291FBC

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/CF511D6BC291FBC

http://xlowfznrg4wf7dli.ONION/CF511D6BC291FBC

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	vsebfsdrlbup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+vtfwp.png	vsebfsdrlbup.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+vtfwp.png	vsebfsdrlbup.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+vtfwp.html	vsebfsdrlbup.exe

Executes dropped EXE 2 IoCs

pid	Process
4344	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laqifvobvxqr = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\vsebfsdrlbup.exe\""	vsebfsdrlbup.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4344 set thread context of 4596	4344	vsebfsdrlbup.exe	101

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_SplashScreen.scale-200.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\Recovery+vtfwp.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-100_contrast-black.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-20_contrast-black.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-200.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\Recovery+vtfwp.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-150.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-125.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\meBoot.min.js	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-24_altform-lightunplated.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\Recovery+vtfwp.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Fonts\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-40_altform-lightunplated.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\DeleteToastQuickAction.scale-80.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-64.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\Recovery+vtfwp.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-32.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_altform-unplated_contrast-black.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\logo.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-125.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-80_altform-unplated.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36_altform-lightunplated.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Google\Chrome\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\Recovery+vtfwp.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-400.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-lightunplated.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Recovery+vtfwp.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Recovery+vtfwp.html	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\Recovery+vtfwp.txt	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-150.png	vsebfsdrlbup.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-128.png	vsebfsdrlbup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\vsebfsdrlbup.exe	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe
File opened for modification	C:\Windows\vsebfsdrlbup.exe	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsebfsdrlbup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsebfsdrlbup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	vsebfsdrlbup.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1768	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe
4596	vsebfsdrlbup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4428	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe
Token: SeDebugPrivilege	4596	vsebfsdrlbup.exe
Token: SeIncreaseQuotaPrivilege	1348	WMIC.exe
Token: SeSecurityPrivilege	1348	WMIC.exe
Token: SeTakeOwnershipPrivilege	1348	WMIC.exe
Token: SeLoadDriverPrivilege	1348	WMIC.exe
Token: SeSystemProfilePrivilege	1348	WMIC.exe
Token: SeSystemtimePrivilege	1348	WMIC.exe
Token: SeProfSingleProcessPrivilege	1348	WMIC.exe
Token: SeIncBasePriorityPrivilege	1348	WMIC.exe
Token: SeCreatePagefilePrivilege	1348	WMIC.exe
Token: SeBackupPrivilege	1348	WMIC.exe
Token: SeRestorePrivilege	1348	WMIC.exe
Token: SeShutdownPrivilege	1348	WMIC.exe
Token: SeDebugPrivilege	1348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1348	WMIC.exe
Token: SeRemoteShutdownPrivilege	1348	WMIC.exe
Token: SeUndockPrivilege	1348	WMIC.exe
Token: SeManageVolumePrivilege	1348	WMIC.exe
Token: 33	1348	WMIC.exe
Token: 34	1348	WMIC.exe
Token: 35	1348	WMIC.exe
Token: 36	1348	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1348	WMIC.exe
Token: SeSecurityPrivilege	1348	WMIC.exe
Token: SeTakeOwnershipPrivilege	1348	WMIC.exe
Token: SeLoadDriverPrivilege	1348	WMIC.exe
Token: SeSystemProfilePrivilege	1348	WMIC.exe
Token: SeSystemtimePrivilege	1348	WMIC.exe
Token: SeProfSingleProcessPrivilege	1348	WMIC.exe
Token: SeIncBasePriorityPrivilege	1348	WMIC.exe
Token: SeCreatePagefilePrivilege	1348	WMIC.exe
Token: SeBackupPrivilege	1348	WMIC.exe
Token: SeRestorePrivilege	1348	WMIC.exe
Token: SeShutdownPrivilege	1348	WMIC.exe
Token: SeDebugPrivilege	1348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1348	WMIC.exe
Token: SeRemoteShutdownPrivilege	1348	WMIC.exe
Token: SeUndockPrivilege	1348	WMIC.exe
Token: SeManageVolumePrivilege	1348	WMIC.exe
Token: 33	1348	WMIC.exe
Token: 34	1348	WMIC.exe
Token: 35	1348	WMIC.exe
Token: 36	1348	WMIC.exe
Token: SeBackupPrivilege	2064	vssvc.exe
Token: SeRestorePrivilege	2064	vssvc.exe
Token: SeAuditPrivilege	2064	vssvc.exe
Token: SeIncreaseQuotaPrivilege	772	WMIC.exe
Token: SeSecurityPrivilege	772	WMIC.exe
Token: SeTakeOwnershipPrivilege	772	WMIC.exe
Token: SeLoadDriverPrivilege	772	WMIC.exe
Token: SeSystemProfilePrivilege	772	WMIC.exe
Token: SeSystemtimePrivilege	772	WMIC.exe
Token: SeProfSingleProcessPrivilege	772	WMIC.exe
Token: SeIncBasePriorityPrivilege	772	WMIC.exe
Token: SeCreatePagefilePrivilege	772	WMIC.exe
Token: SeBackupPrivilege	772	WMIC.exe
Token: SeRestorePrivilege	772	WMIC.exe
Token: SeShutdownPrivilege	772	WMIC.exe
Token: SeDebugPrivilege	772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	772	WMIC.exe
Token: SeRemoteShutdownPrivilege	772	WMIC.exe
Token: SeUndockPrivilege	772	WMIC.exe
Token: SeManageVolumePrivilege	772	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4940 wrote to memory of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4940 wrote to memory of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4940 wrote to memory of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4940 wrote to memory of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4940 wrote to memory of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4940 wrote to memory of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4940 wrote to memory of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4940 wrote to memory of 4428	4940	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	95
PID 4428 wrote to memory of 4344	4428	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	96
PID 4428 wrote to memory of 4344	4428	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	96
PID 4428 wrote to memory of 4344	4428	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	96
PID 4428 wrote to memory of 4640	4428	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	97
PID 4428 wrote to memory of 4640	4428	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	97
PID 4428 wrote to memory of 4640	4428	6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe	97
PID 4344 wrote to memory of 4596	4344	vsebfsdrlbup.exe	101
PID 4344 wrote to memory of 4596	4344	vsebfsdrlbup.exe	101
PID 4344 wrote to memory of 4596	4344	vsebfsdrlbup.exe	101
PID 4344 wrote to memory of 4596	4344	vsebfsdrlbup.exe	101
PID 4344 wrote to memory of 4596	4344	vsebfsdrlbup.exe	101
PID 4344 wrote to memory of 4596	4344	vsebfsdrlbup.exe	101
PID 4344 wrote to memory of 4596	4344	vsebfsdrlbup.exe	101
PID 4344 wrote to memory of 4596	4344	vsebfsdrlbup.exe	101
PID 4344 wrote to memory of 4596	4344	vsebfsdrlbup.exe	101
PID 4596 wrote to memory of 1348	4596	vsebfsdrlbup.exe	102
PID 4596 wrote to memory of 1348	4596	vsebfsdrlbup.exe	102
PID 4596 wrote to memory of 1768	4596	vsebfsdrlbup.exe	115
PID 4596 wrote to memory of 1768	4596	vsebfsdrlbup.exe	115
PID 4596 wrote to memory of 1768	4596	vsebfsdrlbup.exe	115
PID 4596 wrote to memory of 3124	4596	vsebfsdrlbup.exe	116
PID 4596 wrote to memory of 3124	4596	vsebfsdrlbup.exe	116
PID 3124 wrote to memory of 2848	3124	msedge.exe	117
PID 3124 wrote to memory of 2848	3124	msedge.exe	117
PID 4596 wrote to memory of 772	4596	vsebfsdrlbup.exe	118
PID 4596 wrote to memory of 772	4596	vsebfsdrlbup.exe	118
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120
PID 3124 wrote to memory of 1680	3124	msedge.exe	120

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vsebfsdrlbup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	vsebfsdrlbup.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6bcc066e2a81f34c7e052895001f44c6_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\vsebfsdrlbup.exe
    C:\Windows\vsebfsdrlbup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\vsebfsdrlbup.exe
      C:\Windows\vsebfsdrlbup.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4596
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:1768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe56e746f8,0x7ffe56e74708,0x7ffe56e74718
        6⤵
        
        PID:2848
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        6⤵
        
        PID:1680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
        6⤵
        
        PID:1392
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
        6⤵
        
        PID:4024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
        6⤵
        
        PID:1016
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
        6⤵
        
        PID:5008
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
        6⤵
        
        PID:4776
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
        6⤵
        
        PID:804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
        6⤵
        
        PID:5028
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
        6⤵
        
        PID:3264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
        6⤵
        
        PID:388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11906337424592112924,8009102294996541082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
        6⤵
        
        PID:4808
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:772
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\VSEBFS~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\6BCC06~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+vtfwp.html

Filesize
11KB

MD5
abb8013efa8ac6a582a0760e9baa0276

SHA1
8accd3d823b1dc1cfcc072d0ab726b05a553b1a1

SHA256
793b1c1ae36507ff9afb3572e86c0ec2bce37f9ac240e3c7ba92ca5b5e3a46cd

SHA512
40ab4df3d8d6ee60d8a7bed6bcd737fb0ae7a43d304ec919d49df821b984af3b6691821594e694c54308d5f2f6154269ec68bd44a48ba3fe21d621a17268c89f

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+vtfwp.png

Filesize
62KB

MD5
033da1cae97dd300caf3af2b713554ed

SHA1
c0c413835da2f1c8bf1d8edc4afd58df7551ea16

SHA256
a4d8129734d5b3ba6154ccdc53a4a907c40577797d3644e8a854104951fd8e8e

SHA512
7b62358f1c74638b4893415f963359e7384bfd4bbdd4911acdb5d8f2d3c1d90390a325343d9274d3dee51c91eec5a9906e13a9dbf7dd0ebf045dd300d856eaf4

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+vtfwp.txt

Filesize
1KB

MD5
49e7058dda3bfe195a0b584f336c4b55

SHA1
3e380ba34862388c7f0e9326065d7622f3b9df64

SHA256
3159d6100465b3a1a2be2a621cefe7b05a603723b15727329ddf1a4e0afce1a2

SHA512
bafdbe0d9c98495798eb84572c4e6b4a0baf2dc17f1a4da4f544c51a4eb33f9188af0bf016d4c727d745687daca67a3515169ed143293e4c9e9f9fc9297055d0

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
b67011e84abab4dbfc6257bb56c24433

SHA1
be16cb16e81b5a35a8b35fd5abfd04398df71405

SHA256
3592f9771aa25dbeee615c8f9f9febafddab057ba292dadef36f02f4558cc5f8

SHA512
2c2275a26dc14497efd3da65f5f25d82b13454cece9295694f76463c702936c3695da8198f2365a45dc8a158bc47a4124e3d0bcbc1310d3ef5d552b028bc1815

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
8d2a461213e5092c95ba02f7e8c2680a

SHA1
9515149d19990e047c9866604d072dc0e1b475e7

SHA256
a7475a2907da9bb91bb8d5ca45da4b609af0792dda322c31bf3146ba32a2f9a8

SHA512
a8d17a8d345fa69084f296df822a1ddc43e840335548e2df35c543ce5038f725fd055ba5df44ba6932140cfed4216f168ad4fee28e60f8438ea015bfb538ccc4

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
512806dfec0a9c5e6c7b47058854433c

SHA1
68cf186c842707beef318a1d63ab51aae9d8cb64

SHA256
ea09cfc6bd7690554223cb83adc13258733edb00209a1a31b8cee6e5f2f2592a

SHA512
a0c6fc9a9252324002c3b68b496bed9097f6af70e9c997386c77139f91eba03c299d478587cf50f79f26152f027a515648f2c28c35caee56fe61dc285c80c4d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cec5b88e0fcee9e4ff063108173efe9a

SHA1
c3d5ca4db0f51d4ef60d02240382c033ef8fabf1

SHA256
ccbd088226c845dce7325b57881cc2365101f8821c517d1b22fbaf103869431d

SHA512
c2c54ed31ff61b0851822d32cbb4424a7f0b31daee2be286b97b967d60cfb1df91a57facbc98ef2b71a3866e4040b2f1c69cd77a9c12eae25e5486002f780531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c853bd3b89c3cf0de483e4b865f7695

SHA1
882d179d570b6945cabcb0b8db703d147f865aab

SHA256
5dc6717c00945df0dc762ab62dc323c377ad003369849c14ce732def68c107e0

SHA512
9b8c74a8453cc88a140414bcf20e018f213854725510e71e883b42bef92892d209ddbef53ccd2c5f2e644ec809d81653027bb8858d97ff4d0a779727c32d2a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c94ca0035ed0bd4c32797eadf06b2a7e

SHA1
c0fe30d5dc85c1fcaaba327d856c1d9c93d5cd6f

SHA256
5328b0ed830a071aa05793b0683a159ed881579a855b7a802f2795bfada09324

SHA512
4c1c27d31fdf07f728b048cfbce2d538aa05baf9311420199b3668566724f6f5807d9d306eba685472f6e4da3b74339e224ab01aa595dd87586c53ff23b938bf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656325443828.txt

Filesize
77KB

MD5
099336c9ed429f6462669b922654c98b

SHA1
5a4fb401f49d0cdadc45333d5405b849a6034985

SHA256
861cd91bea573f7ad14140f9ab4bf72269a04b798a52ca52cddb142dbae15e95

SHA512
d9e76c74f427bacc33d3b8f0802d633e6a59caf3c367e9f4b9bd20c847971f00d7c1caab6765168f49e35b3b2353b54fcb10e968dbe07c5cef8745f99010089b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727657695736094.txt

Filesize
47KB

MD5
3083bc7b00f175352b88a7279b65521f

SHA1
e1fd69156003bb22b606e00f51b2c56f21a74084

SHA256
4f04b3f1b8ec9f24fc3466e5dc9ef87b655e7e891f0544b2ee4604dc890e1221

SHA512
75d24017578569c7c2e5db6d57728cfabf8c454b24d72106eda374257d57c89e74e9b54b14b79b51571f05870020f4294d879ac33dc86ea2faa25bc9404928ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt

Filesize
74KB

MD5
653e31b325d4768e5f40e335f8172066

SHA1
8f35366ab518fdc6f24463ec9cbe55d5cfad0281

SHA256
ad0f2acc69a79a8785d09601329d94877eeba13f943f6cd30b475a728ee2c01f

SHA512
47ce551bed878f778fdd55613ef1d7766b03c4c5da7d158db95004888543b4ee9ec76416b31fbc68484beda63c3c76089b1971316b3e2fff3b5ae77bc6cdb772

Download Submit
C:\Windows\vsebfsdrlbup.exe

Filesize
340KB

MD5
6bcc066e2a81f34c7e052895001f44c6

SHA1
6f892ec0287ace1c4c7c86e3945b44de6c9d3ba8

SHA256
39a70938288eacf5eab1002150cb06a8299475ad6064fb131aa6e9118c66b4bc

SHA512
b11b924dfda23d28019879acbd790778049f4f711134b0003967408b28532544745d12081a9da538f9ecd84f3791b621d3d9c1b4a62699b22d7c56274a1f9f2c

Download Submit
memory/4344-12-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/4428-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4428-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4428-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4428-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4428-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-10726-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-4226-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-7326-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-2197-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-690-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-25-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-9834-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-10725-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-2203-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-10734-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-10735-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-23-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-20-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-17-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4596-10790-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4940-0-0x0000000000720000-0x0000000000723000-memory.dmp

Filesize
12KB

Download
memory/4940-4-0x0000000000720000-0x0000000000723000-memory.dmp

Filesize
12KB

Download
memory/4940-1-0x0000000000720000-0x0000000000723000-memory.dmp

Filesize
12KB

Download