cerber | f10b952d03c6c2ced1d2a0ea27a6572a38227c0c66a0d80be8e7976513270bc6

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\\ipconfig.exe\""	ipconfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\\ipconfig.exe\""	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	ipconfig.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ipconfig.lnk	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ipconfig.lnk	ipconfig.exe

Executes dropped EXE 1 IoCs

pid	Process
1696	ipconfig.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ipconfig = "\"C:\\Users\\Admin\\AppData\\Roaming\\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\\ipconfig.exe\""	ipconfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ipconfig = "\"C:\\Users\\Admin\\AppData\\Roaming\\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\\ipconfig.exe\""	ipconfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ipconfig = "\"C:\\Users\\Admin\\AppData\\Roaming\\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\\ipconfig.exe\""	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ipconfig = "\"C:\\Users\\Admin\\AppData\\Roaming\\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\\ipconfig.exe\""	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ipinfo.io

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp2495.bmp"	ipconfig.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4692	cmd.exe
4848	PING.EXE
6060	cmd.exe
5244	PING.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
1696	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5076	vssadmin.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4792	taskkill.exe
6120	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\\ipconfig.exe\""	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop	ipconfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\\ipconfig.exe\""	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	ipconfig.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4848	PING.EXE
5244	PING.EXE

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
1696	ipconfig.exe
32	msedge.exe
32	msedge.exe
1580	msedge.exe
1580	msedge.exe
5056	identity_helper.exe
5056	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe
Token: SeDebugPrivilege	4792	taskkill.exe
Token: SeDebugPrivilege	1696	ipconfig.exe
Token: SeBackupPrivilege	1360	vssvc.exe
Token: SeRestorePrivilege	1360	vssvc.exe
Token: SeAuditPrivilege	1360	vssvc.exe
Token: SeIncreaseQuotaPrivilege	408	wmic.exe
Token: SeSecurityPrivilege	408	wmic.exe
Token: SeTakeOwnershipPrivilege	408	wmic.exe
Token: SeLoadDriverPrivilege	408	wmic.exe
Token: SeSystemProfilePrivilege	408	wmic.exe
Token: SeSystemtimePrivilege	408	wmic.exe
Token: SeProfSingleProcessPrivilege	408	wmic.exe
Token: SeIncBasePriorityPrivilege	408	wmic.exe
Token: SeCreatePagefilePrivilege	408	wmic.exe
Token: SeBackupPrivilege	408	wmic.exe
Token: SeRestorePrivilege	408	wmic.exe
Token: SeShutdownPrivilege	408	wmic.exe
Token: SeDebugPrivilege	408	wmic.exe
Token: SeSystemEnvironmentPrivilege	408	wmic.exe
Token: SeRemoteShutdownPrivilege	408	wmic.exe
Token: SeUndockPrivilege	408	wmic.exe
Token: SeManageVolumePrivilege	408	wmic.exe
Token: 33	408	wmic.exe
Token: 34	408	wmic.exe
Token: 35	408	wmic.exe
Token: 36	408	wmic.exe
Token: SeIncreaseQuotaPrivilege	408	wmic.exe
Token: SeSecurityPrivilege	408	wmic.exe
Token: SeTakeOwnershipPrivilege	408	wmic.exe
Token: SeLoadDriverPrivilege	408	wmic.exe
Token: SeSystemProfilePrivilege	408	wmic.exe
Token: SeSystemtimePrivilege	408	wmic.exe
Token: SeProfSingleProcessPrivilege	408	wmic.exe
Token: SeIncBasePriorityPrivilege	408	wmic.exe
Token: SeCreatePagefilePrivilege	408	wmic.exe
Token: SeBackupPrivilege	408	wmic.exe
Token: SeRestorePrivilege	408	wmic.exe
Token: SeShutdownPrivilege	408	wmic.exe
Token: SeDebugPrivilege	408	wmic.exe
Token: SeSystemEnvironmentPrivilege	408	wmic.exe
Token: SeRemoteShutdownPrivilege	408	wmic.exe
Token: SeUndockPrivilege	408	wmic.exe
Token: SeManageVolumePrivilege	408	wmic.exe
Token: 33	408	wmic.exe
Token: 34	408	wmic.exe
Token: 35	408	wmic.exe
Token: 36	408	wmic.exe
Token: 33	272	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	272	AUDIODG.EXE
Token: SeDebugPrivilege	6120	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1696	2032	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe	91
PID 2032 wrote to memory of 1696	2032	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe	91
PID 2032 wrote to memory of 1696	2032	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe	91
PID 2032 wrote to memory of 4692	2032	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe	92
PID 2032 wrote to memory of 4692	2032	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe	92
PID 2032 wrote to memory of 4692	2032	84255e080413cc079085e8f879be7c66_JaffaCakes118.exe	92
PID 4692 wrote to memory of 4792	4692	cmd.exe	94
PID 4692 wrote to memory of 4792	4692	cmd.exe	94
PID 4692 wrote to memory of 4792	4692	cmd.exe	94
PID 4692 wrote to memory of 4848	4692	cmd.exe	95
PID 4692 wrote to memory of 4848	4692	cmd.exe	95
PID 4692 wrote to memory of 4848	4692	cmd.exe	95
PID 1696 wrote to memory of 5076	1696	ipconfig.exe	98
PID 1696 wrote to memory of 5076	1696	ipconfig.exe	98
PID 1696 wrote to memory of 408	1696	ipconfig.exe	103
PID 1696 wrote to memory of 408	1696	ipconfig.exe	103
PID 1696 wrote to memory of 1580	1696	ipconfig.exe	118
PID 1696 wrote to memory of 1580	1696	ipconfig.exe	118
PID 1580 wrote to memory of 3576	1580	msedge.exe	120
PID 1580 wrote to memory of 3576	1580	msedge.exe	120
PID 1696 wrote to memory of 212	1696	ipconfig.exe	119
PID 1696 wrote to memory of 212	1696	ipconfig.exe	119
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 4048	1580	msedge.exe	121
PID 1580 wrote to memory of 32	1580	msedge.exe	122
PID 1580 wrote to memory of 32	1580	msedge.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\84255e080413cc079085e8f879be7c66_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\84255e080413cc079085e8f879be7c66_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Roaming\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\ipconfig.exe
  "C:\Users\Admin\AppData\Roaming\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\ipconfig.exe"
  2⤵
  - Adds policy Run key to start application
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Gathers network information
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5076
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9764e46f8,0x7ff9764e4708,0x7ff9764e4718
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:32
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7866774391218716695,12117439147526243702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
      4⤵
      PID:5384
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cerberhhyed5frqa.xmfhr6.win/FF73-A98D-55C5-0063-71A7
    3⤵
    PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9764e46f8,0x7ff9764e4708,0x7ff9764e4718
      4⤵
      PID:4108
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
    3⤵
    PID:1144
- - C:\Windows\system32\cmd.exe
    /d /c taskkill /t /f /im "ipconfig.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{A9B9797B-2350-5224-D0C5-BE661FD62C90}\ipconfig.exe" > NUL
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6060
  - - C:\Windows\system32\taskkill.exe
      taskkill /t /f /im "ipconfig.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6120
  - - C:\Windows\system32\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5244
- C:\Windows\SysWOW64\cmd.exe
  /d /c taskkill /t /f /im "84255e080413cc079085e8f879be7c66_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\84255e080413cc079085e8f879be7c66_JaffaCakes118.exe" > NUL
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /t /f /im "84255e080413cc079085e8f879be7c66_JaffaCakes118.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x46c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery