teslacrypt | a5643944606ce1fc7025ba988e0186ab8d37a44af5efd077a8934e36a41d8624

Analysis

max time kernel
148s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
Size

376KB
MD5

9fb86c5050cc496dcdc3f53ee2c59069
SHA1

ee358c3adca4413b6c30b146a8b33b70a230b3c7
SHA256

a5643944606ce1fc7025ba988e0186ab8d37a44af5efd077a8934e36a41d8624
SHA512

ecc5f28fe85343e1574112323e2f35853b49290100d450e5a4ca708c16f07018b5ae82be70bb5408d0e92183344c12d3612a9198fa7c641f61f8a5f6c536f21d
SSDEEP

6144:Ee3rNhMeYq4CGRTs4kadSoKVStcmTVn57CpSCwsUbg62oXd:EY5hMfqwTsTKcmTV5kINEx+d

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+xrpqt.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2964EA59E1532652 2. http://kkd47eh4hdjshb5t.angortra.at/2964EA59E1532652 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/2964EA59E1532652 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/2964EA59E1532652 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2964EA59E1532652 http://kkd47eh4hdjshb5t.angortra.at/2964EA59E1532652 http://ytrest84y5i456hghadefdsd.pontogrot.com/2964EA59E1532652 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/2964EA59E1532652

URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/2964EA59E1532652

http://kkd47eh4hdjshb5t.angortra.at/2964EA59E1532652

http://ytrest84y5i456hghadefdsd.pontogrot.com/2964EA59E1532652

http://xlowfznrg4wf7dli.ONION/2964EA59E1532652

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	cgoiwkgjwxbe.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+xrpqt.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+xrpqt.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+xrpqt.html	cgoiwkgjwxbe.exe

Executes dropped EXE 2 IoCs

pid	Process
4212	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scburislxexo = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\cgoiwkgjwxbe.exe\""	cgoiwkgjwxbe.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3288 set thread context of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 4212 set thread context of 4232	4212	cgoiwkgjwxbe.exe	95

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\Recovery+xrpqt.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\iheart-radio.scale-100.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\093BCF21-5E9E-4799-B5D9-0D68ED1A295B\root\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe805.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-200.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-125.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-16_altform-unplated_contrast-black.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-60_altform-unplated.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ro-RO\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-100_contrast-white.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\Recovery+xrpqt.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-125.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-125.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-60.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\SmallTile.scale-100.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-400.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_contrast-white.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalSplashScreen.scale-200.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Tented\TentMobile_100x96.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Recovery+xrpqt.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupSmallTile.scale-100.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-125.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\Recovery+xrpqt.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\styles.css	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-400.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\avatar310x310.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-colorize.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+xrpqt.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Recovery+xrpqt.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-400.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\Recovery+xrpqt.txt	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\Windows Sidebar\Recovery+xrpqt.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\Recovery+xrpqt.html	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SmallTile.scale-200_contrast-white.png	cgoiwkgjwxbe.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png	cgoiwkgjwxbe.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\cgoiwkgjwxbe.exe	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
File opened for modification	C:\Windows\cgoiwkgjwxbe.exe	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cgoiwkgjwxbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cgoiwkgjwxbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	cgoiwkgjwxbe.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4016	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe
4232	cgoiwkgjwxbe.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
Token: SeDebugPrivilege	4232	cgoiwkgjwxbe.exe
Token: SeIncreaseQuotaPrivilege	4164	WMIC.exe
Token: SeSecurityPrivilege	4164	WMIC.exe
Token: SeTakeOwnershipPrivilege	4164	WMIC.exe
Token: SeLoadDriverPrivilege	4164	WMIC.exe
Token: SeSystemProfilePrivilege	4164	WMIC.exe
Token: SeSystemtimePrivilege	4164	WMIC.exe
Token: SeProfSingleProcessPrivilege	4164	WMIC.exe
Token: SeIncBasePriorityPrivilege	4164	WMIC.exe
Token: SeCreatePagefilePrivilege	4164	WMIC.exe
Token: SeBackupPrivilege	4164	WMIC.exe
Token: SeRestorePrivilege	4164	WMIC.exe
Token: SeShutdownPrivilege	4164	WMIC.exe
Token: SeDebugPrivilege	4164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4164	WMIC.exe
Token: SeRemoteShutdownPrivilege	4164	WMIC.exe
Token: SeUndockPrivilege	4164	WMIC.exe
Token: SeManageVolumePrivilege	4164	WMIC.exe
Token: 33	4164	WMIC.exe
Token: 34	4164	WMIC.exe
Token: 35	4164	WMIC.exe
Token: 36	4164	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4816	WMIC.exe
Token: SeSecurityPrivilege	4816	WMIC.exe
Token: SeTakeOwnershipPrivilege	4816	WMIC.exe
Token: SeLoadDriverPrivilege	4816	WMIC.exe
Token: SeSystemProfilePrivilege	4816	WMIC.exe
Token: SeSystemtimePrivilege	4816	WMIC.exe
Token: SeProfSingleProcessPrivilege	4816	WMIC.exe
Token: SeIncBasePriorityPrivilege	4816	WMIC.exe
Token: SeCreatePagefilePrivilege	4816	WMIC.exe
Token: SeBackupPrivilege	4816	WMIC.exe
Token: SeRestorePrivilege	4816	WMIC.exe
Token: SeShutdownPrivilege	4816	WMIC.exe
Token: SeDebugPrivilege	4816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4816	WMIC.exe
Token: SeRemoteShutdownPrivilege	4816	WMIC.exe
Token: SeUndockPrivilege	4816	WMIC.exe
Token: SeManageVolumePrivilege	4816	WMIC.exe
Token: 33	4816	WMIC.exe
Token: 34	4816	WMIC.exe
Token: 35	4816	WMIC.exe
Token: 36	4816	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 3288 wrote to memory of 1960	3288	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	90
PID 1960 wrote to memory of 4212	1960	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	91
PID 1960 wrote to memory of 4212	1960	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	91
PID 1960 wrote to memory of 4212	1960	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	91
PID 1960 wrote to memory of 1400	1960	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	92
PID 1960 wrote to memory of 1400	1960	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	92
PID 1960 wrote to memory of 1400	1960	9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe	92
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4212 wrote to memory of 4232	4212	cgoiwkgjwxbe.exe	95
PID 4232 wrote to memory of 4164	4232	cgoiwkgjwxbe.exe	96
PID 4232 wrote to memory of 4164	4232	cgoiwkgjwxbe.exe	96
PID 4232 wrote to memory of 4016	4232	cgoiwkgjwxbe.exe	99
PID 4232 wrote to memory of 4016	4232	cgoiwkgjwxbe.exe	99
PID 4232 wrote to memory of 4016	4232	cgoiwkgjwxbe.exe	99
PID 4232 wrote to memory of 1288	4232	cgoiwkgjwxbe.exe	100
PID 4232 wrote to memory of 1288	4232	cgoiwkgjwxbe.exe	100
PID 1288 wrote to memory of 1632	1288	msedge.exe	101
PID 1288 wrote to memory of 1632	1288	msedge.exe	101
PID 4232 wrote to memory of 4816	4232	cgoiwkgjwxbe.exe	102
PID 4232 wrote to memory of 4816	4232	cgoiwkgjwxbe.exe	102
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104
PID 1288 wrote to memory of 952	1288	msedge.exe	104

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cgoiwkgjwxbe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	cgoiwkgjwxbe.exe

C:\Users\Admin\AppData\Local\Temp\9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9fb86c5050cc496dcdc3f53ee2c59069_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\cgoiwkgjwxbe.exe
    C:\Windows\cgoiwkgjwxbe.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\cgoiwkgjwxbe.exe
      C:\Windows\cgoiwkgjwxbe.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4232
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:4016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7f5e46f8,0x7ffc7f5e4708,0x7ffc7f5e4718
        6⤵
        
        PID:1632
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        6⤵
        
        PID:952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
        6⤵
        
        PID:4484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
        6⤵
        
        PID:532
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        6⤵
        
        PID:3992
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        6⤵
        
        PID:4772
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
        6⤵
        
        PID:2356
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
        6⤵
        
        PID:3092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
        6⤵
        
        PID:2692
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
        6⤵
        
        PID:4348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
        6⤵
        
        PID:3892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,11787612001323602316,14782453029693105477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        6⤵
        
        PID:1668
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\CGOIWK~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\9FB86C~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+xrpqt.html

Filesize
7KB

MD5
c3f41987e225b282f36b8a51eb06919f

SHA1
f69ad0b0ffb442ee35ff24cf3984d1f5e4a569bb

SHA256
028a0be2453fac400f949c6452daebc0518b42035ff3f173b4ee6057952267cd

SHA512
769bfdef7981c04cc7a3fb4927962f78bad106fbd0f84b05e1101a865b74a0ea2660d8a26ce3b4567562810e7690e1a57af088bbe26c83da7ff41f2bb023f220

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+xrpqt.png

Filesize
63KB

MD5
0078a3a1b5da948bed8f78c8f74c1b38

SHA1
b63b1280227899be857b370e3930b571c811fd52

SHA256
e2a488a725732d8e95c5d17d90b685c3df16f5ccaaceceb9292b394465075e5f

SHA512
29fbb153a43101314d4f6bc01cbaa96c06ea64cb21a3b5f2bf36ded2597407e647d494f785b349833cedea6a384b474218c6412fea14a7bb9a4ea04596b085ee

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+xrpqt.txt

Filesize
1KB

MD5
a79f406b48b075985fe054a6b71109f0

SHA1
a4271b2d7331b4986a4c737cbaa1424c2024b1b6

SHA256
1b9c718bbb547e677623f0b8e0e1eb31350cbfd3c17322afb2e967dd7c1f4021

SHA512
fe9e1abcc8c9edd88e9db8958c32dc23d68d1948f084ca59949fbf836f969430bb46939efff8f9ace9457107feb02311355b8f7440296ee819426ebec0bef194

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
f32997d1a8849565f5050187ed24df9f

SHA1
8c63e55be1567e45d015e5a6b9ca5eb022d4bf6f

SHA256
43b07512e61ec8509efb612b054d865aad446d728d1287266fdb633a7f3c471b

SHA512
7d4bfeb787cff5fd66d93fdf5610d66336f0eba977dd4812b68e2e0e74afa3313a86de0c8080a9fe83915706b112fb3e97fb2b9428d4055cd2f1993e1fad8692

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
a938999d5c9cf840ce01a55a98a977a8

SHA1
353c970d979fb99a6c1790469a5409076a67ff47

SHA256
f0252396ed6e4444c6835c179cf652fce4601bf22780392e430a488a75ebe044

SHA512
ded8203bb64d20912d56ed371c52ea76ceb9f787d4eca2cf9e6b6b6791f81f9114bd423118d28394eccd867c61573cf13123357baeffe0c4b1b79ac7e6899891

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
3e064d3e8bf2b1a7008c6b04eeca5d73

SHA1
e16a75a3b56801a3a1d2eac55435a3804b3cab9b

SHA256
6d61af6f10ea396cf2ab653bf43027986c771332b9f3df75142cc907437f9fe7

SHA512
68f94f84bf12d8b405f8ceaee798948b06b7ed521e8cced911e8a70d9827d0389ba14d71eec091898164831c6bec1bc4b42271701f1576ec5075c1f691ace6b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
38b3f23eb5e02f0f8d65e86358b6df25

SHA1
e39e8ae6a749cd165c995633dcc81ad1a3380eec

SHA256
da36b5a4d5bea00d0f31b5eddb0e0be79ff442578c352fb5e0d9595b2fff52a4

SHA512
780549c38921c85c955682b185d372992cc9fe2bf04f4312a38c4e4b3f59bb4c26295a250c7602fd4557a9d72bb6576397a13e86e7c85a637f22a5f2296801b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f426fa866fcf3863b67b9dd12b44fce1

SHA1
48651535e02d5610a7a3cc18a25d00c3a0bc5312

SHA256
5c87f060304fb8beda9152988b7b712aece1d0cb6683d7777475a7f653594772

SHA512
6c222b164199454b01c89caea2b24d20efd6edc95877bb2a266c10c725d12dcc78c435fdc2a11578fca6a8a074a42282de2ae3171b1c975bc820fd2268ff5ad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
33c8fc816b30201d1c23130773635d56

SHA1
c310ccb1ed17d606f837d32f2ff1df8c9e8d1956

SHA256
2e33695b7b95cc13600adfcf73ab26a2f255a275c9c7d00b6ef3ddb3621cd451

SHA512
f09a7e5119a44ee4b2f31c76080a007852a6f85948af4ac4879ea49c493e37d037f2a269fa87ea5fae5e122dcec5e72d1c84058a79cc3b0eca88d9d04f5e1ae7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662717143618.txt

Filesize
77KB

MD5
7f059c10499d8a783e3caa9809346aab

SHA1
e351ef2f7ed1a0cd3f9274129070a4c0c6cb4539

SHA256
1bb4f818bdd7f442163dd1d9d5180532e361a4d4a6282b1e1843638ff5ba5d3e

SHA512
b7263c9be9f606d7278323af40121c9d683bf6f3b9eb722ef9149dcb2a9b23ab4fb4218580da27d5569619bf58a79220ff8393fb441008929b01e33c4cd9cdb6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663983438946.txt

Filesize
47KB

MD5
b16c39abd00924409b40e85e87c21634

SHA1
3879e31866c21e4a75b95aec8acdfa8af1eb9761

SHA256
c420eb0ea299e8c736fc7adcca76b8fe096c3fc6baa9b2c0d6f4fc7d09d7a0d6

SHA512
f3997fce55621256df7742cabeb359a68734b08e19f4a3a9238f2de6c92f99fb0ba3adcebd3fa50b45789cccad6d683076cd0d68e62fab38f0c9a1635e377e48

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671578469739.txt

Filesize
74KB

MD5
cba4a6cb406c94dd89300d9f41c3adc3

SHA1
168069869add15ff0998814f0ef94eafd27e9078

SHA256
b922f90998c15cfd4de6f6eb5cee274d502fa9322c7eb88938c4f4694c1a93ab

SHA512
144686c8a269a85ef5b7d90d8e233f4f1a66164ab2d2bfae2ed45906eb851b9704dc04e197da2137e88aab5811d65efb63be0c3376e6f36e533e9dc424ff055a

Download Submit
C:\Windows\cgoiwkgjwxbe.exe

Filesize
376KB

MD5
9fb86c5050cc496dcdc3f53ee2c59069

SHA1
ee358c3adca4413b6c30b146a8b33b70a230b3c7

SHA256
a5643944606ce1fc7025ba988e0186ab8d37a44af5efd077a8934e36a41d8624

SHA512
ecc5f28fe85343e1574112323e2f35853b49290100d450e5a4ca708c16f07018b5ae82be70bb5408d0e92183344c12d3612a9198fa7c641f61f8a5f6c536f21d

Download Submit
memory/1960-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1960-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1960-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1960-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1960-13-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/3288-4-0x00000000007B0000-0x00000000007B3000-memory.dmp

Filesize
12KB

Download
memory/3288-1-0x00000000007B0000-0x00000000007B3000-memory.dmp

Filesize
12KB

Download
memory/3288-0-0x00000000007B0000-0x00000000007B3000-memory.dmp

Filesize
12KB

Download
memory/4212-12-0x0000000000400000-0x00000000005EB000-memory.dmp

Filesize
1.9MB

Download
memory/4232-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-5311-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-8668-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-10508-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-10509-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-10517-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-10518-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-2676-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-2675-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-644-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-25-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-10559-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-23-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-20-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4232-17-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download