teslacrypt | 9b1622602d4ae8196316deeb91fbdd1346a4b31453f3762be119e24c84827217

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Size

388KB
MD5

a0340430d4b1c1f6dd4048ab98f2e4b2
SHA1

a43ff275972b4ed9b7f3ece61d7d49375db635e9
SHA256

9b1622602d4ae8196316deeb91fbdd1346a4b31453f3762be119e24c84827217
SHA512

54ca85bee0ded2a742c767565159c0e3121d8cd1d97cebc751d067b1ea45d9fca86b6d5acad5b472eddef23d20afcc8ae3497cdd411fd9f393d80e0c90f2cd8d
SSDEEP

12288:XhTjRwlkwFrnAEryLFcG3yBrZTRDgZ8zOhG6:p4DRw7325gPh

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+hxnip.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/62966E53EC8DE2F0 2. http://kkd47eh4hdjshb5t.angortra.at/62966E53EC8DE2F0 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/62966E53EC8DE2F0 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/62966E53EC8DE2F0 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/62966E53EC8DE2F0 http://kkd47eh4hdjshb5t.angortra.at/62966E53EC8DE2F0 http://ytrest84y5i456hghadefdsd.pontogrot.com/62966E53EC8DE2F0 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/62966E53EC8DE2F0

URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/62966E53EC8DE2F0

http://kkd47eh4hdjshb5t.angortra.at/62966E53EC8DE2F0

http://ytrest84y5i456hghadefdsd.pontogrot.com/62966E53EC8DE2F0

http://xlowfznrg4wf7dli.ONION/62966E53EC8DE2F0

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (863) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	ygiauerhwwqj.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+hxnip.png	ygiauerhwwqj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+hxnip.png	ygiauerhwwqj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+hxnip.html	ygiauerhwwqj.exe

Executes dropped EXE 2 IoCs

pid	Process
4448	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pooihealekbq = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\ygiauerhwwqj.exe\""	ygiauerhwwqj.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3548 set thread context of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 4448 set thread context of 4164	4448	ygiauerhwwqj.exe	103

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-36_altform-unplated.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-150.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\Recovery+hxnip.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-150_contrast-white.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-200.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square310x310Logo.scale-100.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-100.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\en-us\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_8_Loud.m4a	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-400.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-256.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-80.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashWideTile.scale-125_contrast-black.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-latn-cs\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-black_scale-200.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16_altform-unplated.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Recovery+hxnip.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-256_altform-unplated.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skypex-icon-white.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\69.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-20.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-125.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-400.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-100.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\Road.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Shaders\Recovery+hxnip.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_altform-unplated_contrast-white.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-72_altform-unplated.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-100_contrast-black.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlConeHover.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\934B6514-B3DC-4B8F-82EB-F1681BAEB6A9\root\vfs\Windows\assembly\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Error.jpg	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Recovery+hxnip.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\Recovery+hxnip.html	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-20_contrast-white.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\Recovery+hxnip.png	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Deleted\Recovery+hxnip.txt	ygiauerhwwqj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40_altform-unplated.png	ygiauerhwwqj.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ygiauerhwwqj.exe	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
File opened for modification	C:\Windows\ygiauerhwwqj.exe	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ygiauerhwwqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ygiauerhwwqj.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	ygiauerhwwqj.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1968	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe
4164	ygiauerhwwqj.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Token: SeDebugPrivilege	4164	ygiauerhwwqj.exe
Token: SeIncreaseQuotaPrivilege	412	WMIC.exe
Token: SeSecurityPrivilege	412	WMIC.exe
Token: SeTakeOwnershipPrivilege	412	WMIC.exe
Token: SeLoadDriverPrivilege	412	WMIC.exe
Token: SeSystemProfilePrivilege	412	WMIC.exe
Token: SeSystemtimePrivilege	412	WMIC.exe
Token: SeProfSingleProcessPrivilege	412	WMIC.exe
Token: SeIncBasePriorityPrivilege	412	WMIC.exe
Token: SeCreatePagefilePrivilege	412	WMIC.exe
Token: SeBackupPrivilege	412	WMIC.exe
Token: SeRestorePrivilege	412	WMIC.exe
Token: SeShutdownPrivilege	412	WMIC.exe
Token: SeDebugPrivilege	412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	412	WMIC.exe
Token: SeRemoteShutdownPrivilege	412	WMIC.exe
Token: SeUndockPrivilege	412	WMIC.exe
Token: SeManageVolumePrivilege	412	WMIC.exe
Token: 33	412	WMIC.exe
Token: 34	412	WMIC.exe
Token: 35	412	WMIC.exe
Token: 36	412	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3692	WMIC.exe
Token: SeSecurityPrivilege	3692	WMIC.exe
Token: SeTakeOwnershipPrivilege	3692	WMIC.exe
Token: SeLoadDriverPrivilege	3692	WMIC.exe
Token: SeSystemProfilePrivilege	3692	WMIC.exe
Token: SeSystemtimePrivilege	3692	WMIC.exe
Token: SeProfSingleProcessPrivilege	3692	WMIC.exe
Token: SeIncBasePriorityPrivilege	3692	WMIC.exe
Token: SeCreatePagefilePrivilege	3692	WMIC.exe
Token: SeBackupPrivilege	3692	WMIC.exe
Token: SeRestorePrivilege	3692	WMIC.exe
Token: SeShutdownPrivilege	3692	WMIC.exe
Token: SeDebugPrivilege	3692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3692	WMIC.exe
Token: SeRemoteShutdownPrivilege	3692	WMIC.exe
Token: SeUndockPrivilege	3692	WMIC.exe
Token: SeManageVolumePrivilege	3692	WMIC.exe
Token: 33	3692	WMIC.exe
Token: 34	3692	WMIC.exe
Token: 35	3692	WMIC.exe
Token: 36	3692	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 3548 wrote to memory of 2096	3548	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	97
PID 2096 wrote to memory of 4448	2096	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	98
PID 2096 wrote to memory of 4448	2096	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	98
PID 2096 wrote to memory of 4448	2096	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	98
PID 2096 wrote to memory of 2884	2096	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	99
PID 2096 wrote to memory of 2884	2096	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	99
PID 2096 wrote to memory of 2884	2096	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	99
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4448 wrote to memory of 4164	4448	ygiauerhwwqj.exe	103
PID 4164 wrote to memory of 412	4164	ygiauerhwwqj.exe	104
PID 4164 wrote to memory of 412	4164	ygiauerhwwqj.exe	104
PID 4164 wrote to memory of 1968	4164	ygiauerhwwqj.exe	108
PID 4164 wrote to memory of 1968	4164	ygiauerhwwqj.exe	108
PID 4164 wrote to memory of 1968	4164	ygiauerhwwqj.exe	108
PID 4164 wrote to memory of 2840	4164	ygiauerhwwqj.exe	109
PID 4164 wrote to memory of 2840	4164	ygiauerhwwqj.exe	109
PID 2840 wrote to memory of 208	2840	msedge.exe	110
PID 2840 wrote to memory of 208	2840	msedge.exe	110
PID 4164 wrote to memory of 3692	4164	ygiauerhwwqj.exe	111
PID 4164 wrote to memory of 3692	4164	ygiauerhwwqj.exe	111
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113
PID 2840 wrote to memory of 2700	2840	msedge.exe	113

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ygiauerhwwqj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	ygiauerhwwqj.exe

C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\ygiauerhwwqj.exe
    C:\Windows\ygiauerhwwqj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\ygiauerhwwqj.exe
      C:\Windows\ygiauerhwwqj.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4164
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:412
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:1968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa81f946f8,0x7ffa81f94708,0x7ffa81f94718
        6⤵
        
        PID:208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        6⤵
        
        PID:2700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
        6⤵
        
        PID:820
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
        6⤵
        
        PID:2136
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
        6⤵
        
        PID:5048
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
        6⤵
        
        PID:5008
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
        6⤵
        
        PID:1944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
        6⤵
        
        PID:2920
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
        6⤵
        
        PID:2196
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
        6⤵
        
        PID:2488
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11596158373861617709,8604889633613429980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
        6⤵
        
        PID:228
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3692
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\YGIAUE~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\A03404~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+hxnip.html

Filesize
9KB

MD5
721ba4402b447e3da17697f129491e4f

SHA1
d543d312180cbbadaa843fab74027436a4a34144

SHA256
6d0d45b31acb63ad1a52b54812b40dce4cc6c47d9db1dacb1d0e7a9731e18be9

SHA512
5117eca0a7ea94cab2706a0d1148710b1d0359555429cc64df5cb688b61d725ff236ceabf13ebeadf248ec0337240fd4bc548be4f4d9cec5e68b377e74aeddd9

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+hxnip.png

Filesize
63KB

MD5
25e39db7924d8e80447bdb374200ed36

SHA1
524e0deb8f683cfca168a76bde228f51ccaf00f0

SHA256
27d271b53c8317a56afa3b414fade38e980ee799dc8c57f943f80e19839814f6

SHA512
e55ae659fe831e35de6bd9fb4e058580d0ce6eb9a4609c013a72d688f48cba58763391a7a89daf74257cd30e1b8158457f0f7113924fc9d4d6e5a03b8f559521

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+hxnip.txt

Filesize
1KB

MD5
c1179645eadc76d024bd746c7e1fe5e2

SHA1
c56c879bb2185721e12ca60c5870b1aaa7a9e265

SHA256
5e652307d9b6a569083768d7a239f62a1f41ae3a6aa9d00b9b7d8b9aa2b50dad

SHA512
d90cedeeb8fa6fc8eb576543e799fb0093e4bf7092a6f8085aa91f7a6f881ac02570121807f2086298ace4628703704afb59ec91092c3ffcacc81fab4d7d328c

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
3284b8c1149ea6d467c90f9dc4abce46

SHA1
89a8428a215a2fa854c3d23d9bce9e8040d82df9

SHA256
45ab96fafd830b0277a9646f20322a040ca0eec965e901fc9a58bb47ef0bd712

SHA512
680008c6b002aec57c3638c3042d7c516fc1e41f6636119ae849be16dea66b83a40042cc8f69c8cf1b506a57fdf5ec2f7cc96ec9da2fac138d11188d6d324365

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
386f03678f0bd3ebdded549c669ff260

SHA1
1f80e943ba6d3bfba265aea5629fcdbf9287a708

SHA256
5e41b8b28a81661e678b2f32780752a412e88d5066969c7eeda1b970441925c7

SHA512
6d757a3a453e3b2d83cab3269b72586077c8efce01e1c0cfa88566d04756dd0c955aaddf6a769571e7b4cf51748405d3d7371e66ca7d2c46eacf3cd9435e662d

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
7c9dccce870476ae818fec4a96d4c7f3

SHA1
013f605c30d93282c49031f0d323ec642975e8a2

SHA256
1182dfd8516c0ef267c8d6bf1dafaf3d1704114da4a6c41303b232b6ac93d6db

SHA512
73b332ec64a40c5c2eeb8c60f1d1fa0340c025a6cae8a5f5ee5697f90a57a9ce895f7302bb62cb7fe3e487253f9aa2b8b0fb8eabfe8d8313d2ca7998624865f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52844bf5169d099e2f0107ff6b6e40ba

SHA1
8360aa332c5084929844b4d5d1a62f2264d0a104

SHA256
d7c0cea5b315d938b7794f24134258458317e5d11a773381681731ae1248937f

SHA512
fa5a1881ae5fc5d7dc30d0f2dfb357b8430af15fb3e63ac918ad952abc2bf0971c69964eb332b39d537117212d1f2c6eee06fad3a70c1d27c1252d6be04bc979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b24a3cf6-e75e-42bc-90ea-fa7061bb93ad.tmp

Filesize
5KB

MD5
8b04e3d53dc5c1e178b789cbf568d765

SHA1
1ebe2000b9bc4dc30fa14aaaa988c1381e9745ec

SHA256
530d20d21a433e3237db727ab05266888c4f45b84f19678a1ca1090114e54ac5

SHA512
a8211f96489c06698ff8398bef8667e2a731fe72d47c6529ad7f70268234d08a9765c16d03244462ce2ec00ffbe00f3a5d0ef068674cc920c667174cf651482f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
feaf328e757f0f9ed684b205d64736a0

SHA1
76ac67e51317ba9d2a2f053c5cb35f41855c265d

SHA256
db6abdd2bc1c725a861f87fd2a497dcf20de755c4269d219f7ebfeaa21df07b1

SHA512
0645b1747be870c31cd58434a6aad5c446d20e42fb64bd3a2c9db84c3add469316a6d7baf7708d01e92390670f15d248e91cb4e9ca35ba8654746924a38eaab1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656298443196.txt

Filesize
77KB

MD5
8ae6e6ffff8ea56efb25a94386810ebf

SHA1
e4a55a2c029a4583128f80a6735c4b60c5d2678a

SHA256
62c77b443930fb5fee6c22ca14d1569e5e0a1141e8a2f946bb2db9b5032c67cd

SHA512
bb88d1d58578fdcd80361c4848e5b859b6de5315e987b3b82424fedc18612609e46b39276ec725abebfc5bff7187c0eed3344a21f5ed8bf7246beac0e8a868e4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727657999741523.txt

Filesize
47KB

MD5
e45ad0be6ab7056bdccedbb4266775ef

SHA1
7c3d917bc3127d87e55689f9883cd540b915a525

SHA256
42b0d7dd3dea4b3f7bc871984c21e0f4fbf60c20bd8c0c65e0a30cfcf4a8d289

SHA512
65cd001607cecb43f973ecf37f21657ee0e309d6340195cf90f83a151fc67cd1ec1fd7b318b65d99f8728be1550d58ab0e421bafe8543e9766044f78b1b0973b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666039184869.txt

Filesize
74KB

MD5
0a2032fa6cf9def52296448e0071705f

SHA1
7129f3deae4cd4ce6ef6062906090c7b2d2aa5fb

SHA256
3866cfceb2f016317402c0c6d11c1a554900bbc2b4aca3709b510b1addb372ef

SHA512
91ead85af684efe6970da1ba850ef4cfbfd42d9d9ba58bd9b757d917ce0a24f22d388184368aff468b82da8fdb2327a7e00f8efbafc84885533c44c9de169672

Download Submit
C:\Windows\ygiauerhwwqj.exe

Filesize
388KB

MD5
a0340430d4b1c1f6dd4048ab98f2e4b2

SHA1
a43ff275972b4ed9b7f3ece61d7d49375db635e9

SHA256
9b1622602d4ae8196316deeb91fbdd1346a4b31453f3762be119e24c84827217

SHA512
54ca85bee0ded2a742c767565159c0e3121d8cd1d97cebc751d067b1ea45d9fca86b6d5acad5b472eddef23d20afcc8ae3497cdd411fd9f393d80e0c90f2cd8d

Download Submit
memory/2096-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2096-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2096-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2096-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2096-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3548-4-0x0000000000C80000-0x0000000000C83000-memory.dmp

Filesize
12KB

Download
memory/3548-1-0x0000000000C80000-0x0000000000C83000-memory.dmp

Filesize
12KB

Download
memory/3548-0-0x0000000000C80000-0x0000000000C83000-memory.dmp

Filesize
12KB

Download
memory/4164-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-5306-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-2728-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-2727-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-8786-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-10727-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-10728-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-10736-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-10737-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-890-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-24-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-23-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-21-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-10779-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4164-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4448-12-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download