teslacrypt | ce70e4c500aa39d8d43b1fc93909894c87b68843420b359f4017bec77292fa7d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe
Size

376KB
MD5

b4c370efce46e7abfec0b147f3118b6e
SHA1

d08babb7e379e05f24270b005efd42c57834d6f1
SHA256

ce70e4c500aa39d8d43b1fc93909894c87b68843420b359f4017bec77292fa7d
SHA512

61573d888601dec15e2eae0777df7a15a5205f3af28c44349aa76f29d712f32d287dedb1187ca1121262b1f7715244bb4c31cc3e878728d77a28619a9207b30f
SSDEEP

6144:ie3rNhMeYq4CGRTs4kadSoKVStcmTVn57CpSCwsUbg62oXd:iY5hMfqwTsTKcmTV5kINEx+d

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+jstdm.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/ABC16D5FBF71CF8B 2. http://kkd47eh4hdjshb5t.angortra.at/ABC16D5FBF71CF8B 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/ABC16D5FBF71CF8B If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/ABC16D5FBF71CF8B 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/ABC16D5FBF71CF8B http://kkd47eh4hdjshb5t.angortra.at/ABC16D5FBF71CF8B http://ytrest84y5i456hghadefdsd.pontogrot.com/ABC16D5FBF71CF8B *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/ABC16D5FBF71CF8B

URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/ABC16D5FBF71CF8B

http://kkd47eh4hdjshb5t.angortra.at/ABC16D5FBF71CF8B

http://ytrest84y5i456hghadefdsd.pontogrot.com/ABC16D5FBF71CF8B

http://xlowfznrg4wf7dli.ONION/ABC16D5FBF71CF8B

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (872) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bsxcuwfhfdfh.exeb4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	bsxcuwfhfdfh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe

Drops startup file 6 IoCs

Processes:

bsxcuwfhfdfh.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+jstdm.html	bsxcuwfhfdfh.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+jstdm.html	bsxcuwfhfdfh.exe

Executes dropped EXE 2 IoCs

Processes:

bsxcuwfhfdfh.exebsxcuwfhfdfh.exe

pid	Process
2720	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bsxcuwfhfdfh.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blgxshwdfgwk = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\bsxcuwfhfdfh.exe\""	bsxcuwfhfdfh.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

Processes:

b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exebsxcuwfhfdfh.exe

description	pid	Process	procid_target
PID 2364 set thread context of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2720 set thread context of 4864	2720	bsxcuwfhfdfh.exe	95

Drops file in Program Files directory 64 IoCs

Processes:

bsxcuwfhfdfh.exe

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\WideTile.scale-125.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\gl-ES\View3d\Recovery+jstdm.html	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-150.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Resource\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-20_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-125.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-72.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\Recovery+jstdm.html	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\Recovery+jstdm.html	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-100.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-100.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\Recovery+jstdm.html	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ShareProvider_CopyFile24x24.scale-100.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-black_scale-125.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-80.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-48.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-400.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-200_contrast-black.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\SmallTile.scale-200.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-200.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MediumTile.scale-200_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-200_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\offlineUtilities.js	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Recovery+jstdm.html	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-32.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\Recovery+jstdm.html	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp2.scale-200.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreMedTile.scale-200.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Windows Media Player\de-DE\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.White.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\Recovery+jstdm.html	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-125_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\weatherdotcom.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-20_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\offlineStrings.js	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-125.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\STARTUP\Recovery+jstdm.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_neutral_~_8wekyb3d8bbwe\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-24_contrast-white.png	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\Recovery+jstdm.txt	bsxcuwfhfdfh.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\Recovery+jstdm.html	bsxcuwfhfdfh.exe

Drops file in Windows directory 2 IoCs

Processes:

b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\bsxcuwfhfdfh.exe	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe
File opened for modification	C:\Windows\bsxcuwfhfdfh.exe	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exeb4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exebsxcuwfhfdfh.execmd.exebsxcuwfhfdfh.exeNOTEPAD.EXEcmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bsxcuwfhfdfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bsxcuwfhfdfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

bsxcuwfhfdfh.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	bsxcuwfhfdfh.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
1704	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bsxcuwfhfdfh.exe

pid	Process
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe
4864	bsxcuwfhfdfh.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exebsxcuwfhfdfh.exeWMIC.exeWMIC.exe

description	pid	Process
Token: SeDebugPrivilege	2924	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe
Token: SeDebugPrivilege	4864	bsxcuwfhfdfh.exe
Token: SeIncreaseQuotaPrivilege	2856	WMIC.exe
Token: SeSecurityPrivilege	2856	WMIC.exe
Token: SeTakeOwnershipPrivilege	2856	WMIC.exe
Token: SeLoadDriverPrivilege	2856	WMIC.exe
Token: SeSystemProfilePrivilege	2856	WMIC.exe
Token: SeSystemtimePrivilege	2856	WMIC.exe
Token: SeProfSingleProcessPrivilege	2856	WMIC.exe
Token: SeIncBasePriorityPrivilege	2856	WMIC.exe
Token: SeCreatePagefilePrivilege	2856	WMIC.exe
Token: SeBackupPrivilege	2856	WMIC.exe
Token: SeRestorePrivilege	2856	WMIC.exe
Token: SeShutdownPrivilege	2856	WMIC.exe
Token: SeDebugPrivilege	2856	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2856	WMIC.exe
Token: SeRemoteShutdownPrivilege	2856	WMIC.exe
Token: SeUndockPrivilege	2856	WMIC.exe
Token: SeManageVolumePrivilege	2856	WMIC.exe
Token: 33	2856	WMIC.exe
Token: 34	2856	WMIC.exe
Token: 35	2856	WMIC.exe
Token: 36	2856	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2980	WMIC.exe
Token: SeSecurityPrivilege	2980	WMIC.exe
Token: SeTakeOwnershipPrivilege	2980	WMIC.exe
Token: SeLoadDriverPrivilege	2980	WMIC.exe
Token: SeSystemProfilePrivilege	2980	WMIC.exe
Token: SeSystemtimePrivilege	2980	WMIC.exe
Token: SeProfSingleProcessPrivilege	2980	WMIC.exe
Token: SeIncBasePriorityPrivilege	2980	WMIC.exe
Token: SeCreatePagefilePrivilege	2980	WMIC.exe
Token: SeBackupPrivilege	2980	WMIC.exe
Token: SeRestorePrivilege	2980	WMIC.exe
Token: SeShutdownPrivilege	2980	WMIC.exe
Token: SeDebugPrivilege	2980	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2980	WMIC.exe
Token: SeRemoteShutdownPrivilege	2980	WMIC.exe
Token: SeUndockPrivilege	2980	WMIC.exe
Token: SeManageVolumePrivilege	2980	WMIC.exe
Token: 33	2980	WMIC.exe
Token: 34	2980	WMIC.exe
Token: 35	2980	WMIC.exe
Token: 36	2980	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exeb4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exebsxcuwfhfdfh.exebsxcuwfhfdfh.exemsedge.exe

description	pid	Process	procid_target
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2364 wrote to memory of 2924	2364	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	90
PID 2924 wrote to memory of 2720	2924	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	91
PID 2924 wrote to memory of 2720	2924	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	91
PID 2924 wrote to memory of 2720	2924	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	91
PID 2924 wrote to memory of 3436	2924	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	92
PID 2924 wrote to memory of 3436	2924	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	92
PID 2924 wrote to memory of 3436	2924	b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe	92
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 2720 wrote to memory of 4864	2720	bsxcuwfhfdfh.exe	95
PID 4864 wrote to memory of 2856	4864	bsxcuwfhfdfh.exe	96
PID 4864 wrote to memory of 2856	4864	bsxcuwfhfdfh.exe	96
PID 4864 wrote to memory of 1704	4864	bsxcuwfhfdfh.exe	99
PID 4864 wrote to memory of 1704	4864	bsxcuwfhfdfh.exe	99
PID 4864 wrote to memory of 1704	4864	bsxcuwfhfdfh.exe	99
PID 4864 wrote to memory of 1892	4864	bsxcuwfhfdfh.exe	100
PID 4864 wrote to memory of 1892	4864	bsxcuwfhfdfh.exe	100
PID 1892 wrote to memory of 2376	1892	msedge.exe	101
PID 1892 wrote to memory of 2376	1892	msedge.exe	101
PID 4864 wrote to memory of 2980	4864	bsxcuwfhfdfh.exe	102
PID 4864 wrote to memory of 2980	4864	bsxcuwfhfdfh.exe	102
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104
PID 1892 wrote to memory of 3316	1892	msedge.exe	104

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

bsxcuwfhfdfh.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bsxcuwfhfdfh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	bsxcuwfhfdfh.exe

C:\Users\Admin\AppData\Local\Temp\b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b4c370efce46e7abfec0b147f3118b6e_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\bsxcuwfhfdfh.exe
    C:\Windows\bsxcuwfhfdfh.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\bsxcuwfhfdfh.exe
      C:\Windows\bsxcuwfhfdfh.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4864
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:1704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff93046f8,0x7ffff9304708,0x7ffff9304718
        6⤵
        
        PID:2376
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
        6⤵
        
        PID:3316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
        6⤵
        
        PID:4508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
        6⤵
        
        PID:1808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
        6⤵
        
        PID:1184
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:1528
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
        6⤵
        
        PID:1876
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
        6⤵
        
        PID:4660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
        6⤵
        
        PID:4552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
        6⤵
        
        PID:2168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
        6⤵
        
        PID:2980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,9667352701347814091,2813520320317049705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
        6⤵
        
        PID:5108
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\BSXCUW~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\B4C370~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+jstdm.html

Filesize
7KB

MD5
0c15035f77d0b3b9b8737188152f548f

SHA1
3f26643706e27a22b49d73e1a5d61ef543aced66

SHA256
0591499fd4eb507a184b86cdc7b49798db43007bf934330ab385ac466ba8b260

SHA512
7e768e4e40108dfd0bc7c620a86d072951ae61bad839dfc3f78e4604133879c61a25ce69a83edc2f0edaabb3925f66b2601e80211bfa89d5b11eeb056180ce56

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+jstdm.png

Filesize
63KB

MD5
8b1c74f637dba817a97c168f6a851b77

SHA1
5a1911a2db1b53447f99012f263c577abe5d4848

SHA256
b4647e87dbc56cf119de0ac53064e0a69d9fad5fe9a2e18dfa7c62ccae5ab14b

SHA512
4af2f5310f2fb14f82660196a8c58875aeb11b57dbd79224663ef05da204b945a2a14f84ff4140e92022b9831b61f9a2c86c827d33c90b6791794e0c4d6eaf6d

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+jstdm.txt

Filesize
1KB

MD5
e38675639fac11412fb93dc96b3b9ec0

SHA1
73977381479cbfd565a820450c889372dc1adc83

SHA256
a14864ad81240487901cf756fd28f6ed412ed7b12ca91933a8b5d9d1b958c1b8

SHA512
a49ec1c09b72e5f83efa9df66dfbc518c828d262e65a95ed4723aa1610ba3de7995d26cad27c963da8e5092e51a14f24704d745ddca5b0a10118722237ae08f0

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
e2fa48fd25db182d91036e74a3092280

SHA1
ad8e185811e02c6416ac03d8c80cc1a6362d0436

SHA256
cf4e5f1a0e9e9d8923d5ed1eea9c2db343fcd194f27b6cdbbea9a346431a907b

SHA512
5a1622deaf8a5f5ee1cb1eca5263a41b0d7d7ced4ee836d69603dd9fa29a8bd7fe02d8a207e0365160e5fb7e9cd0aca8437f8ad71fe63a94b829bed2cc0e73e6

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
aac9ee622c1819ba80f05cec151f0cc7

SHA1
bf49cd44e004491d54eb172e9f74de8b490cdfbd

SHA256
3ad887839a04d81a569c05c0b325a1d1a334d4c25d77d002a631ef6a46f5c7dd

SHA512
2471b45ead9659cfb3f2833ec9b37ec87e5f7d2caacc6fca18da364a20e8cebaf5f15a5a7dc96326562d04491c4c1306f16072bd0cdf5ea069c899ea858a17e2

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
bc77b25750ddc73a0e1c0f99d72f64cc

SHA1
1b6ced856dea87950a139ca8597c96936b7d68d7

SHA256
cd64443658ee79f33eed6d6b333ec5274a813fe2d961de27c76b1ad5492951a0

SHA512
d58490044eefe0b774137b4b88606c48026bbce4061514e1ec1a3d93c6057ddcf711a29a31c905fa47e22e2118dc8cf31d33cf38a2f9a8651b2abef8eaeae883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1d7d2902057874b8b8afd476dade05c

SHA1
491b83f22969742008bc83e4739661400ea56806

SHA256
7ffbf94683547175236aa16e376e393f44bd58772920caec95fb1e762a83bba4

SHA512
75da2e3ecfed04110b58544c4726693bf8dea4859e214d89fefddd45ae817e4c43de7d16d157c1340a0843c67e14623a46f71f885b23ddb55a4b25e46ea45e64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d53d444b1a3593a0f10e4a56f8f2352d

SHA1
ebd70e1b6b09207dfbefc71c163bde46c9a15805

SHA256
c55a8f1bb64cdac93d9560c694bbd530921a6f70089bafe8bf129d6dce0ac07d

SHA512
394d63d19fb3309132538e8123283a1acd30dc0f8e75e902717d1078d63e7f63d4d2a2ea9a0ab1e6886cfcdb12e9e1d811aedbf277fd72f96dd3999e660e6160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ed363b465de1ceda273d02184c2a8190

SHA1
2e5db555cabd2f4424b8a928becec14d7f62eace

SHA256
b954dcab054e7fff1d4c79011962e0a37fec7e050d61b516e3df15b5cb409264

SHA512
9062cabfcf74ed5c7a1ea0372e9a808afcf0bc69f227bb0915e60d6dc9b0609f101a1a7fa2255eb3fd0149a57e1d9a48dc4a6005e5a177a65294a99fac446dac

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662824772148.txt

Filesize
77KB

MD5
e2929f5cd5bc791d69d9db31c27e9243

SHA1
d6716e96fa514c6f64688f5ff2bf56239484c847

SHA256
a0e9d67509ff15216c002fc817fa4fccc32a82452561ca94e01919256a9da372

SHA512
9b5efd436f0716e9ad543307aa0487aebbc0d94966172ddeeb3416f9ba90ac268efdfed2d7ffd32bbe5e357010abd653adde28ab76eaff2136c53eadb2eee9a9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671764608349.txt

Filesize
74KB

MD5
61f15563b2202edb1ed17bb44b483316

SHA1
d8ba13f01d80535c13bc8c53479870d0f1698e50

SHA256
1645d8e634cf53656719d9efc64e24301ab81b00bb98e4b553e768c1e19ac1ad

SHA512
c00b75c0434f59d029689d4fccd160e5a5060d6e1f76f7fa83e19fee5ea0183029357617a89433916754eca1460e3989567e8f79d4bcda5dc368cbf3e168fd1b

Download Submit
C:\Windows\bsxcuwfhfdfh.exe

Filesize
376KB

MD5
b4c370efce46e7abfec0b147f3118b6e

SHA1
d08babb7e379e05f24270b005efd42c57834d6f1

SHA256
ce70e4c500aa39d8d43b1fc93909894c87b68843420b359f4017bec77292fa7d

SHA512
61573d888601dec15e2eae0777df7a15a5205f3af28c44349aa76f29d712f32d287dedb1187ca1121262b1f7715244bb4c31cc3e878728d77a28619a9207b30f

Download Submit
\??\pipe\LOCAL\crashpad_1892_OAKCWWHPXBHDUSMZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2364-1-0x0000000000C30000-0x0000000000C33000-memory.dmp

Filesize
12KB

Download
memory/2364-0-0x0000000000C30000-0x0000000000C33000-memory.dmp

Filesize
12KB

Download
memory/2364-5-0x0000000000C30000-0x0000000000C33000-memory.dmp

Filesize
12KB

Download
memory/2720-12-0x0000000000400000-0x00000000005EB000-memory.dmp

Filesize
1.9MB

Download
memory/2924-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2924-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2924-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2924-4-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2924-15-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-5075-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-2536-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-8544-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-10533-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-10534-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-10542-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-10544-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-2531-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-741-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-26-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-24-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-10585-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-21-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-20-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4864-19-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download