teslacrypt | d3aef7ccd94c55c75a19d3ac6e31ac4af1cfcdd64e77be9afc4e5c8de9301686

Analysis

max time kernel
146s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe
Size

396KB
MD5

b774e9f49d4aa8a2a009d06a6cdb6f8a
SHA1

5eaf1e24c495634ecbf7c81b640d10de8a3399d2
SHA256

d3aef7ccd94c55c75a19d3ac6e31ac4af1cfcdd64e77be9afc4e5c8de9301686
SHA512

b1cdb65dd44aefae7933944a824faac70b1fe68267e245a3a1181deda7b8cb9016e502550cd73974b3fd85756602193d4db8a23e9f3622d0ed5c59a780b1aecf
SSDEEP

6144:CT3WR0F1lDPR+bJnm/jtowhxZWVrfQwBcTMMG26uw6fyQ7Q:CT3MA+bJmy4ZKfQRMh6

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+qrkjg.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/219CC282FBE275E0 2. http://kkd47eh4hdjshb5t.angortra.at/219CC282FBE275E0 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/219CC282FBE275E0 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/219CC282FBE275E0 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/219CC282FBE275E0 http://kkd47eh4hdjshb5t.angortra.at/219CC282FBE275E0 http://ytrest84y5i456hghadefdsd.pontogrot.com/219CC282FBE275E0 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/219CC282FBE275E0

URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/219CC282FBE275E0

http://kkd47eh4hdjshb5t.angortra.at/219CC282FBE275E0

http://ytrest84y5i456hghadefdsd.pontogrot.com/219CC282FBE275E0

http://xlowfznrg4wf7dli.ONION/219CC282FBE275E0

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (884) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	lwdsingnnjus.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+qrkjg.html	lwdsingnnjus.exe

Executes dropped EXE 2 IoCs

pid	Process
2700	lwdsingnnjus.exe
1620	lwdsingnnjus.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ijwfgnrgcied = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\lwdsingnnjus.exe\""	lwdsingnnjus.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2600 set thread context of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2700 set thread context of 1620	2700	lwdsingnnjus.exe	95

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1949_24x24x32.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-400.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\Font\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Program Files\RestoreResume.xlsx	lwdsingnnjus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-60_altform-unplated.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W3.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\DirectionalDot.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\logo.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-256_altform-unplated.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-unplated_devicefamily-colorfulunplated.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxMetadata\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Toolkit\Images\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\THMBNAIL.PNG	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72_altform-unplated.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-125.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-100.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.scale-200.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageStoreLogo.scale-125_contrast-white.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\MilitaryRight.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\FreeCell.Large.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_File_Transfer_Complete.m4a	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNative\Tracing\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-48_altform-unplated.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-32_altform-unplated.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-20_contrast-black.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\Recovery+qrkjg.html	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-unplated.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-400.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8041_24x24x32.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-100.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-200.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak	lwdsingnnjus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\Recovery+qrkjg.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Error_Box.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Recovery+qrkjg.png	lwdsingnnjus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	lwdsingnnjus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated_contrast-high.png	lwdsingnnjus.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\lwdsingnnjus.exe	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe
File opened for modification	C:\Windows\lwdsingnnjus.exe	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lwdsingnnjus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lwdsingnnjus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	lwdsingnnjus.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
404	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe
1620	lwdsingnnjus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe
Token: SeDebugPrivilege	1620	lwdsingnnjus.exe
Token: SeIncreaseQuotaPrivilege	3244	WMIC.exe
Token: SeSecurityPrivilege	3244	WMIC.exe
Token: SeTakeOwnershipPrivilege	3244	WMIC.exe
Token: SeLoadDriverPrivilege	3244	WMIC.exe
Token: SeSystemProfilePrivilege	3244	WMIC.exe
Token: SeSystemtimePrivilege	3244	WMIC.exe
Token: SeProfSingleProcessPrivilege	3244	WMIC.exe
Token: SeIncBasePriorityPrivilege	3244	WMIC.exe
Token: SeCreatePagefilePrivilege	3244	WMIC.exe
Token: SeBackupPrivilege	3244	WMIC.exe
Token: SeRestorePrivilege	3244	WMIC.exe
Token: SeShutdownPrivilege	3244	WMIC.exe
Token: SeDebugPrivilege	3244	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3244	WMIC.exe
Token: SeRemoteShutdownPrivilege	3244	WMIC.exe
Token: SeUndockPrivilege	3244	WMIC.exe
Token: SeManageVolumePrivilege	3244	WMIC.exe
Token: 33	3244	WMIC.exe
Token: 34	3244	WMIC.exe
Token: 35	3244	WMIC.exe
Token: 36	3244	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1624	WMIC.exe
Token: SeSecurityPrivilege	1624	WMIC.exe
Token: SeTakeOwnershipPrivilege	1624	WMIC.exe
Token: SeLoadDriverPrivilege	1624	WMIC.exe
Token: SeSystemProfilePrivilege	1624	WMIC.exe
Token: SeSystemtimePrivilege	1624	WMIC.exe
Token: SeProfSingleProcessPrivilege	1624	WMIC.exe
Token: SeIncBasePriorityPrivilege	1624	WMIC.exe
Token: SeCreatePagefilePrivilege	1624	WMIC.exe
Token: SeBackupPrivilege	1624	WMIC.exe
Token: SeRestorePrivilege	1624	WMIC.exe
Token: SeShutdownPrivilege	1624	WMIC.exe
Token: SeDebugPrivilege	1624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1624	WMIC.exe
Token: SeRemoteShutdownPrivilege	1624	WMIC.exe
Token: SeUndockPrivilege	1624	WMIC.exe
Token: SeManageVolumePrivilege	1624	WMIC.exe
Token: 33	1624	WMIC.exe
Token: 34	1624	WMIC.exe
Token: 35	1624	WMIC.exe
Token: 36	1624	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2600 wrote to memory of 2380	2600	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	90
PID 2380 wrote to memory of 2700	2380	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	91
PID 2380 wrote to memory of 2700	2380	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	91
PID 2380 wrote to memory of 2700	2380	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	91
PID 2380 wrote to memory of 3500	2380	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	92
PID 2380 wrote to memory of 3500	2380	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	92
PID 2380 wrote to memory of 3500	2380	b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe	92
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 2700 wrote to memory of 1620	2700	lwdsingnnjus.exe	95
PID 1620 wrote to memory of 3244	1620	lwdsingnnjus.exe	96
PID 1620 wrote to memory of 3244	1620	lwdsingnnjus.exe	96
PID 1620 wrote to memory of 404	1620	lwdsingnnjus.exe	99
PID 1620 wrote to memory of 404	1620	lwdsingnnjus.exe	99
PID 1620 wrote to memory of 404	1620	lwdsingnnjus.exe	99
PID 1620 wrote to memory of 2400	1620	lwdsingnnjus.exe	100
PID 1620 wrote to memory of 2400	1620	lwdsingnnjus.exe	100
PID 2400 wrote to memory of 3452	2400	msedge.exe	101
PID 2400 wrote to memory of 3452	2400	msedge.exe	101
PID 1620 wrote to memory of 1624	1620	lwdsingnnjus.exe	102
PID 1620 wrote to memory of 1624	1620	lwdsingnnjus.exe	102
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104
PID 2400 wrote to memory of 2328	2400	msedge.exe	104

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	lwdsingnnjus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lwdsingnnjus.exe

C:\Users\Admin\AppData\Local\Temp\b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b774e9f49d4aa8a2a009d06a6cdb6f8a_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\lwdsingnnjus.exe
    C:\Windows\lwdsingnnjus.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\lwdsingnnjus.exe
      C:\Windows\lwdsingnnjus.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1620
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3244
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf36246f8,0x7ffbf3624708,0x7ffbf3624718
        6⤵
        
        PID:3452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
        6⤵
        
        PID:2328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
        6⤵
        
        PID:5020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
        6⤵
        
        PID:436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
        6⤵
        
        PID:3076
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
        6⤵
        
        PID:5108
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
        6⤵
        
        PID:1684
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
        6⤵
        
        PID:3116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
        6⤵
        
        PID:3732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
        6⤵
        
        PID:4416
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
        6⤵
        
        PID:3964
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3234327328181271201,5551892473867487221,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
        6⤵
        
        PID:2036
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\LWDSIN~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\B774E9~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+qrkjg.html

Filesize
9KB

MD5
76154f30b870155766c40984f0be8a67

SHA1
7edb4b63bd0482465d8b466e6edfed7a42850ce3

SHA256
7945fcbdfef31b6d9b2cafae34fc5eef6f03cee53a882eef396c1e4778d25871

SHA512
ed3df1c18468edb72b73026971dbd581e030469f9399d46b84fb6bff2c089257d1614975d4c74130369ad518a0cb5e3533ef381a5a6887596647d420de5de886

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+qrkjg.png

Filesize
63KB

MD5
81abb361f0a8da6805cc2bb2c3d15ac7

SHA1
e9952b9d02f035d2ecf4602b962cb9e9073f22bb

SHA256
99f779deb9493f04adca641740ab1e25571ce936bc2187f924a411343a8627a3

SHA512
f0bafaf698decaf03ff48bf3bfe5fb37d1e961ef1970054930d70e415b2bbe805c466e56af6b7b36eedcacdbdd958b02aff8b04cf414ad66d4adbd0bfa87d2ff

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+qrkjg.txt

Filesize
1KB

MD5
df3c40e6e7f8caf69047615351a66771

SHA1
eb4641df826c8f061e2bb834f9ae64f15c4e1c5b

SHA256
0aeb8a61b43a14199d40a514360812ca137cfd5a4d82a09966a605ae3b47ee8b

SHA512
7fac1b6d4608ad91ce6c3efef72f47e2b44f54aa5fe9071c23be34e6c36eb4e951c13b0ff34494cf2eff97dd4f2055400011b841ef87938518bba9c3fa8ffa20

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
36f9b587e4bced3ae6eef46529d96326

SHA1
c3851c317695584a521407f37968d493dfb230e9

SHA256
269cae87663b58a5f95063b14b7e21576255397c2c3868f356d0ce0562696236

SHA512
0bdca9dea8d8a6421ab22bc3412c193840826d922d1ff861eae298b055f166f89b426c6f646ec7b47e8b7c8f1ed8234407c892b4d104e44bf8b74e81ba605eb5

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
cec0996f5329c303aae7c5cf4c4b0dab

SHA1
ea8445210793fdf0aee78ed3cc47e4f19a1a91e8

SHA256
6e4ea9e7ed46127229a7ba051b3fe0314e0157729c725494d4ed7516c11967a9

SHA512
0867230cfe693fd1dfd853e02bd4285dddb945f35c9d386ae110c98a12ca10bff9a937ea4f97483e489b252e29b0dac819a7ce29c657dd540716c0ea6bd24b59

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
caa84f46cf47136a6325f0ae41d1974d

SHA1
b02da630c4051fbae3323e727fb180b277026703

SHA256
dc2888b42be045527d3abd99657a55bba0f040b402241dac49ba2f6eef88244a

SHA512
8eee7513dc1a6343ad8db030a459c82c690efa0a8894fa0100415a5a3641623515adf93de9f57e8c210f360e44fb3ea83796b5f6ca4c4ba921176d661d4402ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0c479d2c0755957c21ab5d80a23e62bd

SHA1
c3e3f6c555965594d6d05440c988608e7d8f3158

SHA256
bd01845846b24ea003b74161cf6d30ec71ca684a799728add26ca455e795a538

SHA512
0c259828e2267d0e834e31d8800ea1dd546d9def0de7de72b01e63c7b989801db1d9715dc70dd3c45f66e5e01443755773b501deaa9fafde5da72af9bd0faa5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40784c1fec709534df269685a9a0c40d

SHA1
242cf8f2cecf8546538eda3a5c69687450289a97

SHA256
04748cb63bd74bbb68724b0ca45ec6f231d08ab6ba976fc14fb30de9acc0fd82

SHA512
f9ace73e58b2830f52ad1a1440754a3cd9f8dd8b6154bb0097ddf0cf2ad51885a8e34d8d196fa06deebc625b7d833b5916bb38c4dca1ad7aa54eff0dcda59fec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
97e290f1e69d5a337554179db840db33

SHA1
a81e0b252ded8cc14c9d274472ca7f34e947bfd6

SHA256
1e0616e0a889bf2fbacc96c23bd54c82da1228b2cb35041d2086e0e872e30c2d

SHA512
6a02ebb86c711316dfe9b75e50305f9c6a733a624e8626c123b707b665c82e492ddfaf9fafb3dbfe86b2ffccc68b75256204cd12a210ae292a09b8e65abc7dfb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662824772148.txt

Filesize
77KB

MD5
72f4771d212aa4a7ad975e126f894bbe

SHA1
2a1f08b89919f3ae7ce65fa9f7eeb876f4c9a405

SHA256
fa665f8e01a2a12c9b610fb9d5dea83ea6d4bba1e44a2b0db8ffc1b8429eeca2

SHA512
96c802ea71adc067d343cc42a0b7e76f248bc79ddeba6bf2138a9f6d15efb778ca087f6a207a05f35871aee1863da375ab1c3bc5b73fe25aa7c48faad1a37c2d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671764608349.txt

Filesize
74KB

MD5
a93c31e96ac886df69a1536ae38285e6

SHA1
da2e66f4339575eacfff44f3d7f754279abf4130

SHA256
94a025f0ddbbd1be3ad29381109f011231df9a50ef8e75b2f289652906b0f5f8

SHA512
4a8e2f28f187ae74645a8a1eb443bded0ee8b66c430559f5b94f2022b7b96ec4646051266b7ecc3398d0ac4ec63fa0b996d5512919ed5084f6beb5936d7a18ff

Download Submit
C:\Windows\lwdsingnnjus.exe

Filesize
396KB

MD5
b774e9f49d4aa8a2a009d06a6cdb6f8a

SHA1
5eaf1e24c495634ecbf7c81b640d10de8a3399d2

SHA256
d3aef7ccd94c55c75a19d3ac6e31ac4af1cfcdd64e77be9afc4e5c8de9301686

SHA512
b1cdb65dd44aefae7933944a824faac70b1fe68267e245a3a1181deda7b8cb9016e502550cd73974b3fd85756602193d4db8a23e9f3622d0ed5c59a780b1aecf

Download Submit
memory/1620-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-10559-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-25-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-773-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-20-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-2772-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-2778-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-5264-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-10610-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-10569-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-8504-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-24-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-10560-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1620-10568-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2380-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2380-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2380-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2380-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2380-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2600-4-0x00000000007E0000-0x00000000007E3000-memory.dmp

Filesize
12KB

Download
memory/2600-0-0x00000000007E0000-0x00000000007E3000-memory.dmp

Filesize
12KB

Download
memory/2600-1-0x00000000007E0000-0x00000000007E3000-memory.dmp

Filesize
12KB

Download
memory/2700-12-0x0000000000400000-0x0000000000620000-memory.dmp

Filesize
2.1MB

Download