teslacrypt | ba1409d897af7db9224c5fa45cffdf6e38cb724ce08052f4aad34596e1d24458

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe
Size

424KB
MD5

d19e3bd15c6594a56d81d92831dadbd2
SHA1

99ba265f63c21cc992adb8a6d86c4cf3a4cb284d
SHA256

ba1409d897af7db9224c5fa45cffdf6e38cb724ce08052f4aad34596e1d24458
SHA512

8faaaa2142cdf0730965fd2c883980f88a0a4b0a05ac662950874ce48bf0de034a3e6d69a4a2fd8bf20a75a6c8b2e829b6ad033900f6c5c17f60dec643f4f16b
SSDEEP

12288:3mJqaEwQLysD/XDz3qzRdW1DzHpblCJxfS6:3gMLyWDbkElOR1

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_RECoVERY_+ksgot.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/FB689ABDB81715EE 2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/FB689ABDB81715EE 3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/FB689ABDB81715EE If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/FB689ABDB81715EE 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/FB689ABDB81715EE http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/FB689ABDB81715EE http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/FB689ABDB81715EE *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/FB689ABDB81715EE

URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/FB689ABDB81715EE

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/FB689ABDB81715EE

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/FB689ABDB81715EE

http://xlowfznrg4wf7dli.ONION/FB689ABDB81715EE

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (874) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	itkesdwwgfmi.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+ksgot.html	itkesdwwgfmi.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+ksgot.html	itkesdwwgfmi.exe

Executes dropped EXE 1 IoCs

pid	Process
4376	itkesdwwgfmi.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aflwmbkxjxpa = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\itkesdwwgfmi.exe\""	itkesdwwgfmi.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\AppxMetadata\_RECoVERY_+ksgot.html	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_RECoVERY_+ksgot.html	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-white_scale-200.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-400.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-400.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black_devicefamily-colorfulunplated.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fr\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-180.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\_RECoVERY_+ksgot.html	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-latn-cs\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-100.HCWhite.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.contrast-black_scale-100.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\FlatFreehand3D.mp4	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\_RECoVERY_+ksgot.html	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_altform-unplated_contrast-white.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-100.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-125.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\moe_default_icon.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Resources\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-100.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-80.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-150.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-400.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\office.js	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-unplated.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailSmallTile.scale-125.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\_RECoVERY_+ksgot.html	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-125_contrast-white.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Schema\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-125_contrast-white.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_contrast-white.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-20_altform-lightunplated.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-200.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\en-US\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ms-MY\View3d\_RECoVERY_+ksgot.html	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x86\_RECoVERY_+ksgot.txt	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\_RECoVERY_+ksgot.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-200.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200_contrast-black.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Fonts\_RECoVERY_+ksgot.html	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-high.png	itkesdwwgfmi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png	itkesdwwgfmi.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\itkesdwwgfmi.exe	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe
File opened for modification	C:\Windows\itkesdwwgfmi.exe	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	itkesdwwgfmi.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	itkesdwwgfmi.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4584	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe
4376	itkesdwwgfmi.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe
Token: SeDebugPrivilege	4376	itkesdwwgfmi.exe
Token: SeIncreaseQuotaPrivilege	2160	WMIC.exe
Token: SeSecurityPrivilege	2160	WMIC.exe
Token: SeTakeOwnershipPrivilege	2160	WMIC.exe
Token: SeLoadDriverPrivilege	2160	WMIC.exe
Token: SeSystemProfilePrivilege	2160	WMIC.exe
Token: SeSystemtimePrivilege	2160	WMIC.exe
Token: SeProfSingleProcessPrivilege	2160	WMIC.exe
Token: SeIncBasePriorityPrivilege	2160	WMIC.exe
Token: SeCreatePagefilePrivilege	2160	WMIC.exe
Token: SeBackupPrivilege	2160	WMIC.exe
Token: SeRestorePrivilege	2160	WMIC.exe
Token: SeShutdownPrivilege	2160	WMIC.exe
Token: SeDebugPrivilege	2160	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2160	WMIC.exe
Token: SeRemoteShutdownPrivilege	2160	WMIC.exe
Token: SeUndockPrivilege	2160	WMIC.exe
Token: SeManageVolumePrivilege	2160	WMIC.exe
Token: 33	2160	WMIC.exe
Token: 34	2160	WMIC.exe
Token: 35	2160	WMIC.exe
Token: 36	2160	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2160	WMIC.exe
Token: SeSecurityPrivilege	2160	WMIC.exe
Token: SeTakeOwnershipPrivilege	2160	WMIC.exe
Token: SeLoadDriverPrivilege	2160	WMIC.exe
Token: SeSystemProfilePrivilege	2160	WMIC.exe
Token: SeSystemtimePrivilege	2160	WMIC.exe
Token: SeProfSingleProcessPrivilege	2160	WMIC.exe
Token: SeIncBasePriorityPrivilege	2160	WMIC.exe
Token: SeCreatePagefilePrivilege	2160	WMIC.exe
Token: SeBackupPrivilege	2160	WMIC.exe
Token: SeRestorePrivilege	2160	WMIC.exe
Token: SeShutdownPrivilege	2160	WMIC.exe
Token: SeDebugPrivilege	2160	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2160	WMIC.exe
Token: SeRemoteShutdownPrivilege	2160	WMIC.exe
Token: SeUndockPrivilege	2160	WMIC.exe
Token: SeManageVolumePrivilege	2160	WMIC.exe
Token: 33	2160	WMIC.exe
Token: 34	2160	WMIC.exe
Token: 35	2160	WMIC.exe
Token: 36	2160	WMIC.exe
Token: SeBackupPrivilege	2520	vssvc.exe
Token: SeRestorePrivilege	2520	vssvc.exe
Token: SeAuditPrivilege	2520	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1164	WMIC.exe
Token: SeSecurityPrivilege	1164	WMIC.exe
Token: SeTakeOwnershipPrivilege	1164	WMIC.exe
Token: SeLoadDriverPrivilege	1164	WMIC.exe
Token: SeSystemProfilePrivilege	1164	WMIC.exe
Token: SeSystemtimePrivilege	1164	WMIC.exe
Token: SeProfSingleProcessPrivilege	1164	WMIC.exe
Token: SeIncBasePriorityPrivilege	1164	WMIC.exe
Token: SeCreatePagefilePrivilege	1164	WMIC.exe
Token: SeBackupPrivilege	1164	WMIC.exe
Token: SeRestorePrivilege	1164	WMIC.exe
Token: SeShutdownPrivilege	1164	WMIC.exe
Token: SeDebugPrivilege	1164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1164	WMIC.exe
Token: SeRemoteShutdownPrivilege	1164	WMIC.exe
Token: SeUndockPrivilege	1164	WMIC.exe
Token: SeManageVolumePrivilege	1164	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4376	2816	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe	83
PID 2816 wrote to memory of 4376	2816	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe	83
PID 2816 wrote to memory of 4376	2816	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe	83
PID 2816 wrote to memory of 2108	2816	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe	84
PID 2816 wrote to memory of 2108	2816	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe	84
PID 2816 wrote to memory of 2108	2816	d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe	84
PID 4376 wrote to memory of 2160	4376	itkesdwwgfmi.exe	86
PID 4376 wrote to memory of 2160	4376	itkesdwwgfmi.exe	86
PID 4376 wrote to memory of 4584	4376	itkesdwwgfmi.exe	106
PID 4376 wrote to memory of 4584	4376	itkesdwwgfmi.exe	106
PID 4376 wrote to memory of 4584	4376	itkesdwwgfmi.exe	106
PID 4376 wrote to memory of 4284	4376	itkesdwwgfmi.exe	107
PID 4376 wrote to memory of 4284	4376	itkesdwwgfmi.exe	107
PID 4284 wrote to memory of 4404	4284	msedge.exe	108
PID 4284 wrote to memory of 4404	4284	msedge.exe	108
PID 4376 wrote to memory of 1164	4376	itkesdwwgfmi.exe	109
PID 4376 wrote to memory of 1164	4376	itkesdwwgfmi.exe	109
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 2808	4284	msedge.exe	111
PID 4284 wrote to memory of 3656	4284	msedge.exe	112
PID 4284 wrote to memory of 3656	4284	msedge.exe	112
PID 4284 wrote to memory of 3400	4284	msedge.exe	113
PID 4284 wrote to memory of 3400	4284	msedge.exe	113
PID 4284 wrote to memory of 3400	4284	msedge.exe	113
PID 4284 wrote to memory of 3400	4284	msedge.exe	113
PID 4284 wrote to memory of 3400	4284	msedge.exe	113

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	itkesdwwgfmi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	itkesdwwgfmi.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d19e3bd15c6594a56d81d92831dadbd2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\itkesdwwgfmi.exe
  C:\Windows\itkesdwwgfmi.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4376
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa12f546f8,0x7ffa12f54708,0x7ffa12f54718
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3588542363579891254,9860249854380651771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:3004
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\ITKESD~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\D19E3B~1.EXE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2108

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_RECoVERY_+ksgot.html

Filesize
11KB

MD5
1137a73dc08b86c2e517fbe8507082fe

SHA1
ed16917a4646b8c83fedab3c156a47342ff96f69

SHA256
00f2f47d9171bb87b9df385c616ea1c3836880989a7e916ae703265c650455b9

SHA512
83c95db769a334cf090e9075c8c08e26e40e57723a4a57e661f3af614b68f33fec7ec813762cd9b4ced0e8ae8408dbe6ddb55ec1ba59af32c0dbbe8ab016ca67

Download Submit
C:\Program Files\7-Zip\Lang\_RECoVERY_+ksgot.png

Filesize
64KB

MD5
88e627d2e62034205e695d05e1b0def4

SHA1
29fd3138d985deca0571fd45a955cdf68c0916e9

SHA256
00e8b3ba7f45107f538d6eeacf766a7236373d3b0d5e526c9d7e9867996a9bee

SHA512
05b9ef1128f53b31bac1fc7f879c5d44914cc6d2848a27d1ad962771bbf6a68730df581979a754463fc369c7ed789a89c369baeaefeec284f488284e7421c9fb

Download Submit
C:\Program Files\7-Zip\Lang\_RECoVERY_+ksgot.txt

Filesize
1KB

MD5
374b72c04e9374f8314c2652cc4b06af

SHA1
1e3f5c086a01d1b4717345282a6b399a3772ac1d

SHA256
7e75c9e8a2f429f7b37bb6a00c28046b538d15b93dd7b48d088e9fe95c56eef6

SHA512
77c4a6a8f9d6da604c6747102ca244817d213ae6f29a6e3e8e96eff0c9d48ed524af8bd4ee1df7886870cf8afe29c590d2e1c306b6193d50725b706ae50bf0fa

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
75e212c7bf1be118647305916a92cebc

SHA1
85b10849349f6b7a5f61e2cf93e1cafea0ea1b4b

SHA256
e64cd5539a9d017e6f4794270cd04c0cee27f37e71af95357090fcded63c432e

SHA512
c60b7299b3f9a4e339243e1b9c51bf5c3a1e8a9d367ec20865b0df633d494791817ea5a7e6096ca07cff4e3c64662b733df4ab6b3d50f6a8b60335c9e36da752

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
73cce1e510871c4d9423a5e5dd51411c

SHA1
e020340ccc7ee80f50a64959bf4d3b2686292c93

SHA256
122b0c6eb9e5e1d7cf8f3be6b67c7080a32db1537b484240bbc8476c2613da53

SHA512
023a85891e73716b24936394f750ca16887cb8a5eee7ff55cf30c04ec8dd66f0776b7473c705e64be58e609b62aca4df4ba55e04740cefc6985592fb5a5e14f6

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
11dd7e1ec528ac3904ec361a884e8c25

SHA1
f63d33bef64d3580fe43faa14c75519c91eb6d96

SHA256
76706b480d66bf74b995e9eaaeff89225de13fe6f67492f11783fe32068a6f39

SHA512
b6a284b9563fad28b5cccfe6fa6a16ee00f37642e8855311e496fbecbc0868cab226f95cfeebeabe6bd4de651dd4d89f3dbb7a0c4d5b597f9010cd131cf1749f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af0491275638a5115ea609b73c9e6dff

SHA1
0354598963bc1ae68d66699cc2d97b7c3e71083f

SHA256
f26f69b3c3a530ce10979545a456d85bda000b9e74c418297329bc175c8f6c7e

SHA512
9a2129426aabc9c7d63887e6725529d9b98db261928b75608291b71a9734a7e109eb52815135fff7b3dfe0f27d7e1b156bc2890bce0e0dd194f719ecb8e50d79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cba4d11a7cf53e8ad8df3372355a1711

SHA1
41dfe4d0fb74dabd2ff178840b000fb54126e193

SHA256
3bea02309290e3a288d0ecf90e09935904b95e3c9348a3c757f80bfce049e61e

SHA512
f5fba5ba6ef2ec1cac6e04f4a3e034316c8baede91bf74a9b1d97be519c836a846ab07ec95484987fd147a653e461b3de08aeb5147cf3fc9c12a76e419e9cfa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2be0176a41c85e211af6aaa2a3e2104c

SHA1
82d2dcfd245e98ebf002dc7a8c9508ff8f212137

SHA256
a71d7bff4886f69164ff737354118664cb987ee19bd79c14a441b308f2821e72

SHA512
7a1cdeb191c08ab604b5bcc26d1b780a0262ea39e6c0f06bc731c3cf63bd0495dc36b63966ded6df6b18b89c551882b37a7141fefb196bc68e0abb4a4df09835

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656298443196.txt

Filesize
77KB

MD5
5ef9f0a5920290642500d875ca18b706

SHA1
28bce8f4344c308e442dec95a2ce6bc3c85c641b

SHA256
ec78a75570f4d7ff519742367a8a6adb7629adbf4fe85e85475e6f7fc9d7e4fa

SHA512
b91d62c4ecf8cdb08fcffb1ddf36501d6d9f8c7b88c3282b974b0a51f0a8370dfd8b456dbf3490f71378c5a55062949403119e80553c98b34ce3d44d13968187

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727657999741523.txt

Filesize
47KB

MD5
2dbcdb6a00529175d449d8f705661a6b

SHA1
03a9db912f34556a5e6806aa93430d0de2048fdf

SHA256
181b96b6f38959d4bf0dde663838e8beb94da43e52da0c984d8304b6dc4d1770

SHA512
5a1a0d206bf8478e628494124ff08ca65856822b22e694ea719a0cb6c933346cb838c185757d79f7c47e4f4b7b85c0a290138fff6f56525c589827ed5b74b5b1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666039184869.txt

Filesize
74KB

MD5
3defaad57f66391f284db48e0ff4300d

SHA1
eeea2994304ed1932186a99228fffd202fb037c0

SHA256
5b23a4d8d8b568b626de9464e6a981bf2427ee0a7e3f7abe38195e38a404b210

SHA512
d1e5f252dfd3a164c7f18db8dc70d8cc04a42f673cfeb7f9730aa5b1877c269d5176e7340196611d6c1936ff4b49c2e5dcfb29f1356a5be05d143bd7ae32e300

Download Submit
C:\Windows\itkesdwwgfmi.exe

Filesize
424KB

MD5
d19e3bd15c6594a56d81d92831dadbd2

SHA1
99ba265f63c21cc992adb8a6d86c4cf3a4cb284d

SHA256
ba1409d897af7db9224c5fa45cffdf6e38cb724ce08052f4aad34596e1d24458

SHA512
8faaaa2142cdf0730965fd2c883980f88a0a4b0a05ac662950874ce48bf0de034a3e6d69a4a2fd8bf20a75a6c8b2e829b6ad033900f6c5c17f60dec643f4f16b

Download Submit
memory/2816-0-0x0000000002260000-0x00000000022E5000-memory.dmp

Filesize
532KB

Download
memory/2816-9-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2816-10-0x0000000002260000-0x00000000022E5000-memory.dmp

Filesize
532KB

Download
memory/2816-2-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4376-5222-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4376-8275-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4376-10738-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4376-2575-0x0000000000970000-0x00000000009F5000-memory.dmp

Filesize
532KB

Download
memory/4376-2565-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4376-11-0x0000000000970000-0x00000000009F5000-memory.dmp

Filesize
532KB

Download
memory/4376-10785-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download