teslacrypt | 4a015db95a1e6db8123e4b21dfe56e34fabf570261b6d2a0a11c0abb282a3363

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe
Size

424KB
MD5

d818966749acd83dc9fa5d73d5a47f2e
SHA1

4c3a30cd2c8c396ff90aa4ebcba63d89a9cfce50
SHA256

4a015db95a1e6db8123e4b21dfe56e34fabf570261b6d2a0a11c0abb282a3363
SHA512

1fde3f7a05b877184a4676db15e6c4ae6efb8847dacb4226887b9f67097996e0533e2eb7b7aab11d3cbe902f8abc7b75ab4981e2b4cd115051c4a89d2d9fc446
SSDEEP

6144:BsPAYJDo2magV+8GUEmGM41DwAHQmjdN1AUL0yogLpWPoXbftChXW3AxfulDGgB:ep808fEmLqDwAJjpA+E+blCJxfS6

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_RECoVERY_+bkkla.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/B6259594299A48D2 2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/B6259594299A48D2 3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/B6259594299A48D2 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/B6259594299A48D2 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/B6259594299A48D2 http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/B6259594299A48D2 http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/B6259594299A48D2 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/B6259594299A48D2

URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/B6259594299A48D2

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/B6259594299A48D2

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/B6259594299A48D2

http://xlowfznrg4wf7dli.ONION/B6259594299A48D2

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (873) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	onyqeknrtavl.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+bkkla.html	onyqeknrtavl.exe

Executes dropped EXE 1 IoCs

pid	Process
3488	onyqeknrtavl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xirutnwhohli = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\onyqeknrtavl.exe\""	onyqeknrtavl.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\82.jpg	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_scale-125.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxMetadata\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ko\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_DogEar.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\OrientationControlInnerCircle.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\it-IT\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\PreviewMailList.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-100.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PlaylistMediumTile.scale-100.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteSmallTile.scale-200.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\_Resources\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-150.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\xaml\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\smsconnect\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-100.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\ja-JP\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lo-LA\View3d\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-48.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-400.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-24_altform-unplated.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GameBar_WideTile.scale-125.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\7-Zip\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-125_contrast-white.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\170.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_RECoVERY_+bkkla.html	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\DialRotation.mp4	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.scale-400.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Config\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileSmallSquare.scale-100.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-20_altform-unplated_contrast-black.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\_RECoVERY_+bkkla.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-200_contrast-white.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Resources\_RECoVERY_+bkkla.txt	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-100.png	onyqeknrtavl.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer10Sec.targetsize-32.png	onyqeknrtavl.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\onyqeknrtavl.exe	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe
File opened for modification	C:\Windows\onyqeknrtavl.exe	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	onyqeknrtavl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	onyqeknrtavl.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4528	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe
3488	onyqeknrtavl.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe
Token: SeDebugPrivilege	3488	onyqeknrtavl.exe
Token: SeIncreaseQuotaPrivilege	3508	WMIC.exe
Token: SeSecurityPrivilege	3508	WMIC.exe
Token: SeTakeOwnershipPrivilege	3508	WMIC.exe
Token: SeLoadDriverPrivilege	3508	WMIC.exe
Token: SeSystemProfilePrivilege	3508	WMIC.exe
Token: SeSystemtimePrivilege	3508	WMIC.exe
Token: SeProfSingleProcessPrivilege	3508	WMIC.exe
Token: SeIncBasePriorityPrivilege	3508	WMIC.exe
Token: SeCreatePagefilePrivilege	3508	WMIC.exe
Token: SeBackupPrivilege	3508	WMIC.exe
Token: SeRestorePrivilege	3508	WMIC.exe
Token: SeShutdownPrivilege	3508	WMIC.exe
Token: SeDebugPrivilege	3508	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3508	WMIC.exe
Token: SeRemoteShutdownPrivilege	3508	WMIC.exe
Token: SeUndockPrivilege	3508	WMIC.exe
Token: SeManageVolumePrivilege	3508	WMIC.exe
Token: 33	3508	WMIC.exe
Token: 34	3508	WMIC.exe
Token: 35	3508	WMIC.exe
Token: 36	3508	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3508	WMIC.exe
Token: SeSecurityPrivilege	3508	WMIC.exe
Token: SeTakeOwnershipPrivilege	3508	WMIC.exe
Token: SeLoadDriverPrivilege	3508	WMIC.exe
Token: SeSystemProfilePrivilege	3508	WMIC.exe
Token: SeSystemtimePrivilege	3508	WMIC.exe
Token: SeProfSingleProcessPrivilege	3508	WMIC.exe
Token: SeIncBasePriorityPrivilege	3508	WMIC.exe
Token: SeCreatePagefilePrivilege	3508	WMIC.exe
Token: SeBackupPrivilege	3508	WMIC.exe
Token: SeRestorePrivilege	3508	WMIC.exe
Token: SeShutdownPrivilege	3508	WMIC.exe
Token: SeDebugPrivilege	3508	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3508	WMIC.exe
Token: SeRemoteShutdownPrivilege	3508	WMIC.exe
Token: SeUndockPrivilege	3508	WMIC.exe
Token: SeManageVolumePrivilege	3508	WMIC.exe
Token: 33	3508	WMIC.exe
Token: 34	3508	WMIC.exe
Token: 35	3508	WMIC.exe
Token: 36	3508	WMIC.exe
Token: SeBackupPrivilege	3032	vssvc.exe
Token: SeRestorePrivilege	3032	vssvc.exe
Token: SeAuditPrivilege	3032	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4524	WMIC.exe
Token: SeSecurityPrivilege	4524	WMIC.exe
Token: SeTakeOwnershipPrivilege	4524	WMIC.exe
Token: SeLoadDriverPrivilege	4524	WMIC.exe
Token: SeSystemProfilePrivilege	4524	WMIC.exe
Token: SeSystemtimePrivilege	4524	WMIC.exe
Token: SeProfSingleProcessPrivilege	4524	WMIC.exe
Token: SeIncBasePriorityPrivilege	4524	WMIC.exe
Token: SeCreatePagefilePrivilege	4524	WMIC.exe
Token: SeBackupPrivilege	4524	WMIC.exe
Token: SeRestorePrivilege	4524	WMIC.exe
Token: SeShutdownPrivilege	4524	WMIC.exe
Token: SeDebugPrivilege	4524	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4524	WMIC.exe
Token: SeRemoteShutdownPrivilege	4524	WMIC.exe
Token: SeUndockPrivilege	4524	WMIC.exe
Token: SeManageVolumePrivilege	4524	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3488	4620	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe	82
PID 4620 wrote to memory of 3488	4620	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe	82
PID 4620 wrote to memory of 3488	4620	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe	82
PID 4620 wrote to memory of 4836	4620	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe	83
PID 4620 wrote to memory of 4836	4620	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe	83
PID 4620 wrote to memory of 4836	4620	d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe	83
PID 3488 wrote to memory of 3508	3488	onyqeknrtavl.exe	85
PID 3488 wrote to memory of 3508	3488	onyqeknrtavl.exe	85
PID 3488 wrote to memory of 4528	3488	onyqeknrtavl.exe	99
PID 3488 wrote to memory of 4528	3488	onyqeknrtavl.exe	99
PID 3488 wrote to memory of 4528	3488	onyqeknrtavl.exe	99
PID 3488 wrote to memory of 1128	3488	onyqeknrtavl.exe	100
PID 3488 wrote to memory of 1128	3488	onyqeknrtavl.exe	100
PID 1128 wrote to memory of 1504	1128	msedge.exe	101
PID 1128 wrote to memory of 1504	1128	msedge.exe	101
PID 3488 wrote to memory of 4524	3488	onyqeknrtavl.exe	102
PID 3488 wrote to memory of 4524	3488	onyqeknrtavl.exe	102
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 2984	1128	msedge.exe	104
PID 1128 wrote to memory of 3404	1128	msedge.exe	105
PID 1128 wrote to memory of 3404	1128	msedge.exe	105
PID 1128 wrote to memory of 4776	1128	msedge.exe	106
PID 1128 wrote to memory of 4776	1128	msedge.exe	106
PID 1128 wrote to memory of 4776	1128	msedge.exe	106
PID 1128 wrote to memory of 4776	1128	msedge.exe	106
PID 1128 wrote to memory of 4776	1128	msedge.exe	106

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	onyqeknrtavl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	onyqeknrtavl.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d818966749acd83dc9fa5d73d5a47f2e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\onyqeknrtavl.exe
  C:\Windows\onyqeknrtavl.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3488
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbab9e46f8,0x7ffbab9e4708,0x7ffbab9e4718
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9639941618621450764,17778136690278525281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:404
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\ONYQEK~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\D81896~1.EXE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_RECoVERY_+bkkla.html

Filesize
11KB

MD5
300b772e7d094c8d08b4c3d335590571

SHA1
513317b5ffb2b4c165115ae0948cb184626766c5

SHA256
880689afa68b8c54507b3abe6af487b595a4f167916b83ec47863c0e02dffdeb

SHA512
7d3f7d07dd02fa9ab7c556a6b70f9544ce142c14873fae65b6f57b405397a3f5bfb8967bc2f5e06b3eec8f324ccbbb2c54400f3aeacff041dae9035c4afce726

Download Submit
C:\Program Files\7-Zip\Lang\_RECoVERY_+bkkla.png

Filesize
64KB

MD5
792964f9f717454e16906ace63db972d

SHA1
e50cfe6e6c72f0a4cc8bae3740dc67184ca82624

SHA256
498d90ddd7e84fae4976d64597b565d25c74890571a99e2f10869708575f9b9d

SHA512
035947a473a955a57abada84c0fcdf85d452260d1fdc6e7512710f8454a3b49a8858b316b718e8b76337b7c9f10cdb371516efd73e75329f7ad8d110cd7a6ffb

Download Submit
C:\Program Files\7-Zip\Lang\_RECoVERY_+bkkla.txt

Filesize
1KB

MD5
6c6fb781bfab86f19ec662f1afcb7da3

SHA1
9db1aadb2e2ee62557b3cb2a2d5ba3b89ee36176

SHA256
6be6c375bc65361934b91202fe8bcdb27023f5607fb5044a4a2e4c35227473f7

SHA512
85258e23459048669d74585c9a0314a6be9e9fd3305b87e54ea7724e7992c904192293d8f6f3a736fa1d819faf79ffc036c38a60f5a7036a4fb0d861a77ea98b

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
f7d2d7c21a8404732f5695d4fda77795

SHA1
cdef187d3b6f121d8bbe8b772e9f19fee1dd39a1

SHA256
4f7da352dcc2fa0936347a5d8585f505ce7bf7080923496a9c009e371483a7e1

SHA512
95ca1505ae270c9c1fc493d49585424252504234a53e077e66afeab1ddba18d5ceff76a8fb74c52684ca3b9f2843b0f68c34024df09fd72665ac05cbf11eab32

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
bb03c8647c27ec5d87ff57e0c6f6dc71

SHA1
888c0b0c1931de870329bcaa0d45f75e3c3b9fb2

SHA256
c03ad78193e7f180e894d4df0a5f71150ff13121e39d11584a858dff35862c3c

SHA512
a67480b45e014df7770898b86940e7c2c2405d0607d2678b5cd3b855d65a1183c2476698809f7ef1781ac1a82c8660c3ee1f49f3da2b7616f143a1cbdd60ff8f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
e13b61ea26b6ecf161a1794b5c8b4a6e

SHA1
d516fa727eef8d3f6481cf10d5cacc13df9189d3

SHA256
ece15afdff0a053ff722292d1613511b1e6e8995a0abbef341fc724834ffa66b

SHA512
051bdab0a4eeee5d797715a43569993f750c854db0af48f894ecc865ff8821168608e213315660f21f68b6e4cf8c0254681470f81c0502dc85735d54b3cb24e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef146d62d0e29f2158a75e6fc84c61e9

SHA1
b5bab3d7861d6c02ecc815b2424a3cec5bca9287

SHA256
09f8caf10aa3f767ba02cad27ae2123296a6b64ee1450c29a4261438d2d33f99

SHA512
7d1145a61009620144f36840132522d4cd9d0781b367cc6b7aa860bd19c76287852f5e9f915b38a6cf7ae6a1800ede51f3a277ce8b274a761ba198afd0298456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddf402850a36ec9e5a60ab43c1a20e6c

SHA1
51efe7e93a889bd0c3f118c21a745305d534602b

SHA256
3bd2c7344f95e1d9435520e8213693a9a5e56ae5b1772aa2ecf21bd675142cbf

SHA512
7580bfebd884aabfe3e701527b7456de8ef1321bd32f366e9dfcecd9fc23f78110740bfcf8147e3f1832f1de9b170ccf3ab8e2cb8f0d3674ffcb06bbe59d8878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
91d8095075f31a47a58cd02c7068756e

SHA1
96999eba042d956616f4438089d0c5d066259890

SHA256
b628f6ad871d51d8d05228afd733b5411c1ecd1e5092ca34866dc5efd31b0459

SHA512
dd8151d0b56c0ae4b61679108cb7bcc8eeba674987d37d2cb7bb4783d52425341c4d8d843f7afbe5f568dc740ebe11711d6f24a2317dc910f108367d37c9049b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656325443828.txt

Filesize
77KB

MD5
54a1443406e464bc671518b0f3abe427

SHA1
c90ae8871a493d8f12bba9fa6a86f9229e568e15

SHA256
ef4d48f101c29fca8d9efb18bffedd423dccd58321e337c3c12c9fcb66ad2775

SHA512
dc0723ab9abef5767448ae36b1e7a17b5537c957c0bb416d19c4623d83282d1f64530cbc406bd20217d6ae62dba4aa8a1834269e2f1a1ac7cf577a0f4a2ee414

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727657695736094.txt

Filesize
47KB

MD5
95befab7951770b983b76e81cedb31d3

SHA1
ece6fe77b1000e68be901574955ac8d956be5f8a

SHA256
5567c2ce5686dfd593da84dae69de025c2c36b57e55ebb90086c19b4151e80cf

SHA512
19e115c7b729e012588bf6d76372dd1c213ac6a1dcb154fd7a21561f71a16288ebace9a00df11a6f5f73d44a4fc860b90c19853f396bb322292d40a603897d05

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt

Filesize
74KB

MD5
d8dd12b8311f0d5e273ba73ac026f962

SHA1
9a5fd2e9532cbe4c98f5d2fbe08a4ef481b9c13e

SHA256
e33cca281c4d67889b673813ed3c0123e55f9c16fdec2e4054dc7577f0207c4f

SHA512
ea95ae1de9a631560cea0b4f8c6cc79bee12f93646518411c98f9ab13f7946e96065dc460629ace1e15043b3dba720f1f1156bcf2e137cf47520e63085792d48

Download Submit
C:\Windows\onyqeknrtavl.exe

Filesize
424KB

MD5
d818966749acd83dc9fa5d73d5a47f2e

SHA1
4c3a30cd2c8c396ff90aa4ebcba63d89a9cfce50

SHA256
4a015db95a1e6db8123e4b21dfe56e34fabf570261b6d2a0a11c0abb282a3363

SHA512
1fde3f7a05b877184a4676db15e6c4ae6efb8847dacb4226887b9f67097996e0533e2eb7b7aab11d3cbe902f8abc7b75ab4981e2b4cd115051c4a89d2d9fc446

Download Submit
memory/3488-5458-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3488-8925-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3488-10742-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3488-2725-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3488-2726-0x0000000002150000-0x00000000021D5000-memory.dmp

Filesize
532KB

Download
memory/3488-11-0x0000000002150000-0x00000000021D5000-memory.dmp

Filesize
532KB

Download
memory/3488-10786-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/3488-10789-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4620-0-0x00000000022B0000-0x0000000002335000-memory.dmp

Filesize
532KB

Download
memory/4620-10-0x00000000022B0000-0x0000000002335000-memory.dmp

Filesize
532KB

Download
memory/4620-9-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/4620-2-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download