teslacrypt | 73da1b9b157a7d2ae3a21c90a114ca7251c32545511a38a3e92b777e59009c45

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe
Size

368KB
MD5

d96103542ad88b7dd63633e1402d004d
SHA1

f139d0cdf959da734adb8218bb9ab1070589f0ba
SHA256

73da1b9b157a7d2ae3a21c90a114ca7251c32545511a38a3e92b777e59009c45
SHA512

c39095411c803ffe51d7adc67b5ac31897fad8914c3c09ea53fee4c3123ac3655dec98af425db093405b079a81aa97e2e5f6a2dc8061a5c812347d2a476753bb
SSDEEP

6144:oL9rKjvNvkH1sGf7L4JZ9oL+5b/OcGBJL8dxjHtgWECmCTPqsUPpII:5jo1sWUCL+5b/DGHL8bjHtgWL1TPqsiC

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+pskth.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E7EF1E76865BF565 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E7EF1E76865BF565 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/E7EF1E76865BF565 If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/E7EF1E76865BF565 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E7EF1E76865BF565 http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E7EF1E76865BF565 http://yyre45dbvn2nhbefbmh.begumvelic.at/E7EF1E76865BF565 Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/E7EF1E76865BF565

URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E7EF1E76865BF565

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E7EF1E76865BF565

http://yyre45dbvn2nhbefbmh.begumvelic.at/E7EF1E76865BF565

http://xlowfznrg4wf7dli.ONION/E7EF1E76865BF565

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (859) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	tceklrmftfdx.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+pskth.png	tceklrmftfdx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe

Executes dropped EXE 2 IoCs

pid	Process
2988	tceklrmftfdx.exe
4700	tceklrmftfdx.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ynekqmf = "C:\\Windows\\system32\\CMD.EXE /c start C:\\Windows\\tceklrmftfdx.exe"	tceklrmftfdx.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 416 set thread context of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 2988 set thread context of 4700	2988	tceklrmftfdx.exe	94

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_contrast-black.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteWideTile.scale-125.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-24_contrast-black.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_EyeLookingUp.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\SmallTile.scale-200.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\TextConv\_ReCoVeRy_+pskth.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\_ReCoVeRy_+pskth.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-400.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_5_Loud.m4a	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\WideTile.scale-100.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\_ReCoVeRy_+pskth.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-400.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Config\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-24_contrast-white.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-32_altform-unplated_contrast-white.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\MedTile.scale-125.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\200.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-250.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\10px.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\4.jpg	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\ole db\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\_ReCoVeRy_+pskth.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\SmallTile.scale-100.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-125.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-125_contrast-black.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-125.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SmallTile.scale-100_contrast-black.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-black_scale-125.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\SmallTile.scale-200.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\_ReCoVeRy_+pskth.html	tceklrmftfdx.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_ReCoVeRy_+pskth.txt	tceklrmftfdx.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\_ReCoVeRy_+pskth.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\_ReCoVeRy_+pskth.png	tceklrmftfdx.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png	tceklrmftfdx.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tceklrmftfdx.exe	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe
File opened for modification	C:\Windows\tceklrmftfdx.exe	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tceklrmftfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tceklrmftfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	tceklrmftfdx.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4324	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe
4700	tceklrmftfdx.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe
Token: SeDebugPrivilege	4700	tceklrmftfdx.exe
Token: SeIncreaseQuotaPrivilege	4432	WMIC.exe
Token: SeSecurityPrivilege	4432	WMIC.exe
Token: SeTakeOwnershipPrivilege	4432	WMIC.exe
Token: SeLoadDriverPrivilege	4432	WMIC.exe
Token: SeSystemProfilePrivilege	4432	WMIC.exe
Token: SeSystemtimePrivilege	4432	WMIC.exe
Token: SeProfSingleProcessPrivilege	4432	WMIC.exe
Token: SeIncBasePriorityPrivilege	4432	WMIC.exe
Token: SeCreatePagefilePrivilege	4432	WMIC.exe
Token: SeBackupPrivilege	4432	WMIC.exe
Token: SeRestorePrivilege	4432	WMIC.exe
Token: SeShutdownPrivilege	4432	WMIC.exe
Token: SeDebugPrivilege	4432	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4432	WMIC.exe
Token: SeRemoteShutdownPrivilege	4432	WMIC.exe
Token: SeUndockPrivilege	4432	WMIC.exe
Token: SeManageVolumePrivilege	4432	WMIC.exe
Token: 33	4432	WMIC.exe
Token: 34	4432	WMIC.exe
Token: 35	4432	WMIC.exe
Token: 36	4432	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4432	WMIC.exe
Token: SeSecurityPrivilege	4432	WMIC.exe
Token: SeTakeOwnershipPrivilege	4432	WMIC.exe
Token: SeLoadDriverPrivilege	4432	WMIC.exe
Token: SeSystemProfilePrivilege	4432	WMIC.exe
Token: SeSystemtimePrivilege	4432	WMIC.exe
Token: SeProfSingleProcessPrivilege	4432	WMIC.exe
Token: SeIncBasePriorityPrivilege	4432	WMIC.exe
Token: SeCreatePagefilePrivilege	4432	WMIC.exe
Token: SeBackupPrivilege	4432	WMIC.exe
Token: SeRestorePrivilege	4432	WMIC.exe
Token: SeShutdownPrivilege	4432	WMIC.exe
Token: SeDebugPrivilege	4432	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4432	WMIC.exe
Token: SeRemoteShutdownPrivilege	4432	WMIC.exe
Token: SeUndockPrivilege	4432	WMIC.exe
Token: SeManageVolumePrivilege	4432	WMIC.exe
Token: 33	4432	WMIC.exe
Token: 34	4432	WMIC.exe
Token: 35	4432	WMIC.exe
Token: 36	4432	WMIC.exe
Token: SeBackupPrivilege	1340	vssvc.exe
Token: SeRestorePrivilege	1340	vssvc.exe
Token: SeAuditPrivilege	1340	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5020	WMIC.exe
Token: SeSecurityPrivilege	5020	WMIC.exe
Token: SeTakeOwnershipPrivilege	5020	WMIC.exe
Token: SeLoadDriverPrivilege	5020	WMIC.exe
Token: SeSystemProfilePrivilege	5020	WMIC.exe
Token: SeSystemtimePrivilege	5020	WMIC.exe
Token: SeProfSingleProcessPrivilege	5020	WMIC.exe
Token: SeIncBasePriorityPrivilege	5020	WMIC.exe
Token: SeCreatePagefilePrivilege	5020	WMIC.exe
Token: SeBackupPrivilege	5020	WMIC.exe
Token: SeRestorePrivilege	5020	WMIC.exe
Token: SeShutdownPrivilege	5020	WMIC.exe
Token: SeDebugPrivilege	5020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5020	WMIC.exe
Token: SeRemoteShutdownPrivilege	5020	WMIC.exe
Token: SeUndockPrivilege	5020	WMIC.exe
Token: SeManageVolumePrivilege	5020	WMIC.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 416 wrote to memory of 4004	416	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	89
PID 4004 wrote to memory of 2988	4004	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	90
PID 4004 wrote to memory of 2988	4004	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	90
PID 4004 wrote to memory of 2988	4004	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	90
PID 4004 wrote to memory of 2744	4004	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	91
PID 4004 wrote to memory of 2744	4004	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	91
PID 4004 wrote to memory of 2744	4004	d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe	91
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 2988 wrote to memory of 4700	2988	tceklrmftfdx.exe	94
PID 4700 wrote to memory of 4432	4700	tceklrmftfdx.exe	95
PID 4700 wrote to memory of 4432	4700	tceklrmftfdx.exe	95
PID 4700 wrote to memory of 4324	4700	tceklrmftfdx.exe	100
PID 4700 wrote to memory of 4324	4700	tceklrmftfdx.exe	100
PID 4700 wrote to memory of 4324	4700	tceklrmftfdx.exe	100
PID 4700 wrote to memory of 4956	4700	tceklrmftfdx.exe	101
PID 4700 wrote to memory of 4956	4700	tceklrmftfdx.exe	101
PID 4956 wrote to memory of 3656	4956	msedge.exe	102
PID 4956 wrote to memory of 3656	4956	msedge.exe	102
PID 4700 wrote to memory of 5020	4700	tceklrmftfdx.exe	103
PID 4700 wrote to memory of 5020	4700	tceklrmftfdx.exe	103
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105
PID 4956 wrote to memory of 464	4956	msedge.exe	105

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	tceklrmftfdx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	tceklrmftfdx.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:416
- C:\Users\Admin\AppData\Local\Temp\d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d96103542ad88b7dd63633e1402d004d_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\tceklrmftfdx.exe
    C:\Windows\tceklrmftfdx.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\tceklrmftfdx.exe
      C:\Windows\tceklrmftfdx.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4700
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:4324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe57da46f8,0x7ffe57da4708,0x7ffe57da4718
        6⤵
        
        PID:3656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
        6⤵
        
        PID:464
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
        6⤵
        
        PID:1136
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
        6⤵
        
        PID:2840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
        6⤵
        
        PID:1764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
        6⤵
        
        PID:3152
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
        6⤵
        
        PID:268
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
        6⤵
        
        PID:3600
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
        6⤵
        
        PID:1976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
        6⤵
        
        PID:1484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        6⤵
        
        PID:3972
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10628069311439877388,5681712931163606414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
        6⤵
        
        PID:940
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5020
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\TCEKLR~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\D96103~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\_ReCoVeRy_+pskth.html

Filesize
12KB

MD5
2f2d678dbd11af87a3d6845dc0f41a58

SHA1
6b5c3bc61acdc192ab366835c5c222e0964b29b2

SHA256
53b0f6173b40e7185468499c22b727d961845a6622a82f9ed86d257a1ec15325

SHA512
692cd471b08eb8f94e106c380c6220653fffe5c66237df7143922d38379493b2d83fb98858477e5a6e6a4405205e6c187e7220e9913eb48a301afae4f4957d1f

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+pskth.png

Filesize
63KB

MD5
a42771d7b9f737ffe2944b08b2635fe2

SHA1
a426e224103455533a6cb9d525b88be2af68e1f9

SHA256
16641be90e7f59e78d9450426e7143b7d249ad1e65e7d5daed441c3d0a7999b8

SHA512
e714aa64eea58d17e883022bd0d53b956b68b4fc9703c770d59e1851f6bd23c0a681ad00c35facb9142d1215702044e31c2c9774ddc37bef8dfc2b2ca36ccc73

Download Submit
C:\Program Files\7-Zip\Lang\_ReCoVeRy_+pskth.txt

Filesize
1KB

MD5
c8ab2b0ec8b212d5836bb020ae26a70b

SHA1
bf332fff2ac4d13ea12fdf4d40a86794e5e2dd8a

SHA256
c7a7cc43b9dfa50fed8e11fedea1e71bd8b55c75cebe2840ef918dddb2cfdc9c

SHA512
47fc3fe6fc1281281e474709053dc3bb1abcdb4f2f030617527558922957cd0ad87052c91dc6463fad7944e82ef3d2fa72022107a3dce930d692cfd0ebb874a0

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
d16c001810e34882eee1edacad2425cb

SHA1
3697aea012962f42b72e4ee114f1d34733fbf746

SHA256
480d8b369b7296a4f249471235cc64759f9a89a82a5891b1a02268cc059c7463

SHA512
6a6acdaad24fbf21afbfdf4ce1c906b731f4bf63554530a28de3bfe004cbc8710dadb283109cdbe26cb7cdb08d2c469833d71e7508cab0a8e9e80c0d7bd1ba31

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
44614ac743be320051756e7885831434

SHA1
812aeff6166e2a50bf20e0d4ffba30ef644ada64

SHA256
ab858222f909d1bde3a10b2c12384fde259ef2eb109c502cff4b6a2aa204b5f8

SHA512
6acb001212b515246047275dda2b5f6e5d18ae5090d27ed4c70b442b64ca4aecf26385a0b37252ab1ba5d62d1b6af452d5103baa25f1fd6476e02915b6c0e004

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
6c4b527f4c9d7b040e2c17e0ab25206a

SHA1
5f7cdde4d167768ac466770d353929458629d918

SHA256
69bd810502756a095fd3de5ba1f281cc6aa4ac70f4ff09ff85d223680f953c6c

SHA512
58ac806dddc9f5c2cd690cafa1cd0603ff0f46c54449a578d2a4d9b256286923567581c2641685867a6695be8ea135b6e841e0a1047efa5db277b60c5ec18919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b09b7b2db90d7b9b959528f6df960ee4

SHA1
4de66ff54acb728bb463313bd20c85fc80928de4

SHA256
d1240dee9e5e7dc2e53430ee49746c04090a4164c22a4df004accd1fc434d649

SHA512
c03c06ae9de672a890dda30d9331b67138cd0170bc777995295babb1615244d023a154a21886a415e95dc7beb81de38848fe426a7a148f8df2aa3d497b2b2118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b160f9891415e167378b035a27d5e488

SHA1
c25bd203a678e70edc695f11b9e1ed13626b0977

SHA256
e1617074756085f8b8a558d2d063597feafe07a65f23dd1631443df41ee24465

SHA512
75bf8fec059645bec5702be989baba8ae1ba3de51e5bcccae268836ba27d85c753f7dc0c713c42a5f1a400dc6e62592573e6e6d796e281258239ea7658a2cc8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fcbd077f20ef91780c6193d83a095c71

SHA1
28461cafa2742c2c9060617f8c40a67def56c308

SHA256
1960b96041755744789ccfddd6293a28989a5f8c07e5d9d3caa6d5f217f4aaed

SHA512
cbc80b87a1119a5b0b94b0ca7159e3d92726ece75d75fd906b16cb6f943c7ee14ee2c9afe173f926bbb05c02af55ce5950a781aca0d4a9b0c0cf8a2a8f1ba001

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656325443828.txt

Filesize
77KB

MD5
f200cf849a6084f8ac0fa76c938a5c00

SHA1
6579ec1d5a52d286f746e56e71551e7084605c98

SHA256
1cedddecbf3d74b6455f98c04cb8475cbcb5db72047aeaeb2e25e114ce2b29a1

SHA512
5587ec142328cbac419c4adfbc1693f0c0af86bfb479b5d2b37e3d4efa1416082f6ee45a725e13ef699636a2fc8703c6296a653fc7934451130be6cee8251158

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727657695736094.txt

Filesize
47KB

MD5
3565904329437b51e625bec8f06f7ccf

SHA1
9c00545f8f20d8c67572722e6248bc38a296d6dd

SHA256
bedd27ac2c65ecb2dd0624af40fec4ab11dd41b879af333a32ee2a8d6652f8e0

SHA512
bf33061a3952e73339dbe52bfe37f050995e5996ab4d34fc6fffe8d3184ce7c2a0f3ac7b1bdaf0ecd5dc8f2c736f99e0d8579305b64b377d36cd72fcb028013e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt

Filesize
74KB

MD5
1195fce2fb08144994908d6947f7761b

SHA1
39ff2c06865bd9fa7bfc75b6731d869d62573c20

SHA256
93e075b691e944a6cd9a6fc26e76a76bcabdc6a4f2dd44bb8214b16f4051a773

SHA512
aaad30b6d26d269affe05ee36311cbd7c5c6a2ebd7f93c211a7e303edf1e2fde97068a3ee6b0521496720c7cd5fe5fe5161c840e143c5fc98e63b60ece93bd4f

Download Submit
C:\Windows\tceklrmftfdx.exe

Filesize
368KB

MD5
d96103542ad88b7dd63633e1402d004d

SHA1
f139d0cdf959da734adb8218bb9ab1070589f0ba

SHA256
73da1b9b157a7d2ae3a21c90a114ca7251c32545511a38a3e92b777e59009c45

SHA512
c39095411c803ffe51d7adc67b5ac31897fad8914c3c09ea53fee4c3123ac3655dec98af425db093405b079a81aa97e2e5f6a2dc8061a5c812347d2a476753bb

Download Submit
memory/416-4-0x0000000000560000-0x0000000000564000-memory.dmp

Filesize
16KB

Download
memory/416-0-0x0000000000560000-0x0000000000564000-memory.dmp

Filesize
16KB

Download
memory/416-1-0x0000000000560000-0x0000000000564000-memory.dmp

Filesize
16KB

Download
memory/2988-12-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/4004-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4004-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4004-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4004-6-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4004-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-6084-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-3003-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-9661-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-10464-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-10465-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-10473-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-10474-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-3002-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-10498-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-195-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-25-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-23-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-20-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4700-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download