dharma | abd591d27b0fc4c99fea4df79c796c432bd4f69bfe95e26065e72d2ac26f42a7

Analysis

max time kernel
482s
max time network
478s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14-12-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HackBGRT-2.5.1.zip
Size

2.0MB
MD5

bb04d0b0b92a57733941f05a7738dc90
SHA1

3e9999f6f68d37b0953afd8b404257485e62fae4
SHA256

abd591d27b0fc4c99fea4df79c796c432bd4f69bfe95e26065e72d2ac26f42a7
SHA512

0389830b294c50958783a7e9f54bf5f89508896bdd02dfa911ddd21497761cd08dc0f1372dfb58785b91b86c92d79e77b33b5d5869cb7d11cdc9769a1f1dc4d3
SSDEEP

49152:lsQ7se4o0QMg4LssSaHzpPACQGIxSuw+98ne6E2H0T9:lsQ7Z4E4Lmq6bGIC+aer2H0T9

Score

10^/10

dharma bootkit credential_access defense_evasion discovery evasion execution exploit impact persistence ransomware spyware stealer

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty"	WormLocker2.0.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (558) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
35796	takeown.exe
35676	icacls.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-80FFB319.[[email protected]].ncov	.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	.exe

Executes dropped EXE 12 IoCs

pid	Process
2252	setup.exe
5012	setup.exe
3604	.exe
39284	msedge.exe
39308	msedge.exe
9184	msedge.exe
22628	msedge.exe
6576	msedge.exe
6828	msedge.exe
26344	msedge.exe
25656	msedge.exe
35116	WormLocker2.0.exe

Loads dropped DLL 8 IoCs

pid	Process
39308	msedge.exe
39284	msedge.exe
9184	msedge.exe
22628	msedge.exe
6576	msedge.exe
6828	msedge.exe
26344	msedge.exe
25656	msedge.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
35796	takeown.exe
35676	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.exe = "C:\\Windows\\System32\\.exe"	.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2410826464-2353372766-2364966905-1000\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	.exe
File opened for modification	C:\Program Files\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	.exe
File opened for modification	C:\Users\Public\desktop.ini	.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
32	raw.githubusercontent.com
67	raw.githubusercontent.com
2	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	vds.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\diskmgmt.msc	mmc.exe
File created	C:\Windows\System32\Info.hta	.exe
File opened for modification	C:\Windows\System32\WormLocker2.0.exe	Automatic_converter_rff_to_mp4.exe
File created	C:\Windows\System32\LogonUI.exe	Automatic_converter_rff_to_mp4.exe
File opened for modification	C:\Windows\System32\LogonUItrue.exe	Automatic_converter_rff_to_mp4.exe
File created	C:\Windows\System32\.exe	.exe
File opened for modification	C:\Windows\System32\LogonUIinf.exe	Automatic_converter_rff_to_mp4.exe
File opened for modification	C:\Windows\System32\ransom_voice.vbs	Automatic_converter_rff_to_mp4.exe
File created	C:\Windows\System32\LogonUItrue.exe	Automatic_converter_rff_to_mp4.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-256_altform-unplated_contrast-white.png	.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\ui-strings.js	.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-80.png	.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-72.png	.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\set-version\lib-amd\index.js	.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak	.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pencht.dll	.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Analytics.DATA	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\PersonalMonthlyBudget.xltx.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in.png.id-80FFB319.[[email protected]].ncov	.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-30.png	.exe
File opened for modification	C:\Program Files\Mozilla Firefox\xul.dll.sig.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PackageManagement.resources.dll	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png	.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\WeatherWideTile.scale-100.png	.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ui-strings.js	.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\ui-strings.js.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\ieinstal.exe.mui	.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.id-80FFB319.[[email protected]].ncov	.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_fr_135x40.svg.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Icons\StickyNotesSmallTile.scale-125_contrast-white.png	.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluDCFilesEmpty_180x180.svg.id-80FFB319.[[email protected]].ncov	.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.id-80FFB319.[[email protected]].ncov	.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\ui-strings.js.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\SATIN.INF.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\nacl_irt_x86_64.nexe.DATA.id-80FFB319.[[email protected]].ncov	.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.id-80FFB319.[[email protected]].ncov	.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe.id-80FFB319.[[email protected]].ncov	.exe
File created	C:\Program Files\7-Zip\7z.sfx.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms	.exe
File opened for modification	C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO	.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons.png	.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif.id-80FFB319.[[email protected]].ncov	.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.id-80FFB319.[[email protected]].ncov	.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js	.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.id-80FFB319.[[email protected]].ncov	.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	vds.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	.exe

Checks SCSI registry key(s) 3 TTPs 27 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc80c28c8cae9410000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002fc80c280000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000010ed3f000000ffffffff0000000007000100006809002fc80c28000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002fc80c2800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002fc80c2800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\AttributesTableCache = a2a0d0ebe5b9334487c068b6b72699c70000000000000000	vds.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc80c2848cde9390000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002fc80c280000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002fc80c28000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002fc80c2800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002fc80c2800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
24568	vssadmin.exe
38204	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	WormLocker2.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 276002.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Worm Locker2.0(ransomware).zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
4056	msedge.exe
4056	msedge.exe
4508	msedge.exe
4508	msedge.exe
3652	identity_helper.exe
3652	identity_helper.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
240	msedge.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe
3604	.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	2868	7zFM.exe
Token: 35	2868	7zFM.exe
Token: SeSecurityPrivilege	2868	7zFM.exe
Token: SeSystemEnvironmentPrivilege	2252	setup.exe
Token: 33	2460	mmc.exe
Token: SeIncBasePriorityPrivilege	2460	mmc.exe
Token: 33	2460	mmc.exe
Token: SeIncBasePriorityPrivilege	2460	mmc.exe
Token: SeBackupPrivilege	35712	vssvc.exe
Token: SeRestorePrivilege	35712	vssvc.exe
Token: SeAuditPrivilege	35712	vssvc.exe
Token: SeTakeOwnershipPrivilege	35796	takeown.exe
Token: SeDebugPrivilege	35116	WormLocker2.0.exe
Token: 33	34172	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	34172	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2868	7zFM.exe
2868	7zFM.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2460	mmc.exe
2460	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1088	2252	setup.exe	84
PID 2252 wrote to memory of 1088	2252	setup.exe	84
PID 2252 wrote to memory of 2028	2252	setup.exe	85
PID 2252 wrote to memory of 2028	2252	setup.exe	85
PID 2252 wrote to memory of 3052	2252	setup.exe	86
PID 2252 wrote to memory of 3052	2252	setup.exe	86
PID 2252 wrote to memory of 4480	2252	setup.exe	87
PID 2252 wrote to memory of 4480	2252	setup.exe	87
PID 2252 wrote to memory of 2744	2252	setup.exe	88
PID 2252 wrote to memory of 2744	2252	setup.exe	88
PID 2252 wrote to memory of 4188	2252	setup.exe	89
PID 2252 wrote to memory of 4188	2252	setup.exe	89
PID 2252 wrote to memory of 8	2252	setup.exe	90
PID 2252 wrote to memory of 8	2252	setup.exe	90
PID 2252 wrote to memory of 4476	2252	setup.exe	91
PID 2252 wrote to memory of 4476	2252	setup.exe	91
PID 2252 wrote to memory of 3256	2252	setup.exe	92
PID 2252 wrote to memory of 3256	2252	setup.exe	92
PID 2252 wrote to memory of 396	2252	setup.exe	93
PID 2252 wrote to memory of 396	2252	setup.exe	93
PID 2252 wrote to memory of 3268	2252	setup.exe	94
PID 2252 wrote to memory of 3268	2252	setup.exe	94
PID 2252 wrote to memory of 3604	2252	setup.exe	95
PID 2252 wrote to memory of 3604	2252	setup.exe	95
PID 2252 wrote to memory of 3244	2252	setup.exe	96
PID 2252 wrote to memory of 3244	2252	setup.exe	96
PID 2252 wrote to memory of 1436	2252	setup.exe	97
PID 2252 wrote to memory of 1436	2252	setup.exe	97
PID 2252 wrote to memory of 4628	2252	setup.exe	98
PID 2252 wrote to memory of 4628	2252	setup.exe	98
PID 2252 wrote to memory of 1880	2252	setup.exe	99
PID 2252 wrote to memory of 1880	2252	setup.exe	99
PID 2252 wrote to memory of 1680	2252	setup.exe	100
PID 2252 wrote to memory of 1680	2252	setup.exe	100
PID 2252 wrote to memory of 1516	2252	setup.exe	101
PID 2252 wrote to memory of 1516	2252	setup.exe	101
PID 2252 wrote to memory of 3120	2252	setup.exe	102
PID 2252 wrote to memory of 3120	2252	setup.exe	102
PID 2252 wrote to memory of 2532	2252	setup.exe	103
PID 2252 wrote to memory of 2532	2252	setup.exe	103
PID 2252 wrote to memory of 644	2252	setup.exe	104
PID 2252 wrote to memory of 644	2252	setup.exe	104
PID 2252 wrote to memory of 4496	2252	setup.exe	105
PID 2252 wrote to memory of 4496	2252	setup.exe	105
PID 2252 wrote to memory of 2536	2252	setup.exe	106
PID 2252 wrote to memory of 2536	2252	setup.exe	106
PID 2252 wrote to memory of 4780	2252	setup.exe	107
PID 2252 wrote to memory of 4780	2252	setup.exe	107
PID 2252 wrote to memory of 3084	2252	setup.exe	108
PID 2252 wrote to memory of 3084	2252	setup.exe	108
PID 2252 wrote to memory of 220	2252	setup.exe	109
PID 2252 wrote to memory of 220	2252	setup.exe	109
PID 2252 wrote to memory of 2624	2252	setup.exe	110
PID 2252 wrote to memory of 2624	2252	setup.exe	110
PID 4056 wrote to memory of 3160	4056	msedge.exe	122
PID 4056 wrote to memory of 3160	4056	msedge.exe	122
PID 4056 wrote to memory of 1176	4056	msedge.exe	123
PID 4056 wrote to memory of 1176	4056	msedge.exe	123
PID 4056 wrote to memory of 1176	4056	msedge.exe	123
PID 4056 wrote to memory of 1176	4056	msedge.exe	123
PID 4056 wrote to memory of 1176	4056	msedge.exe	123
PID 4056 wrote to memory of 1176	4056	msedge.exe	123
PID 4056 wrote to memory of 1176	4056	msedge.exe	123
PID 4056 wrote to memory of 1176	4056	msedge.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\HackBGRT-2.5.1.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2524

C:\Users\Admin\Downloads\HackBGRT-2.5.1\setup.exe
"C:\Users\Admin\Downloads\HackBGRT-2.5.1\setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol"
  2⤵
  PID:1088
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" A: /S
  2⤵
  PID:2028
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" B: /S
  2⤵
  PID:3052
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" C: /S
  2⤵
  PID:4480
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" D: /S
  2⤵
  PID:2744
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" E: /S
  2⤵
  PID:4188
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" F: /S
  2⤵
  PID:8
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" G: /S
  2⤵
  PID:4476
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" H: /S
  2⤵
  PID:3256
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" I: /S
  2⤵
  PID:396
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" J: /S
  2⤵
  PID:3268
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" K: /S
  2⤵
  PID:3604
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" L: /S
  2⤵
  PID:3244
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" M: /S
  2⤵
  PID:1436
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" N: /S
  2⤵
  PID:4628
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" O: /S
  2⤵
  PID:1880
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" P: /S
  2⤵
  PID:1680
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Q: /S
  2⤵
  PID:1516
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" R: /S
  2⤵
  PID:3120
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" S: /S
  2⤵
  PID:2532
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" T: /S
  2⤵
  PID:644
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" U: /S
  2⤵
  PID:4496
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" V: /S
  2⤵
  PID:2536
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" W: /S
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" X: /S
  2⤵
  PID:3084
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Y: /S
  2⤵
  PID:220
- C:\Windows\SYSTEM32\mountvol.exe
  "mountvol" Z: /S
  2⤵
  PID:2624

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3720

C:\Windows\System32\diskpart.exe
"C:\Windows\System32\diskpart.exe"
1⤵
PID:1180

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2020

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://diskgmtm.msc/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb791f3cb8,0x7ffb791f3cc8,0x7ffb791f3cd8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:39284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:39308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:9184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:22628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:25656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,3443000513131126617,13099710253243993839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - NTFS ADS
  PID:26344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\diskmgmt.msc"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2460

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4004

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4208

C:\Users\Admin\Downloads\HackBGRT-2.5.1\setup.exe
"C:\Users\Admin\Downloads\HackBGRT-2.5.1\setup.exe"
1⤵
- Executes dropped EXE
PID:5012

C:\Users\Admin\Downloads\.exe
"C:\Users\Admin\Downloads\.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3604
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:4152
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:22400
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:24568
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:35520
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:38384
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:38204
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:34356
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:34432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:35712

C:\Users\Admin\AppData\Local\Temp\Temp1_Worm Locker2.0(ransomware).zip\Automatic_converter_rff_to_mp4.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Worm Locker2.0(ransomware).zip\Automatic_converter_rff_to_mp4.exe"
1⤵
- Drops file in System32 directory
PID:36684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"
  2⤵
  PID:37440
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:35796
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32 /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:35676
- C:\Windows\System32\WormLocker2.0.exe
  "C:\Windows\System32\WormLocker2.0.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:35116
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\System32\ransom_voice.vbs"
    3⤵
    PID:33924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000488 0x00000000000004E8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:34172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-80FFB319.[[email protected]].ncov

Filesize
2.7MB

MD5
1fe727254edb5f3d4e96380f237cd104

SHA1
08a5ca1fceb5ef4be027f79c0c461b493eeeb5f5

SHA256
337a3dc942c5b3c8544b94178c369ab20b73063ce60740f118c95dc00b49b749

SHA512
4a736af1f39d6a8e8f11555a71115e163006e3d5d4ff7e18c3e56d8bef584d1a95b448f7eba5e13e3f828e67b27d8ba1991b413bba8f3be89911449cd408db72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\setup.exe.log

Filesize
425B

MD5
de75c43a265d0848584ae05945570edf

SHA1
69f95177914f8d8b2f278a91f585a0024b8dffd3

SHA256
d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140

SHA512
365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
17KB

MD5
18a9531f05f4a3662558d102349767b1

SHA1
328114b78180b5931d651669bf0b21d3a5cf8adc

SHA256
2d427df292899c50caad69f5c59737ff07f39544e52ff6b9d01f4fb82ec0d716

SHA512
b52d9f81a88694bbb16551a50fefd69a3f3dcd0ce5d3d3f3e3a2c1d7de969b5f6e27ca9fd22f7e964108f9b39eb083a44ef161ee3b8c39f61fa5939a15d21b2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2b6c4db9fd37ba382c9721040956c90d

SHA1
064370eec1d602600fa610bbde07e01703648c68

SHA256
bd9a981ff915e22d5b1414b784946af457b0bc3365ecb9e445e2ad44cadc48c7

SHA512
d3e30ec040d2cd98af041c265311eecc157723c8bfe7d488f6c14f682cd5da2a29254fbf63297793d2115666fdf0ec4e8977b8038cf2abc6832a75eb1ed08365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1aa4de7d2091c9656f79cf748c4dedbe

SHA1
a6a7e767f60c232298d9a274580755b9f795d287

SHA256
55d5d74c37ff0bacc16fe5764768590af911357760cc8de68f92fd6eef9e578c

SHA512
1204a1efa7bdab35e4d13c18af56c30805b14ee6b28b73bcef5bf2da34456cdeff4d8834a311419ce018df2fc55119b747c41d4cb8d92b092abefd915f1f6d63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5e2420.TMP

Filesize
940B

MD5
ae81456514cfeafcd18a7172767badc7

SHA1
72824d235b8805f7824ba167ffe520a601074ef5

SHA256
91f52cf6a5552ac199d881d316f7a971d4b98356b8133db854712e56aff99522

SHA512
74d6a5326342fdc8efe7f24372eafc49feccf5ac71f4e874e7afbdf6d24d0ade5a4eb9022ab40958933f709552d18146b2b2b93843d316b4b9c09504b78b1987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35ed0c813827f5b80710c37591c90225

SHA1
ef98a80957319bde8bb7b3786a8fbbd78458300b

SHA256
81a42c4cdd9855cf83a416430645057a17114c8593bc2af2352e24cfbaef0045

SHA512
7a1ed89b4d47615eb5bb2a5eec1c68e3568b509ff769a84f83fe414c7c455d66e0486a768ffaacea939041470856e12ea8ce57b1306cccdd55be4a7b4101cff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0dc5ea75ca4b2f76bee44fecd773b514

SHA1
90079804f8ebbb4a653274307ffa7832c758b72f

SHA256
2ad3e3e3cd23b3a21bd4a23b7cdcf1b5c70962b3dd0b480c8ca0b8265de127b0

SHA512
8e0bcfbea4056d4c50cc1a46dadcf40edf01dc674439402590e2766c16da31bcf5b78017aeb4a00baf3e4a08e71b1049a0a6b38393898c36149aea08a35242b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b08936ccecac65459881408314ab6114

SHA1
795c5dae4aeebec7c4ced343e4f1f6523775a9d3

SHA256
dd58a0ef7a73270c32c106dc2ca9f3a29a88feecd5ccc2c67627b94540cd9984

SHA512
09a1484b18a492ea12ee0e45996625bae7b90b6aafae71a1b36cf2b4572684fd79b0874b0419101263ed06093c46a66fc6685946a6f7d78a11da4e0ee26c6e4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
06a613a8f25e483075ae934800f0ad52

SHA1
8dca53bf86e73cbe931b6760b811aa37119f9b0b

SHA256
b2ca7893b83895736604a3b3265fa1cd5aecf90c9c49c53654dd0c2454804080

SHA512
1c9656ccd4a9b2aea204aa412bf9510bac9824d0ae19b3bcb30e5c53629ddfec369935b60d72c66fd19e6922a77685b936bd7a07ca3ce7b482bcec21d9c68ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe5e07be.TMP

Filesize
6KB

MD5
65d8d5d9088f32e280253e5db4cb6675

SHA1
a00fb620c461accd9b76115d18b88a708d0dc999

SHA256
3ef94f760e69f9bca3a7386172700eade357c12c6cdd0920003a83ee33c13520

SHA512
9765eb7483657bf9b92fcc257b15b80852544c97c69a15177f4dd14c1083abeb56bc6fec881497d027dbfd8411d0478b0373406b7ca3c90861e2f978ea3eb368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5e214d3e06907a0b3aeadadf57fd2ca0

SHA1
e7d8365c819dfb876b24cad1420979c4c70b069f

SHA256
55fc75f1aeeb6da7d60e4e9eae707103e90710263ec5d0be35da646cf96df4a7

SHA512
a3822571a70b0b49b906b1b62aa7243491826de2b5156659fc5a1f66ccfb805d6cf1b823da50b5dbbe04f340ce8c8d28cb05b79470c15f9720a8931a70ceaf7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d3203936a8b3157fea6d1fd0148af26b

SHA1
c922e8ad0d742cf87a450868976ae3666b1e65de

SHA256
bde2458b14b0711cb2c5ac0976e163a62a51054c238224a485ca991ae0687b44

SHA512
ef507ed763c5b46ed22a53f71f4951abd3f226679058b6a6c42faa8fa30d44be891b096ebdb7a171ace3026df47cfea2d88f18edf03d0158030ef80da3942069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cbb92e6bc11a26d9430858e319be5e5b

SHA1
2617345706ed7c0277201b3d3d828ad7d524b679

SHA256
4e1b1fd7c259b24046c4c6219177e6ffdba3dfe57e50b17b191547718a12326a

SHA512
2201c24b546e3726ff7febc559a0100807b9227a04f96bc38791714497f12f99efc121b1dd3f033a68e2991dc41dc4b226a8519b9a72fa26ab6ae69870922edc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c653a.TMP

Filesize
1KB

MD5
047d7e96dab5b7eceb1a27da8b384194

SHA1
9bae4d726f54119576714778805e7ddf14934c69

SHA256
f8d42b3f93bb7d7614adf30a3f3fcc268da5636e936dce9578131337af4f4577

SHA512
4ffa62f2fadd334d4b44a9903ec278cb1744748cfa13441c6e7635f203cab25fbde05526783360fbf8cc3014a34810ee640948f1a1676c2b69a50d51ff25e710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e079f.TMP

Filesize
1KB

MD5
f345fc43a0b0a2fb5c7294c1a56a1cdc

SHA1
a3a3e6a29fda2c847583fcf58ca581204d15defd

SHA256
faf2e26122abdd9c02a80da397a08aeae0419948d25f224313bea2bc0766a235

SHA512
250a02266bf0776ba3796aca6d86fb51fdde4b64cc5a1c552d5fe05f32c408fb197e498fe4222b62af270ad793ec1e332b0265c451939621a180c1266d3c45a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9a8e0fb6cf4941534771c38bb54a76be

SHA1
92d45ac2cc921f6733e68b454dc171426ec43c1c

SHA256
9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

SHA512
12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db

Filesize
16KB

MD5
d926f072b41774f50da6b28384e0fed1

SHA1
237dfa5fa72af61f8c38a1e46618a4de59bd6f10

SHA256
4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

SHA512
a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6fb373c0baa2b2e1c1ff8928b592543a

SHA1
4534f6ec6a3a6825bf2e8bdac1b2691a35c0bc74

SHA256
4d995c2ae314e0a87b125fee01b6be9819271c4e9f081461faaf7ff438366ad4

SHA512
9f84861f9a76eb1be8e49a984995385efc59605523684a6e8f4ea5be6c619b0a3c1b4507df80179cca03aca887f242223790e6f99395f8dece8b8b012df58137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
01d1f07f668d8712e6c18f67e760ff82

SHA1
4938a65b7f463d9ea749dd699735ac09bc6dc6d8

SHA256
479904cfcf4fea3834683f0a61bf6cfe7172d054639ed638b904b00e356da9e2

SHA512
8a1acf4768bb373b7d357a40111fe7532eb6e8e6ae8315d253c40d04d86f6e98403dda3dea5572e7f3a2ae5a766ded5b3d1fb5cc5ce486efcf085874dbeb6af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7293b574df7d8bc4385e43a789e232c2

SHA1
a66fb9e5e6792d0f898bcbfa848eecb9803715ba

SHA256
05ab82307244af66cb9cde43064d11d0264ad0ed3fd3798483ad82e6d7cb248f

SHA512
cc9a0f11aa55fb21be9694d6d8d1d70a7bf70792e798a899c782857b6f3ebae4f935855fb4cfa8ee94b62ca8f23a7c4bc5befcaebd91242a5161bf0c5426e957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eab64d1ce2703d53a3079f7942f182d3

SHA1
17476292e2044d4b1a5ae6eca8a5fbc7072d73e4

SHA256
bc78c6a26522ed26f988ae73e0f171354a8118a7dfd019b759eed3160f5e0ab7

SHA512
ee7739accb8fb87fefee67726ae8764d86cc982c15c0272d9139cb6f00526b9eb593227d0416d8fcb7f08b5ccae6af4cfa8226ccee5427fc5de4f24f3f57456d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
bea0cc1a5ac748f41cd00e1e5f810dec

SHA1
f277bb750348af1520752344e505cd3a9f736394

SHA256
493dd500e1840ca0e202c27bd519ca7017ea2c6eebafec59a06afdd0936a73bc

SHA512
e4009dc53661c69dc510b4add826c46f763efdb74f690a3375b3bc555e77aaeb4aa37295cd90a85aaf912e7676545f2a2aace61cd1668f6bcd629e9f477bde7c

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\d6a42368-fac9-490c-8e3e-9bffc432c282.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\Downloads\HackBGRT-2.5.1\setup.exe

Filesize
51KB

MD5
17779e309b41587fb8226df6d35e38b5

SHA1
cf5d45aa9f962ac35d786300e4e7c3fd3f3a8f4d

SHA256
ff5400fb06b7b1f9c2751a34b95eb7fa5d62e755f789433bc0f81df221902a11

SHA512
f101173afdb00f3f319354757b00af20f8570b55c1d35f26c88e3bfd3140feab3624fffee900e9eb5e4e9ffc3a7ab2e722e08e3282b05ba0e56ee5b96603d81c

Download Submit
C:\Users\Admin\Downloads\HackBGRT-2.5.1\setup.log

Filesize
17KB

MD5
d9d552277edebd3897a4439bc548e0aa

SHA1
eab92ec48d5a87d611f53a75e5281c2b251179aa

SHA256
8155665f731312205be4708bcc6ed16a8e1279702001b541f9d259cba85f889e

SHA512
b1b591a50e9901cf98d9ad38eecb60712dade5e66980f550481c263a3e8174d006bb3a4e33f2792dc296be204d1d38e27b4e6b5bbd8bfac06c86d3e8d0d47b2b

Download Submit
C:\Users\Admin\Downloads\HackBGRT-2.5.1\setup.log

Filesize
1KB

MD5
699e03076d88eb017d967e2e210fd3fd

SHA1
850857ad71682ed6fa2768e1692b57575a506b29

SHA256
787c553159298daa6c2d57ed2c8ba6cc82f96197f34eef9cdde939ddb0a8f442

SHA512
d98abc498d96b0b6f0b842db691c8be69d8742c80263154d12eb625d8d54dc7d78cf082ea9e8c12fc88d9ff1f207863a54c56e3a7f5a3f7db403888acfb01b37

Download Submit
C:\Users\Admin\Downloads\HackBGRT-2.5.1\setup.log

Filesize
6KB

MD5
7334003291ae7b1b0d73ab6ba5002a56

SHA1
aead47c84a0c4a80ceedc1e522d28595f95399a2

SHA256
d6cc92b2d25a8025074f3a48d23671a028c7744867fd00327a19d797cb25ff13

SHA512
43463ebcb08ece3f4f10ce14eeddbe73b2523c4445351718b3c461072cfbb54c3e595958705c7f94cda011715307207acbb08032c584b5bdd139e68ec46bb006

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 276002.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\Worm Locker2.0(ransomware).zip

Filesize
204KB

MD5
883752fed229f8a2e871296d217fb6c5

SHA1
aa730ba4b3191cd935ea8d7d1fda9efb3d89c44f

SHA256
995df061cec051f1964775932be424ee3da5a4ee91e2b9a17f7a625894088dbf

SHA512
a8baeaebd568d363f95202fc9e5660b7b367284413f6383b6ed469203a06f2601d0573bda58e529c1d9a23e0ae154306ee9be8ce52e5d65fe5662e67b7a3a549

Download Submit
C:\Windows\System32\WormLocker2.0.exe

Filesize
116KB

MD5
041aa5e99ae545dac5f9306bb20d869e

SHA1
88ea126645bfd418abba44cca4a16adf12084d2f

SHA256
830c271c8aca775457a090a51c93ad08f9665361eeeaa3fda3f9ae032202ad73

SHA512
4b8007dddd519c77bb596f6d17f270da62b236894b6fd7f1c528e553b1aac3a7f9c0df4bb40b678461f70bde3c5a8ac4b5e97e5372dd127a8184862c7f6f4c7c

Download Submit
memory/2252-78-0x00007FFB67553000-0x00007FFB67555000-memory.dmp

Filesize
8KB

Download
memory/2252-43-0x0000000000F20000-0x0000000000F34000-memory.dmp

Filesize
80KB

Download
memory/2252-42-0x00007FFB67553000-0x00007FFB67555000-memory.dmp

Filesize
8KB

Download
memory/3604-607-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3604-7022-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/3604-620-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/35116-26282-0x00000000001C0000-0x00000000001E2000-memory.dmp

Filesize
136KB

Download
memory/36684-26235-0x00000000005F0000-0x0000000000646000-memory.dmp

Filesize
344KB

Download