cryptolocker | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
285s
max time network
287s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
01-02-2025 20:16

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

cryptolocker dharma bootkit credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker
Cryptolocker family
cryptolocker
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (551) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Downloads MZ/PE file 5 IoCs

flow	pid	Process
30	3200	msedge.exe
30	3200	msedge.exe
30	3200	msedge.exe
30	3200	msedge.exe
30	3200	msedge.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 11 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7f573c8b.exe.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7f573c8b.exe.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\info.hta	Taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7f573c8b.exe	explorer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7f573c8b.exe	CoronaVirus.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\7f573c8b.exe.id-7400b7b5.[[email protected]].ncov	Taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe

Executes dropped EXE 15 IoCs

pid	Process
4396	CryptoLocker.exe
3584	{34184A33-0407-212E-3320-09040709E2C2}.exe
3044	{34184A33-0407-212E-3320-09040709E2C2}.exe
4268	CryptoLocker.exe
1136	CoronaVirus.exe
3968	CryptoWall.exe
16764	msedge.exe
17176	msedge.exe
17744	msedge.exe
18476	msedge.exe
18440	msedge.exe
19920	msedge.exe
6648	msedge.exe
9476	PowerPoint.exe
19648	sys3.exe

Loads dropped DLL 7 IoCs

pid	Process
16764	msedge.exe
17176	msedge.exe
17744	msedge.exe
18476	msedge.exe
18440	msedge.exe
19920	msedge.exe
6648	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\Run\7f573c8 = "C:\\7f573c8b\\7f573c8b.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\Run\7f573c8b = "C:\\Users\\Admin\\AppData\\Roaming\\7f573c8b.exe"	explorer.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1537126222-899333903-2037027349-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
10	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	ip-addr.es
91	ip-addr.es
42	ip-addr.es

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	PowerPoint.exe
File opened for modification	\??\PHYSICALDRIVE0	sys3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\warning.gif.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\LAYERS.ELM.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\it-IT\wab32res.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-72_altform-unplated_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-lightunplated.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\dom\setSSR.js	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-400.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-96.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\ui-strings.js.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\da.pak.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\bell_empty.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Office.Excel.DataModel.dll.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl64.dll	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.jpg	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-16_altform-lightunplated.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_sl.dll.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-48_altform-lightunplated_contrast-black.png	CoronaVirus.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\ui-strings.js.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Bold.otf	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Locales\km.pak	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-300.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\profilePic.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\PackageManagementDscUtilities.strings.psd1	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.schema.mfl.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\msedgewebview2.exe.sig.DATA.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.5338de41.pri	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Notifications\SoftLandingAssetDark.gif.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SnipSketchWideTile.scale-100.png	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Microsoft.Apps.Stubs.winmd	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\selector.js	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Edge.dat.DATA.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.id-7400B7B5.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-256.png	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.scale-100.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateAppIcon.targetsize-16.png	CoronaVirus.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 5 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoWall.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\PowerPoint.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\satan.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerPoint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
7736	vssadmin.exe
15084	vssadmin.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "147"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	Taskmgr.exe

NTFS ADS 14 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 156618.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\sys3.exe\:Zone.Identifier:$DATA	PowerPoint.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 665611.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:Zone.Identifier:$DATA	CryptoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 308148.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\PowerPoint.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoWall.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CoronaVirus.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 245483.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\sys3.exe\:SmartScreen:$DATA	PowerPoint.exe
File opened for modification	C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\satan.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:SmartScreen:$DATA	CryptoLocker.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 818061.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
1192	msedge.exe
1192	msedge.exe
720	identity_helper.exe
720	identity_helper.exe
4828	msedge.exe
4828	msedge.exe
1948	msedge.exe
1948	msedge.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
852	msedge.exe
852	msedge.exe
3916	msedge.exe
3916	msedge.exe
1136	CoronaVirus.exe
1136	CoronaVirus.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
20012	Taskmgr.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3968	CryptoWall.exe
1960	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	Taskmgr.exe
Token: SeSystemProfilePrivilege	5028	Taskmgr.exe
Token: SeCreateGlobalPrivilege	5028	Taskmgr.exe
Token: SeSecurityPrivilege	5028	Taskmgr.exe
Token: SeTakeOwnershipPrivilege	5028	Taskmgr.exe
Token: SeSecurityPrivilege	5028	Taskmgr.exe
Token: SeTakeOwnershipPrivilege	5028	Taskmgr.exe
Token: 33	5028	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	5028	Taskmgr.exe
Token: SeDebugPrivilege	20012	Taskmgr.exe
Token: SeSystemProfilePrivilege	20012	Taskmgr.exe
Token: SeCreateGlobalPrivilege	20012	Taskmgr.exe
Token: SeBackupPrivilege	20988	vssvc.exe
Token: SeRestorePrivilege	20988	vssvc.exe
Token: SeAuditPrivilege	20988	vssvc.exe
Token: SeShutdownPrivilege	19648	sys3.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe
5028	Taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
11584	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2096	1192	msedge.exe	77
PID 1192 wrote to memory of 2096	1192	msedge.exe	77
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 808	1192	msedge.exe	78
PID 1192 wrote to memory of 3200	1192	msedge.exe	79
PID 1192 wrote to memory of 3200	1192	msedge.exe	79
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80
PID 1192 wrote to memory of 4640	1192	msedge.exe	80

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdf7a63cb8,0x7ffdf7a63cc8,0x7ffdf7a63cd8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:4396
- - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
    "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3584
  - - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
      "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w00000234
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3044
- C:\Users\Admin\Downloads\CryptoLocker.exe
  "C:\Users\Admin\Downloads\CryptoLocker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2768 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:1072
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:6232
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:7736
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:6140
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:25788
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:15084
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:13592
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:15172
- C:\Users\Admin\Downloads\CryptoWall.exe
  "C:\Users\Admin\Downloads\CryptoWall.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:3968
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    - Drops startup file
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:1960
  - - C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      4⤵
      System Location Discovery: System Language Discovery
      PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:16764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:17176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:17744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:18476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1120 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:18440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:19920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,12407232347271634255,9139497815482223704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6648
- C:\Users\Admin\Downloads\PowerPoint.exe
  "C:\Users\Admin\Downloads\PowerPoint.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:9476
- - C:\Users\Admin\AppData\Local\Temp\sys3.exe
    C:\Users\Admin\AppData\Local\Temp\\sys3.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:19648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:252

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1660

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5028

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:20012

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
PID:5172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:20988

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES ENCRYPTED.txt
1⤵
PID:15180

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
1⤵
PID:15736

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39e3055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:11584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1537126222-899333903-2037027349-1000\$R9ZIQRF.emz

Filesize
2.5MB

MD5
6b3b9c39a09c45e23e8f674a90f350b9

SHA1
de8636a555f828a05cc3bc113deaddca2fe8abb8

SHA256
bfa41bc2056cf6eaa99fa76545ecd2590cbd1515db554fb6a75678e1c25e34d4

SHA512
42d220d9211244397a9b5adfa7378a8985be8f3201595692d8deeb76a3e74bdcf5f493363cf96de12529e10ea0ecad8d51ca05c2abe705daa42020e20e1185f0

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-7400B7B5.[[email protected]].ncov

Filesize
2.9MB

MD5
1b5d8e5c74ea4904a184e4eedf8b3038

SHA1
3f50e00ae2d576d26b14069e0fcf041e69e34103

SHA256
425235b7a7907756b20bc8eb1ca55731358ff3572e5c84d14c8b2d1b1a8ce893

SHA512
53bcb05fc84f30d0dfd4a3cf9eef63a71919c76a4acb5e0968ee30c116db714fdbca674e1c07594601536fb5ee10c9f5852949d9be4e2e9af057473d6481b474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d090669-8450-4dc1-8ebf-0905796d6c9e.tmp

Filesize
1KB

MD5
ba0fbfd714be5bdbc623c9bea189b2b6

SHA1
8dc2f04a7b25abfdac5c56ac3c35cb1d0a716f5b

SHA256
5c80a360ec7091b8f85833c57e820ad7d7b85a98f3ef84d58f51508783f56e73

SHA512
acf690f5fa250b7ed8f9b2112ca82c9edd54cc247c27b1edc9431b07eb959f0c641cbfb5f65601d0cf818ca4dd12b8e699082858d95531f17569691e8ba0a76c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9a016e56edf5b9383de672a527b151a7

SHA1
a8e31029dc114eb1f5b523d06a85ec09ef374c92

SHA256
2bb650b57986df12590923b6f614776dd7325d8d034821a58bc246531fc62d49

SHA512
be50f167e91ed1406231b6923bf707faa74f270eea498eb3c6fb1fce4617ce8f9dc3a838607f030088219c53476d25cff915a3f58affb388e308b2d128ee35e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
d01be2bc277307bf760669a4f350a984

SHA1
64859376f5718ae3b4e6979a9f029ceaebf91fe4

SHA256
de4ea8f1d2393892282b2e5ed049c0817630e9350e541f75ac9e9dc832967d41

SHA512
a901a5b217e43b9553b2dd6edcafea6a97ad56ea0e94726e578e167409fb8218d7cd5b029788186a5ceacc2ea706f37a6d498ed6915d40e25e662501d02df94f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d215d8a8570421e7ebd50cd2cfc737d5

SHA1
b1a57cbc5db2a2629b908b9cce3fbd9841d4f71c

SHA256
84be277259a91948a3da433a0752cdb5ed793a28b699ba8c2f2eda1d339245b8

SHA512
cc74f5357c8d1fe38f860b95e3e860fd6659a3bc97986c5f0f26c25231bc0ceede868dd8cc1b86a142ce72f8b75cc5ab17e3bb44c72a805abd52980071ab5f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffe7701440fd7298be754a216f71a3c7

SHA1
92ae4a153465339af2d153679153e0450f3d3c86

SHA256
ddadbbc0c0fc336851116aaf638a48ff5886a126c54acc8abf289efe2bf0d711

SHA512
fb0ba9296e34607deb95a51f0616d3acbbe1c6f8734d22e7e456442548e98ae681eacd83904dea8536cf74c4912d567401dc90d128cb4e932901edc273190a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52e4eb6eec41425d6aa43162f7a591a2

SHA1
a34c46f93b5a688970a2992b6eec57f24bec253d

SHA256
f8400713eee3bf1e1f517b1d0660478e248a1e314993e17a0ebfb48324a36236

SHA512
8d62b89eca352135e8aa46bd8e0c839f163f3bd7477fc46e5d63260972f0245af0afb4a50dc98e31404919f5d2f0a9a5d7e444f46d3fbd97eec51971482ef89f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ff53996a370a4cad639ac0502ee0044

SHA1
ac9dbee090f11d0c07d2c0bbfe432530118b3b17

SHA256
a529ce24648f9e0f4d0a18b06ba907a783adc5bad018b2c22f0f6ff3c7484c46

SHA512
37cbedf1f179830d3cda897f65d19dc0957669cad930890599ef790f2a2189bd59d7f3af40992096e318066f10624605c1948bc17ae737658cd1b1da1dcc2cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c352d004dc59206727133c3998835cd1

SHA1
4146b94db443bdac1eee510190ad4efb51949cba

SHA256
b00a838779e6f758eac12034e93c1cd6bac35810d521f063a0d418dd4079a232

SHA512
580ce14506b04306baee812f25e28adfaad81c3e92bc02c1876792e9365e80e12ce07023bb6045a904d1d9d5d668021f831f283ce59f8aac2d5795d7a9da5163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
de8ec9019dce19db9a091dac7b9ed577

SHA1
7c9ddac2415c64731c7d99aa88a08826c7a8f441

SHA256
4a5932c4bdc7372ee365e68c83259d0a8fef281800ca651ef443f0871eff1eb4

SHA512
0fefc6a8ab85776290a6923c5b4681616f5a37bb0c99d065cde795318b5ef21f99d28afed8d06711cae1a3d63c96d90b93b8bfe8fc5e559f491d5fdfb140440b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e1ecfd5d05e5b96f899a32ecf6c698e2

SHA1
35777a5a01733d490ec7fab70f012c55e9f919e1

SHA256
181cd2de5e94bc44498f793cc470e0be040305e551480dfe84421221b4abeb1b

SHA512
63478993a36ea740ef3b4bdb356d9de4e7a00880d332d0bde2b3adb7409bc91132bd2966861c5f5505fdeafdda040e3988bb2431a40c0b4ba54579ac78b9d28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
46ab1c95ab3b1946b64588c734aa58df

SHA1
1cff49e490e5ceb182515cca891fa231746b1ced

SHA256
5754e39a4f1836ca6f4585ca6f2e00eb839844fc2a217bd3b193e5584bda9a8e

SHA512
bad18e5b4d2b78888d0fabc975aa1d6e9fca86764ddc5dbcbe5349381867ebc8459d4f8d1ddd2227a84a02001dab437b84eda9755f1c2175a41ccab44ce28e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e16e3a9642499835fdc92176bdad34d8

SHA1
bf3921564ac12c16af3c001988372ad858c3b30d

SHA256
e5692856970c5eb49d5394c9942ea49e2779cb9a3f97f9bf014fce062a2909f7

SHA512
8e7298c6fcfbc76b5e0f12070d241fae0dca8738441b0970c0852dcdfb2676865e630ee82be5c74ae0b8e8621e8b156306ada86cc35707a1c5f1e07f26114a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e34.TMP

Filesize
874B

MD5
b6a5ab6a9bdf63d892c8e12a8c750e6e

SHA1
3e2409544517ca24a9935974d521a22c7ab325bd

SHA256
e0d90e6916370692f9196cdaaf285d91aef45555e6a8930dd1b270e081cedcd8

SHA512
39e2a30e1258b49cbfd0166652fd2a1fc8584f3f7b8eb16ff6bd0351215b77eb970bed870c8b469ff2532bc130312d3dc147ca673cf10d0c225a7f41454dc02b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5ba267.TMP

Filesize
1KB

MD5
d61e8acb97d8c2ccfac1f72d4a732179

SHA1
d41e77a02b7e3d100ccdd3bd95913b90bd35f019

SHA256
fd06c50d3008829db1449c5ff0e70909c6a1f007b1b4b73f5567dfa819c49a52

SHA512
a7dc0f547cb5ce8f76d27c62c367489980d7d00459683f914029f522d9f378c4174b61be1104228dc87878831f5ba6262a1acdb0cb02b90f7483a03fd8ea12c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec205fcb-926d-419a-8b8d-4256940bf5d0.tmp

Filesize
5KB

MD5
562ae00862796dd4adba769127a04a91

SHA1
736fbac04e519698a1b393f5a08973e578e79d97

SHA256
3ca99ce897eda3ed04cb0b303ab8354a8bded8954be172b3070d281a839f2e03

SHA512
56f5c3fbe30821220bb5715410c91c278b74b6484ecb7db66b99bebc4eebd3abead205d3758902420f21c8d7b69092a37be3f952684da28714c5a858a3af4ee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f28d87c31cb5cd305b40c4554e4c708

SHA1
19405d27d3b95a4832f6e7fdfcadbd7ec08b5d9f

SHA256
cb68e308ba9f2ac1074da9a54617f30f647baac74113e3b41a19b3d5cacf0632

SHA512
30c1cb1c4d289d5dbc169e6b6d27029fd549ef60798c3f04b249d7cb2a005f796677d8b8551c7be5b02ccc0db6cb7bc7fc1661f45aea3bc075f82e8e74124940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0da34a93a2d6e62d662cf52c4859c8c8

SHA1
3956f56afa8ffb38f6446e6a3125ac26137a7810

SHA256
82be8925fd04e7f42d6b8829f3fc584029e40236de9dcbf2c44f1e3da9b1d733

SHA512
1687e0cc7704cf3976b805354d97f427a260a5234c21acf4f2d022b9c4c56dfdee8c9bb1a8150d97d0c27772b0489e3ffb89add59bac75d19bbbe89f4d595855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
575f65acfe346a57821a8589af827f22

SHA1
32e18eda4b5bfcaa7951c065a01a9c8b45e8cc85

SHA256
7822bce4ea332df9f045f3823339722c383755e4bca2464fc6153a8700f1e27b

SHA512
34191ebb6f316392c5438dec12e316b7d4962931bb61acbc733456f5d8de735e0e10df1fd136caf02625e4ca858754a20b90fbea72cc70e85c480bd0243bf528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fe0b5cf5771e25ae3c1789065eb6cc34

SHA1
8aaf457275b8ace48513bb65b2fa0d60036760ac

SHA256
08f85e9ba76f66d490af6e8327cd4922ad200c1f4b1e8254f1adad702f41d988

SHA512
ef2522c14984d3631e897fc410be6428b71d7d6152f38b49cf9ada55192895f0a6fe8c99ef2f62bb037ecbf6b7bf382ae66ee2ea5d5c6a4ee2b1c38db9144ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
769a31f25d3264c275035ad4ac1e9dcc

SHA1
0e324f99fffa04eed1e5e1200e69eae73e19989e

SHA256
dcbc9adc41a191537d093a4307fa541e6923403ba12e5c06dddbfed01dc84a5b

SHA512
68f8451c15157ada6cc6badc03357f0cc71849f466dba07b76a6b607a76922d4a6389f05bed2a203e2de7b14589c7aac9966bd325dff615b8981909663b8009b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ec898edc4a23601b359e631203aa77c9

SHA1
1e400fa05c2f8fa07bb65d16858bd9cbebc57e3e

SHA256
d49b49a07a55b4547729e02a85d242f97e997519511f0f612af4d3ee37d6f662

SHA512
406644bf7104ac38fe51a94b419c1c9ee11786fe698e7f60ee599194d5652e9301c8e822a7acdccddf5263c474c8dee83f2c3344e6ca7ce0e4f90e377a493756

Download Submit
C:\Users\Admin\Desktop\ApproveSend.ods

Filesize
463KB

MD5
a8c81f8efeab7669087028fbe8b4ee1f

SHA1
561a3a6fe6fbe825b42c356a40a4fd4477356072

SHA256
b978a371b0fc321005383d4cd1584b62ea79ee7fcaf8474686afa0e95dcf2440

SHA512
9466810641b3f75650f3a7d563d1206dd9151e53808103103c063007d094b8cd40e405d584c9efe7e040a72b9450fa1fab5da24eb7aa2a1cdd6c16a44b3d5f7f

Download Submit
C:\Users\Admin\Desktop\CompleteGroup.ico

Filesize
683KB

MD5
bcf8259cdddcbb3e3af66b389097f8ba

SHA1
36f48fe566175358d0ea67d51d98cfa6cb571e46

SHA256
df838109c86c83dc946a4160478eb0411ad13c4e4e3603edfe2838d0af530b8e

SHA512
568fd4ac1e56fde433b41e7df93eea94a72fd08cfaf94ce82e708ef9fb64da46671c2558f07552b5e16ec52283247264a737810bd9361549b71b821c322af9cf

Download Submit
C:\Users\Admin\Desktop\CompleteSave.dotx

Filesize
1.0MB

MD5
b7e55dfecdbb8d6f75bf7972e7b2c4aa

SHA1
c72b24cdc635ddf52893ab050089a8fc88fc822e

SHA256
530f36c6f6fd954a9240bfd581522094136015a20e3a1c8bc917a5eeb5364989

SHA512
237f78ec18a9b945e8b0522d838846df127df37ae895c461018672acaedd630609098e7c613b1b38219b227739ed2d7013f845490e5f07ba7fdf1e77c89f5a09

Download Submit
C:\Users\Admin\Desktop\CompressUnregister.ico

Filesize
1.1MB

MD5
c5f12f81e75ef0a845bfafa0c2a12da5

SHA1
931ce42994164a6889a0afa307ca3b90938316df

SHA256
20aa0d0a32b7da4a43ddcbd0858cd145145cc85db3823821773a725f03512bf0

SHA512
45ebb3498c7030e768d395caa37ef7b7dc67d460d36bc0e3b0c7fd6be8dc81e48412b9af74b62df81becdeb94de81ecfe7adc2f195e8420a29726aafde9c87e5

Download Submit
C:\Users\Admin\Desktop\DismountDeny.xsl

Filesize
507KB

MD5
125a8e0a5a1d8d4b28e13ce22e3cbe26

SHA1
57f6dc211f8f1e379bee657739d65e3cb293eaa2

SHA256
c542dfe456154e270e232a9a33a550a74ffe7f8b2bed0a04a5d4cb87188aca45

SHA512
aef79f123644ee00a5e2f5ef26191e302c5b644b65e798b6d733ddf506c69c7df9f3acca1c18b0cb77dd49e5db472b580edf3669f7e3cb86f1c853fea4b36e69

Download Submit
C:\Users\Admin\Desktop\EditFind.emz

Filesize
1.8MB

MD5
77496f0c31de34b72926e2ced0a16332

SHA1
21dcc90dfc697319d17dfcbd6868f2a4ee88f6bb

SHA256
ff78d0698c99de9ae41adaba946ae435e25b20cee7aa1fa1f5a7ed38be9eaae4

SHA512
1850baa2f929bda0e091660c6b58e42fa573f0013365156e3aafe25ccff0ae30e07f2490a243fc10238836784affe98cef322b0bb35cd1c237d71f79404a9899

Download Submit
C:\Users\Admin\Desktop\FormatPublish.scf

Filesize
816KB

MD5
e74ebe6d9c29e54f003ea7bee234562c

SHA1
b0fc399b5851cb30fe3dabbb0206ebbc5b028058

SHA256
6fff23ce54337ba28ebbdb81262d08e8b29396f89c68e7df960b66d9a6529219

SHA512
69535a1e82b74ed0105db6a1ca3c87273768d0a06e6f5f6e2fae3535348ffdf1c16bf728e271171e53dcbf46a8cc8350f02d8fb461b430a1522c5c1618cfc32a

Download Submit
C:\Users\Admin\Desktop\InvokeGrant.ico

Filesize
551KB

MD5
b01e0def7b845bc1f5cfe8d38f053654

SHA1
577b456b077ca4c9e0739cd7ed1c5dca48daac84

SHA256
8313099da3bb3c35c72ec888835c7624f6c2f57582bc6496a78c3fc28c16a1dc

SHA512
3405021c59b8e38037d9892d6f7b0c30f933f314c6c0b20c5d109824d64ea9745732fdce203c5600f6505e2e2d9b3fde90c5d8cf5925da62f65600190d90c17e

Download Submit
C:\Users\Admin\Desktop\MountDebug.dll

Filesize
904KB

MD5
7cf40fa0fcd5cfffe9e751e0fa0af093

SHA1
d4bb347fcd8b80d2cbb30669c4c2512285f5c3cf

SHA256
86ec841f2abc1ac5eeb757649d0c386ef1a9bc5a14d7732e14b4908242f996bf

SHA512
3faa73621cce39a8689896a21843180dce1d8135e976acbca907d748d2e5092aa2ab6404a7062597de1faf366824f66126e5baf4271e4a08d28df2ef4fab9d03

Download Submit
C:\Users\Admin\Desktop\MoveRepair.mpv2

Filesize
595KB

MD5
e523039a383874a8b1b884a43230c997

SHA1
2ed5f4935dcd4b9fed7d9edca6fbf220082dcff8

SHA256
84b39f99947267a34c5c111e35514f65635b715a41b9db9392af302eb0dc7f3a

SHA512
2a9be4bff3aeb28a63f2be5e7968c36ec761bcddbc3a627a6038662d418f926ae6e7b6316ab9a0d5511e04f5a3cecee6ee6a351dd61e238bc8dbc1e43f8be742

Download Submit
C:\Users\Admin\Desktop\OpenReceive.svg

Filesize
948KB

MD5
cf5f1a0b2e6107d688e27b324a8190ed

SHA1
87d1b59440953485660797a60d7ff85ff87b00ac

SHA256
688d99ef137196076a9880f8c6cbeba04de769c9bb242dca782f56b5b1a6ccf7

SHA512
08319d96992a6debc932abcbe7ceb2c6ba07eac0583b3740ee6b40f522681b4d3bd2195897ee7d39ff2616279ba058761d80e93d56d7401a07270a2624514b8b

Download Submit
C:\Users\Admin\Desktop\OutUpdate.odp

Filesize
727KB

MD5
906e0e5ade1df397b057417e245f7ec6

SHA1
a55e44d52607957b633ab16633b5c2e84106981b

SHA256
0384f6de84c3575b80ff7b6b52120ce41fb826627821c57c77d33e52a62cef0d

SHA512
77cb39e6d22af217eb17eee110ebbfdda14b55e2b1d6008cb0523b522a27f42743613b2eec706354faa837f7703b24a575d3f6b9479df8c169f33123ae1ba2c4

Download Submit
C:\Users\Admin\Desktop\ResetInvoke.ADT

Filesize
1.2MB

MD5
cb43533b0aa0bca0295db39a2f0a1b07

SHA1
0205a8c5bc5c316684ea06f32671376ba428c084

SHA256
4c90314aa9207fb93b0c497effc04fea485246e600b2e1f7fde7668041f7c019

SHA512
eb11dc78c27fe7d5b811f8a8b62d0659e052293657ad28ae7882af1fb9abb47ce2ffa68e3482b55101ff75449bf1657bbf1902a5132628af140b781677f1c8c6

Download Submit
C:\Users\Admin\Desktop\ResetRepair.xlsx

Filesize
14KB

MD5
644e844b7b2dca087690f09d02124514

SHA1
0f58f1313dc19505235557e610eb0c7724dc98aa

SHA256
4ea4942d98f32f389ab8157434c4cbd21b53f44a76759a5713b7a9452083f9a5

SHA512
e882d3275c760a98379477aae69260de8423337607e67cacf3c5588e105e0fd9c6d5d0df2a5eb0f474f2c1825adbf27b96a2df73cee1b4e3f06d07cd2c0247db

Download Submit
C:\Users\Admin\Desktop\ResolveCompare.gif

Filesize
1.1MB

MD5
664a7197c6917c5aa8d0457e9ca3ae4f

SHA1
e537ce01e5991460d8b42dd5a6f182ab02da1a6c

SHA256
c5cb7166308a698d0938dd4fd7eb12661d4ab2836d50a2587884f93d3c6a0775

SHA512
063be1cfef88be9ce68165c1a0f337747d8db90b4d1f010f47f5101a2dbb6e0193e859d38f3d36642826ad417c7105e46d0aab8e90828d805dcdcadd01364525

Download Submit
C:\Users\Admin\Desktop\ResolveGrant.jpe

Filesize
1.3MB

MD5
f8b7f103211d40761f304854d1fc177c

SHA1
6575bad3964685fb04a2a396788f8db424f0f918

SHA256
408dedbe090625cfcb95d1c788b4abb22e678f900e37c915d1670c5e60265d81

SHA512
65622365409abbfc1d42da895d35d433f5d60f5b524eae451b66f13ef18b2ca3500cbc6c39a475b738c3f07198a1112a1d780302c49a3f9a050706a466bfa66a

Download Submit
C:\Users\Admin\Desktop\RestoreExit.tmp

Filesize
639KB

MD5
34c7d953e65e7899dee216ce0288d06c

SHA1
884baecaf81ef36093ed1515cf5e23eebfe9bc5c

SHA256
b2271ca02d417d6e404d2c12627ac23084f99f310e984571cb0a86d7b6f55223

SHA512
7f015caf2d46e23a5ab7bc4a5c89c59674cc7e11cd666248923dcb7e0107b2b1653919c0df4b548b6c82c37eb1cd657b54ae1ae1a8d752a9979c76eabd9ccbb6

Download Submit
C:\Users\Admin\Desktop\RevokePing.xlsx

Filesize
12KB

MD5
fc83baf32220535566b1390dcf6541ae

SHA1
bd5ae1614e552be379fc687405a91f2d3f543019

SHA256
f8babc6219523bd97fb533f735e4585083e737c25a868d26a2ef6b343d7e7165

SHA512
da0dd1d893adbf05ba1d7cf3ae9e39f47b687ad3e4b4e445e760d766c8e04f3a0faed8ea557a4343a1c798bc76c942dd88aefff1170ed2f9c9879db11fd81c97

Download Submit
C:\Users\Admin\Desktop\StepResolve.eps

Filesize
1.1MB

MD5
d2d56598747df3540c2ccacb8f127153

SHA1
c88a14ee04011f2884a5eb93eaf6d27bb0355cde

SHA256
277bd2d6cf4eb795845c4bbe1af10c0507c74040d3e34a32c41cc7188a9d26e8

SHA512
415f43bfcfb72b93fe145d91d7c2f43bcc344e4e2a1b5d3a34b5774c1a9278a0c1bc11db815db06e696311bd9359b3ae7c9e48dd8c97dda9b404b9905737561a

Download Submit
C:\Users\Admin\Desktop\TracePing.pot

Filesize
772KB

MD5
373507b5abdb7e6096c43a2a99380bda

SHA1
07e4523e6b3e0b54908e6e50c88281eed7cdd533

SHA256
13eab9e883574a9cd3e321c9db1911bdca625d4fa72694b7ce42037dc2695a61

SHA512
e85a6376094e1256b27aa272db3dbe186219a8e973d2310e10a9d7f6fdc23e52c3c7d5ca978ab7a4f986334cdafdc1ff452f5d03782b899f7b4cc3c018392a78

Download Submit
C:\Users\Admin\Desktop\UndoGrant.xltm

Filesize
992KB

MD5
31985af2838c3826455c01396d1bf4f4

SHA1
0c107cf46efd866ade243519ef1e0a2bffa12ab7

SHA256
5644a9ac7212cda897dd5568efdec65621974c478e1323af324fbedfa1ccbdb7

SHA512
45eb3aeba4fb919567873d85e41ad219af52c0b5419180652fd4d9838dc20e15a7a303e7f7b5074c0a2afb726510d9b4a37163c119af8602deccd3dbc488518d

Download Submit
C:\Users\Admin\Desktop\UndoUnblock.gif

Filesize
1.2MB

MD5
6ba86abec67cb34ce69032bf242de99f

SHA1
bbfda49ed4a64cb3d074cb3975de3d634647803f

SHA256
21639dbfab07c2cba6fddc6304fe6ed9f0f180d03efd354eb9670f9a5daa6134

SHA512
71ad46237b2962e155a93ef32124278bf7a0f39bb9b1c9336517ce8d574189f1028522348091f383f2f9294fe88bca130a1f04955711b968ba6c1f27a7c34d8e

Download Submit
C:\Users\Admin\Desktop\UnprotectStep.pptm

Filesize
860KB

MD5
136baadffa245ca3bde9f39defea7acd

SHA1
64a63ea6ddf7661eb854c69eda19e38aaec330f8

SHA256
5925eee8842f05b8935650bfa5329081d0eb6437a577f0baa5870de6a046746f

SHA512
fdc65ba4741fa438cca050e7175e2692b26b32d6c7282697052529e6571f86b2f4d9aadd66078f03adeec4d5c68eb46006edf25b661f901cbf49255cdfbc98a1

Download Submit
C:\Users\Admin\Downloads\CryptoLocker.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\CryptoWall.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 156618.crdownload

Filesize
184KB

MD5
c9c341eaf04c89933ed28cbc2739d325

SHA1
c5b7d47aef3bd33a24293138fcba3a5ff286c2a8

SHA256
1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7

SHA512
7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 245483.crdownload

Filesize
136KB

MD5
70108103a53123201ceb2e921fcfe83c

SHA1
c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

SHA256
9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

SHA512
996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 245483.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 308148.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 665611.crdownload

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 818061.crdownload

Filesize
132KB

MD5
919034c8efb9678f96b47a20fa6199f2

SHA1
747070c74d0400cffeb28fbea17b64297f14cfbd

SHA256
e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

SHA512
745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

Download Submit
memory/1136-4622-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1136-484-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1136-501-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1872-499-0x0000000000520000-0x0000000000545000-memory.dmp

Filesize
148KB

Download
memory/1872-25369-0x0000000000520000-0x0000000000545000-memory.dmp

Filesize
148KB

Download
memory/1960-486-0x0000000000130000-0x0000000000155000-memory.dmp

Filesize
148KB

Download
memory/1960-500-0x0000000000130000-0x0000000000155000-memory.dmp

Filesize
148KB

Download
memory/5028-351-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/5028-352-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/5028-354-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/5028-350-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/5028-342-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/5028-343-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/5028-344-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/5028-348-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/5028-349-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/5028-353-0x000002586D710000-0x000002586D711000-memory.dmp

Filesize
4KB

Download
memory/9476-25367-0x000000002AA00000-0x000000002AA24000-memory.dmp

Filesize
144KB

Download
memory/9476-25361-0x000000002AA00000-0x000000002AA24000-memory.dmp

Filesize
144KB

Download
memory/20012-9218-0x000002F3E8F20000-0x000002F3E8F21000-memory.dmp

Filesize
4KB

Download
memory/20012-18311-0x000002F3E8F20000-0x000002F3E8F21000-memory.dmp

Filesize
4KB

Download
memory/20012-18312-0x000002F3E8F20000-0x000002F3E8F21000-memory.dmp

Filesize
4KB

Download
memory/20012-18313-0x000002F3E8F20000-0x000002F3E8F21000-memory.dmp

Filesize
4KB

Download
memory/20012-18314-0x000002F3E8F20000-0x000002F3E8F21000-memory.dmp

Filesize
4KB

Download
memory/20012-18315-0x000002F3E8F20000-0x000002F3E8F21000-memory.dmp

Filesize
4KB

Download
memory/20012-18316-0x000002F3E8F20000-0x000002F3E8F21000-memory.dmp

Filesize
4KB

Download
memory/20012-9217-0x000002F3E8F20000-0x000002F3E8F21000-memory.dmp

Filesize
4KB

Download
memory/20012-9219-0x000002F3E8F20000-0x000002F3E8F21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads