braincipher | da2c61b069db32058791304408c57922263cedaaaf28230fe787b63be71d5d5f

Resubmissions

26/02/2025, 22:29

250226-2epdjsvygx 10

26/02/2025, 21:48

250226-1nyg5stzdt 10

21/02/2025, 20:45

250221-zjsweszqar 10

Analysis

max time kernel
71s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2025, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

brain.exe
Size

147KB
MD5

448f1796fe8de02194b21c0715e0a5f6
SHA1

935c0b39837319fda571aa800b67d997b79c3198
SHA256

eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
SHA512

0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831
SSDEEP

3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4

Score

10^/10

braincipher defense_evasion discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\sYMY1N6ah.README.txt

Family

braincipher

Ransom Note

*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: M8AL5cWJEU5CnMMPwCdt4x9NVn0ZY2uNtIgnKwkDJwdPbnanVROYFzGmgUCImexTGDmINYgSZXdlhM7D199lNMb294TGY2 Email to support: [email protected]

Emails

[email protected]

URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Signatures

Brain Cipher
Ransomware family based on Lockbit that was first observed in June 2024.
ransomware braincipher
Braincipher family
braincipher

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	7C15.tmp

Deletes itself 1 IoCs

pid	Process
4952	7C15.tmp

Executes dropped EXE 1 IoCs

pid	Process
4952	7C15.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1294999112-580688058-1763548717-1000\desktop.ini	brain.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1294999112-580688058-1763548717-1000\desktop.ini	brain.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
4952	7C15.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	brain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7C15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3976	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe
2400	brain.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp
4952	7C15.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeDebugPrivilege	2400	brain.exe
Token: 36	2400	brain.exe
Token: SeImpersonatePrivilege	2400	brain.exe
Token: SeIncBasePriorityPrivilege	2400	brain.exe
Token: SeIncreaseQuotaPrivilege	2400	brain.exe
Token: 33	2400	brain.exe
Token: SeManageVolumePrivilege	2400	brain.exe
Token: SeProfSingleProcessPrivilege	2400	brain.exe
Token: SeRestorePrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSystemProfilePrivilege	2400	brain.exe
Token: SeTakeOwnershipPrivilege	2400	brain.exe
Token: SeShutdownPrivilege	2400	brain.exe
Token: SeDebugPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeBackupPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe
Token: SeSecurityPrivilege	2400	brain.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe
1248	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1164	OpenWith.exe
4488	OpenWith.exe
1248	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4952	2400	brain.exe	94
PID 2400 wrote to memory of 4952	2400	brain.exe	94
PID 2400 wrote to memory of 4952	2400	brain.exe	94
PID 2400 wrote to memory of 4952	2400	brain.exe	94
PID 4952 wrote to memory of 780	4952	7C15.tmp	95
PID 4952 wrote to memory of 780	4952	7C15.tmp	95
PID 4952 wrote to memory of 780	4952	7C15.tmp	95
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1596 wrote to memory of 1248	1596	firefox.exe	108
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4008	1248	firefox.exe	109
PID 1248 wrote to memory of 4080	1248	firefox.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\brain.exe
"C:\Users\Admin\AppData\Local\Temp\brain.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\ProgramData\7C15.tmp
  "C:\ProgramData\7C15.tmp"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7C15.tmp >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1324 -prefMapHandle 1604 -prefsLen 21257 -prefMapSize 243020 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0007c249-a5db-4fe0-85f5-e6d41edfe1fc} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" gpu
    3⤵
    PID:4008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2372 -prefsLen 21257 -prefMapSize 243020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1021ef9-906a-450a-8884-e2d50b937d12} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" socket
    3⤵
    - Checks processor information in registry
    PID:4080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2984 -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 21326 -prefMapSize 243020 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4a33bdf-eaa1-47f9-ba9b-9a40a4f8ee59} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" tab
    3⤵
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3296 -childID 2 -isForBrowser -prefsHandle 3456 -prefMapHandle 3476 -prefsLen 22178 -prefMapSize 243020 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4aa0904d-6f66-4568-aa22-4dc86ff4520e} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" tab
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4524 -parentBuildID 20240401114208 -prefsHandle 4516 -prefMapHandle 4512 -prefsLen 28819 -prefMapSize 243020 -appDir "C:\Program Files\Mozilla Firefox\browser" - {068f5b6c-6a7d-4ea1-b32d-6404964753f7} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" rdd
    3⤵
    PID:3248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3024 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4980 -prefMapHandle 4936 -prefsLen 30082 -prefMapSize 243020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30204822-befb-4810-9fad-81bbf970d041} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" utility
    3⤵
    - Checks processor information in registry
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3076 -childID 3 -isForBrowser -prefsHandle 5028 -prefMapHandle 4964 -prefsLen 28165 -prefMapSize 243020 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {510530a7-ce43-4c88-b073-f1990abec921} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" tab
    3⤵
    PID:5040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5212 -childID 4 -isForBrowser -prefsHandle 5288 -prefMapHandle 5284 -prefsLen 28165 -prefMapSize 243020 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9bfc973a-d3e2-40f5-bac9-47bd789f900f} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" tab
    3⤵
    PID:228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 5 -isForBrowser -prefsHandle 5288 -prefMapHandle 4964 -prefsLen 28165 -prefMapSize 243020 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76c7d6fa-fa2a-4417-b05d-bee1edc655eb} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" tab
    3⤵
    PID:3860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5772

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\sYMY1N6ah.README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1294999112-580688058-1763548717-1000\AAAAAAAAAAA

Filesize
129B

MD5
c7321f6cfb77ce60c1fd4fe46ec7d219

SHA1
4f54959f5ea45cbec49fcb437deb90d41bb6a476

SHA256
11244f462ba90f47e7ed9691643889cb77edc721e7e54fcb399e01bc1e1a7aac

SHA512
148d67effcf8090daf2303d0b091bbad84dac016c9e9c0008db58929e703815565c8b47aac382c4e4ad27bcd05e8d4b4e9e478264fb59f2dcfe39cac2facd607

Download Submit
C:\ProgramData\7C15.tmp

Filesize
14KB

MD5
294e9f64cb1642dd89229fff0592856b

SHA1
97b148c27f3da29ba7b18d6aee8a0db9102f47c9

SHA256
917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

SHA512
b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

Download Submit
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json

Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\90a4a768-0b20-4a2a-8d42-7f0eda9684c6.down_data

Filesize
64KB

MD5
faad3309f53e37f503a2d45576f3e2c7

SHA1
6f4f63b15653f374390e36c3e3114ba301978b17

SHA256
a7c1bd4df7ac68ee0cad41f0b7e08e06cdd8e965ca2fdf4d5e9fa09589b0e5cf

SHA512
a48916939166015ccfd7c00dafb870bb098169b0738cbc011fdcf78fc0aaa2ed6c3d125854d0e58c143b66c9319e7d4d80be40cc7f9586bb1942ed277d5285fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\dd32f68b-87c4-404c-bf5c-528ba23d3146.down_data

Filesize
224KB

MD5
1733a31431022b43053ccf7238001c0b

SHA1
34b8a52f718b68d5941b3640e5cbba8fd260844c

SHA256
9dda4e8f7608cf92cea1e1dd2b52e4840c78f2726ec48b2ebb52642a437fb809

SHA512
04a604ef683d5886e1a44a01bd540147b9b17ef5e654f902ef7bf9212e0fd7ae6873a91502909963acd5b16fed764df397220c3a63e6c70fceaa8d97f1352308

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDD

Filesize
147KB

MD5
1f968f49166b34216f256cb225b22f32

SHA1
d56579010c9dc0ab40f5db971a5642a0376e0769

SHA256
a7456797e0a57f935489907b233d94789a27c8f948895705103ca6813b7339b0

SHA512
78070f27c06ce7f56aafaf82f8ca252737b4af2c4e102ac1d1d611f49a4f2d6b32a3bba2ba3b3978de75f9929de9d70febfff04ee8a7e365b0e0676ed8b01b02

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\87ycvuwj.default-release\datareporting\glean\db\data.safe.tmp

Filesize
2KB

MD5
68e75ae3a5d8b24d4ad8d2300f798a17

SHA1
c346f0ff0e9abd1feae9d11d80f099e61a0a13d2

SHA256
8100d779bcbae30f0b36b41e61c6ef2de890fb00010bdcf90b87c026c4cf63dd

SHA512
ceaff7a4ba9cc3dd782b3afcd99baf5715373010f70ef76825d54e45cfea5d0e543bad5ebc9550bdbc848b5b586f2c9dea6b327f1c67787adf1d932f00053a9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\87ycvuwj.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
c4d350d650cbaa6bf74b43d207aea60b

SHA1
5497179714ba0dbb4ffef479b9ad6dd4e724fa29

SHA256
ac42062985b649a0c18cb21ef969eac4f5ee0ed9b88c877a01110dc6eb36315b

SHA512
eeaa212caca7e5a782514495def4f432bc12feddd9448663692976b7b45ed58a7e16ee51b2fd768fe4b126ca0fdfa5d7f35cf9d6f43638d5974d2f2310fd5a78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\87ycvuwj.default-release\datareporting\glean\pending_pings\a115f874-eab1-45dd-81ef-af5df97920a1

Filesize
566B

MD5
09e5c2bf917e25f782e0fa59c7ae2861

SHA1
a7fdd2a11fa02de303671ba2ed459f6edfdd7eea

SHA256
abc4ab139fcf418ba2d6c9c0c851af341a55ac128c3839464659a125c3cefaa2

SHA512
513f9675c53ccbe91a0c60e3c5197ce5cb3903293f9fde626351b024a90ae508a19eeb7d28095cddb4230312defc93985f7eaf57528904a06090318f27cf9343

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\87ycvuwj.default-release\extensions.json

Filesize
34KB

MD5
0f5020866ce52ef30345b2cc61fea341

SHA1
bdde714f2883aa0c98a675b45d2b36696002a40b

SHA256
80f4cc7996ebf3865ffad34337af7fa8aaf43ba27fca47c244f71e495125933e

SHA512
d5ecfa9acfa81939bc11cefbf8dde1b5309a074ae477edf171e853ad8f0499052278375d7be7441479b8218c3b848629ebf7c85242c471a7e5212b6c4ca27d10

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\87ycvuwj.default-release\prefs-1.js

Filesize
5KB

MD5
2393359e8f3b75092356bb6e8c3420b3

SHA1
5f0c64fad8876dc351cad721cecd0ef9fb49ceec

SHA256
7e4d0fe996249edf1d2a14bcfa04711006f9327ec32d0e348045d119ee531292

SHA512
574fe8e4c15ba74a0b966d61a3f6829aa276cfc204c6e7970bd8f81de9a194df62a5aa0b9999fdb5f7d8b65fd8aa2821e344084e7584e2583fcebbcb92915277

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\87ycvuwj.default-release\prefs.js

Filesize
2KB

MD5
330a39a3361e3e8f3f61dc30c2eaecfb

SHA1
5eebc8e0d2e76edc9774790b66227a45068d8418

SHA256
d026e1f5ea61e415319e716c6bd4d1afa3f4c92063b6a5b96cc32f38185b7723

SHA512
31d0e95f57993f2077f8b56361a93e0bb58dcaaea80abb249e986174171b10600195468313de75556384fc878bf029d0ddb0714c875c8fc8fe43552045cc57cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\87ycvuwj.default-release\prefs.js

Filesize
4KB

MD5
c2ffc8fba024b6738bfa3fcfb6009f58

SHA1
5f8621bae55a2dcdc046d7723978ea66fe16cf16

SHA256
17d19e7540cd456900cc4ee338e80762a3d509f1760b5d83e2327cabd4b22403

SHA512
f77d0b0ec7aad0309c22ae1d8fab38d5f8969532971cb42aa195136741defe2f89f8133c0f3246315addbb9102ae3dfe55a72bf40a824be662cd5c6fc808c87c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\87ycvuwj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
48KB

MD5
5ecf0b7447aff6d208ce9820d11dadad

SHA1
1d878abee2d79493484ab8f8d43bbcd9b7f3563e

SHA256
820b685b5e701bcae0692b6a1c80084e06d82500de566941b3bbefeadf195642

SHA512
7db80a34e6b542e8d3e74f8b6337dfd748c31ea6ef3f499e58dae2ab3da9eadcdbeb1af92706fedf2e9520d49042a1b95c07a009a1d921b611f7b0f7e33802f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\87ycvuwj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
152KB

MD5
a278efd0e4c294e449b0725a95054cd2

SHA1
19ef73f817f8bb8d55d6af3aa0c5bd2659dd4fc0

SHA256
0c79bd0ec0f856b6c14dc5f05801b4f50de86f7ce09e3340035e6ec969512ea7

SHA512
48eb0d1751eea9f84cb15fc1ae0065f2e33025ed54cf8d6949f73637f3a45cca2bff1db7a4f9fae66e5ff36231f8b00daf5bec91195aab73b759c70a5d48136c

Download Submit
C:\sYMY1N6ah.README.txt

Filesize
1KB

MD5
deb2e0756d331362d57ad9fe408c4ff3

SHA1
870865aad7c7cccafbca0c1f50f7eecaedbd4bf1

SHA256
1ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c

SHA512
e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1294999112-580688058-1763548717-1000\DDDDDDDDDDD

Filesize
129B

MD5
e92cb6ad374148d0d97a227f29fa8b0a

SHA1
2fdbbeb8e66814f7561494f88908d0b949cd221f

SHA256
0e7347fb18f9161bd71d3c64869e061c204f1c9985fae10ec667ae6adc745090

SHA512
229d66542112831120901a9f029eca6221a9eb158656b67d09eacf78dd2a89bb5e2e0722f05ba7228690e404ae6bc153b84954486fa1d56a03637db0b8cbfabd

Download Submit
memory/2400-0-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2400-2700-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2400-1-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2400-2-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2400-2691-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2400-2696-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/4952-2729-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

Filesize
4KB

Download
memory/4952-2730-0x000000007FE00000-0x000000007FE01000-memory.dmp

Filesize
4KB

Download
memory/4952-2698-0x000000007FE20000-0x000000007FE21000-memory.dmp

Filesize
4KB

Download
memory/4952-2699-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

Filesize
4KB

Download
memory/4952-2697-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download