Overview

overview

10

Static

static

ee7221f0d7...e1.exe

windows7_x64

10

ee7221f0d7...e1.exe

windows10_x64

10

Analysis

  • max time kernel
    113s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v200410
  • submitted
    27/04/2020, 12:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee7221f0d74d03a613ca334aa6cacbcff381a10a1d0ded8a485c3ad1ba8530e1.exe

  • Size

    211KB

  • MD5

    32ed52d918a138ddad24dd3a84e20e56

  • SHA1

    11f455b32e8473353febc5995cef63497c5404a1

  • SHA256

    ee7221f0d74d03a613ca334aa6cacbcff381a10a1d0ded8a485c3ad1ba8530e1

  • SHA512

    13e49bb04813598ef5ab1e40a0a657091182bf8ec7b9d4a24bb6d162bfc01b232c910e6e85fdefc13dcded49438e5e6d996ca21a13ec2cd7a0d5f5a40c16a446

Score
10/10
ransomwareevasionragnarokpersistence

Malware Config

Extracted

Path

C:\How_To_Decrypt_My_Files.txt

Family

ragnarok

Ransom Note
#what happend? Unfortunately your files are encrypted, To decrypt your files follow the instructions 1. you need a decrypt tool so that you can decrypt all of your files 2. contact with us for our btc address if you want decrypt your files or you can do nothing just wait your files gona be deleted 3. you can provide a file which size less than 3M for us to prove that we can decrypt your files after you paid 4. it is wise to pay in the first time it wont cause you more losses you can send your DEVICE ID to mail address below [email protected] [email protected] [email protected] DEVICE ID: AwCLF5UTCV0RI5EL3UURzEURGZUN5YzN1AzN2UkMGZDRCZTOzUTRzIUQyYTMERjNxY0MFlDNyAzM5E0QGdTMyUzQwQkQ3I0N0gTQwcDMFNkN0kDR2YUO2YTODVjNCJjMxETMwQzM3YzQEljN4MTNxkjRDZkRyUTQBJTN1EjN2kzM2I0N0gDRDRkM3MTREdDR4QkRCdDMycjREJDMyYkRDlDRCN0QFZjN1UEODNUNDlDRBREN3MjRCNUMDFURyYEM3QEO4cDRChTMDVTRBZDNDNkQyEEMBFEMyMDRGJEMBNDNygTR0QUOyETQGVUMzcDMDNEN2UDNFVER2Q0MENzQ5kTOBJERygDN1YkNxE0MxkzQ0IUN1cjMGF0MzAzQ2ADRwQ0NxMkQCN0Q5QkQ0QTQBV0MyUzNDNTRBRUQzEDR0IzM4AjRwYUNFRERzQkMyYzQBdzMFNTNGhjM3QENBhjN0UDOEZzQxYzNzQjRwEUQ4EjM5M0QycTQ0Q0MFV0MzMEOFVTOyUDO0MDMGJjRGJTNzMTQ2YDO3ITM3IkRwQTNzMkM3IkRBREMCZERwYzMxYzQ5QDO5ATR0IUOGljRCR0MxMkM3AjM1UEMzE0M2UTNzkzMyMERyMERFNER0EkNEVTM5AzMBFUMwIkM4YUN2AzQ5YkMCNUOBZDN3cTNxYDOBJENGRTR2QjQyQ0MCJEM5IDRERjNyQDM4kDO1EzNGJ0QCRzM3MEN2YjMBFzNyETR4MkNxgjQ5MjMBNzQ3YkRwIzMwUUOGFDRGFUMzIDNGlzQFdzNxgzMCVzMzMjM4YjQFFUN3IkN0EjNyEERyEUNFlzMzQDN3YTQ1YDNyMjRzU0QClTQEJ0N1MjREJUN2YkMFZDN2UjQFljNBFjM5IzMEJEOClDO3MkM5ETOxEkM1UTN3MER2YEMyQEN2IjN3IjN1UDRDVjNyMEN5YDN2EEMwIUN4MTM2kDMBBTOxUENDBTMzQURxkTQwEjQ2kjRCVEOzQjNxYjRyEERzETMChTNDhTMBRkQyMEMGlzN5YTO1MDR1YzQ4QjMBVjQygTRDZTOwMTM5EDOwIDM1QkNxEjMFZTRycjQ2QUM2IDO1YDO1UjN2QDN3kTOCBjM2EUM0IEO2cDNBR0M3YkQ3UzNzMUR0MjR2MDN2UERCVDMGdDR0kzNEZjRCFTNGJDNBRTN4EENFJTOyYUQ5MzQBBTNxYDN5MDO5IDNBNzNwgjRBNERGRkQGNjREZERGJjQ3YkMDFzM1kTODFUOwYDNzITQCFEODRDRwYUNBVDOEdTR4EUM0EzQ2UDM2UzN0EUMwI0N5MUNxMkQxQDOxYEMCVERBJTQwgTMzEUN2YTQBNkNCR0NBZDMxMTO4UkQDFzQ5ATR2wiR1kDOwQDR2UUMxIDNFRTMDJURyEkQxETNyYzQ3cDR3EDOGhjNElTN5MjRBZkQ5MERBJTM2QkQFFTMFZ0MBRTMwUER1cDMBhzNDFjMCJjRCZ0NCJjQGRURFZTMGV0MGFjNxQjNwUDNxMzN2QTOBdTM2EkMyIzMyUDNEN0NFNjM0YDRFVDMFVjREFUQyQzNxkzQBVjQ3IzMCVTQ1UEN5UDOChjM3EENGlDREFDNFFzM3ATQGRERzADODREOwUENGZkQzcjQ2czN1IUQDRTOxQzNCFjR3QjQ3YkQwcjM3UTMElDRxMDRzMTM4cTO1QURxATRCFUMDdjQ5QDRFVTQzQ0QGJTN4YTQCNER1MER2EzN2UTN0cTQCJ0Q1MzN1UDO2QkRFNUMFNkQGNUO2gzMwUEM4QERyQkM3YTRCFTR1UjMEN0Q3MDOzUEO3QkRDJTMBlTQxIURBJkQycjNwQTQ0QDOygzN3EEN3cjR0QENxMEO3gDRzQUQykzN3YzNxY0QxITMzIDNzUUNxEDMzgTR0MUNzYUNxgjR5QjMFN0QyQkQxAjQyQzQCBjNDBDOBRUN0cjRDR0NyQ0M2czQ3IEOCF0QGVTR0MkM3gjM3kjRCZDMCNERCZERDJzN5EUQzAjNBdzMzUENFRjQxYEM1EkQ4kzQzMUM0MzNEBzMDhjM5gjQFlTO2I0M0QkQDVTQGhTREVzMEdDRFNkR3IkMEVERycTRzgTRxMUM4QTQ1QUN3gzQGhjRDRER1YEM1gzNGRDODN0QDBjQzkTMBdTQBJEM3QEO4QjRxITQyYUNyUTN5kjNGZEN2EENwcDN2UzNwQUQGRTQ4YTQ2IUM2YkM4UkQyYERENURFFjRwIzNwIDN1kTR2cDM5cTQEJDR2cTRFJjM5I0MFZkNwAzNFR0M0ETMEVUMFZENFNUNxgjMzM0N4YUNykDMyQkMDZUNxkDMCZ0NwEDMERDNBJEO1kzQBlTREZjR5IUO3kjN5ATR4MDNFhTO1YzMzIUQ4kDMFJEMDFDR2EzMwEENBZDNxMkQBRDNyITQGlTNDVTQxgDO1QDMFVjM3E0NEBjMFJkQDhjMDljQEFEOFNTOwUjN1YER3MjQ4ITO1AjQDJ0MzATOwUER1M0N1QzQwIEOGhjNBZTN2UERFREOxMEOykjR2UTQ2QDREVDMBZEMykjNENURBVTO1EUR0YDO0EkNzETOENERGZEO2EEO5UDOCR0MFR0MDNkNFBjM5IzMyIUOxUzMwQjRCRkMBFDODVkM2UTM3gjR4UjR4EUM1EEMxI0QDFkQER0NFFTOBNzQwYkQDNTOxU0MEJDRFNjQFV0N3ITQ5IENyYjMxgTN3MERFBTOCVDO1kDOzY0N

Extracted

Path

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\296333\How_To_Decrypt_My_Files.txt

Family

ragnarok

Ransom Note
#what happend? Unfortunately your files are encrypted, To decrypt your files follow the instructions 1. you need a decrypt tool so that you can decrypt all of your files 2. contact with us for our btc address if you want decrypt your files or you can do nothing just wait your files gona be deleted 3. you can provide a file which size less than 3M for us to prove that we can decrypt your files after you paid 4. it is wise to pay in the first time it wont cause you more losses you can send your DEVICE ID to mail address below [email protected] [email protected] [email protected] DEVICE ID: AwCLF5UTCV0RI5EL3UURzEURGZUN5YzN1AzN2UkMGZDRCZTOzUTRzIUQyYTMERjNxY0MFlDNyAzM5E0QGdTMyUzQwQkQ3I0N0gTQwcDMFNkN0kDR2YUO2YTODVjNCJjMxETMwQzM3YzQEljN4MTNxkjRDZkRyUTQBJTN1EjN2kzM2I0N0gDRDRkM3MTREdDR4QkRCdDMycjREJDMyYkRDlDRCN0QFZjN1UEODNUNDlDRBREN3MjRCNUMDFURyYEM3QEO4cDRChTMDVTRBZDNDNkQyEEMBFEMyMDRGJEMBNDNygTR0QUOyETQGVUMzcDMDNEN2UDNFVER2Q0MENzQ5kTOBJERygDN1YkNxE0MxkzQ0IUN1cjMGF0MzAzQ2ADRwQ0NxMkQCN0Q5QkQ0QTQBV0MyUzNDNTRBRUQzEDR0IzM4AjRwYUNFRERzQkMyYzQBdzMFNTNGhjM3QENBhjN0UDOEZzQxYzNzQjRwEUQ4EjM5M0QycTQ0Q0MFV0MzMEOFVTOyUDO0MDMGJjRGJTNzMTQ2YDO3ITM3IkRwQTNzMkM3IkRBREMCZERwYzMxYzQ5QDO5ATR0IUOGljRCR0MxMkM3AjM1UEMzE0M2UTNzkzMyMERyMERFNER0EkNEVTM5AzMBFUMwIkM4YUN2AzQ5YkMCNUOBZDN3cTNxYDOBJENGRTR2QjQyQ0MCJEM5IDRERjNyQDM4kDO1EzNGJ0QCRzM3MEN2YjMBFzNyETR4MkNxgjQ5MjMBNzQ3YkRwIzMwUUOGFDRGFUMzIDNGlzQFdzNxgzMCVzMzMjM4YjQFFUN3IkN0EjNyEERyEUNFlzMzQDN3YTQ1YDNyMjRzU0QClTQEJ0N1MjREJUN2YkMFZDN2UjQFljNBFjM5IzMEJEOClDO3MkM5ETOxEkM1UTN3MER2YEMyQEN2IjN3IjN1UDRDVjNyMEN5YDN2EEMwIUN4MTM2kDMBBTOxUENDBTMzQURxkTQwEjQ2kjRCVEOzQjNxYjRyEERzETMChTNDhTMBRkQyMEMGlzN5YTO1MDR1YzQ4QjMBVjQygTRDZTOwMTM5EDOwIDM1QkNxEjMFZTRycjQ2QUM2IDO1YDO1UjN2QDN3kTOCBjM2EUM0IEO2cDNBR0M3YkQ3UzNzMUR0MjR2MDN2UERCVDMGdDR0kzNEZjRCFTNGJDNBRTN4EENFJTOyYUQ5MzQBBTNxYDN5MDO5IDNBNzNwgjRBNERGRkQGNjREZERGJjQ3YkMDFzM1kTODFUOwYDNzITQCFEODRDRwYUNBVDOEdTR4EUM0EzQ2UDM2UzN0EUMwI0N5MUNxMkQxQDOxYEMCVERBJTQwgTMzEUN2YTQBNkNCR0NBZDMxMTO4UkQDFzQ5ATR2wiR1kDOwQDR2UUMxIDNFRTMDJURyEkQxETNyYzQ3cDR3EDOGhjNElTN5MjRBZkQ5MERBJTM2QkQFFTMFZ0MBRTMwUER1cDMBhzNDFjMCJjRCZ0NCJjQGRURFZTMGV0MGFjNxQjNwUDNxMzN2QTOBdTM2EkMyIzMyUDNEN0NFNjM0YDRFVDMFVjREFUQyQzNxkzQBVjQ3IzMCVTQ1UEN5UDOChjM3EENGlDREFDNFFzM3ATQGRERzADODREOwUENGZkQzcjQ2czN1IUQDRTOxQzNCFjR3QjQ3YkQwcjM3UTMElDRxMDRzMTM4cTO1QURxATRCFUMDdjQ5QDRFVTQzQ0QGJTN4YTQCNER1MER2EzN2UTN0cTQCJ0Q1MzN1UDO2QkRFNUMFNkQGNUO2gzMwUEM4QERyQkM3YTRCFTR1UjMEN0Q3MDOzUEO3QkRDJTMBlTQxIURBJkQycjNwQTQ0QDOygzN3EEN3cjR0QENxMEO3gDRzQUQykzN3YzNxY0QxITMzIDNzUUNxEDMzgTR0MUNzYUNxgjR5QjMFN0QyQkQxAjQyQzQCBjNDBDOBRUN0cjRDR0NyQ0M2czQ3IEOCF0QGVTR0MkM3gjM3kjRCZDMCNERCZERDJzN5EUQzAjNBdzMzUENFRjQxYEM1EkQ4kzQzMUM0MzNEBzMDhjM5gjQFlTO2I0M0QkQDVTQGhTREVzMEdDRFNkR3IkMEVERycTRzgTRxMUM4QTQ1QUN3gzQGhjRDRER1YEM1gzNGRDODN0QDBjQzkTMBdTQBJEM3QEO4QjRxITQyYUNyUTN5kjNGZEN2EENwcDN2UzNwQUQGRTQ4YTQ2IUM2YkM4UkQyYERENURFFjRwIzNwIDN1kTR2cDM5cTQEJDR2cTRFJjM5I0MFZkNwAzNFR0M0ETMEVUMFZENFNUNxgjMzM0N4YUNykDMyQkMDZUNxkDMCZ0NwEDMERDNBJEO1kzQBlTREZjR5IUO3kjN5ATR4MDNFhTO1YzMzIUQ4kDMFJEMDFDR2EzMwEENBZDNxMkQBRDNyITQGlTNDVTQxgDO1QDMFVjM3E0NEBjMFJkQDhjMDljQEFEOFNTOwUjN1YER3MjQ4ITO1AjQDJ0MzATOwUER1M0N1QzQwIEOGhjNBZTN2UERFREOxMEOykjR2UTQ2QDREVDMBZEMykjNENURBVTO1EUR0YDO0EkNzETOENERGZEO2EEO5UDOCR0MFR0MDNkNFBjM5IzMyIUOxUzMwQjRCRkMBFDODVkM2UTM3gjR4UjR4EUM1EEMxI0QDFkQER0NFFTOBNzQwYkQDNTOxU0MEJDRFNjQFV0N3ITQ5IENyYjMxgTN3MERFBTOCVDO1kDOzY0N#what happend? Unfortunately your files are encrypted, To decrypt your files follow the instructions 1. you need a decrypt tool so that you can decrypt all of your files 2. contact with us for our btc address if you want decrypt your files or you can do nothing just wait your files gona be deleted 3. you can provide a file which size less than 3M for us to prove that we can decrypt your files after you paid 4. it is wise to pay in the first time it wont cause you more losses you can send your DEVICE ID to mail address below [email protected] [email protected] [email protected] DEVICE ID: AwCLF5UTCV0RI5EL3UURzEURGZUN5YzN1AzN2UkMGZDRCZTOzUTRzIUQyYTMERjNxY0MFlDNyAzM5E0QGdTMyUzQwQkQ3I0N0gTQwcDMFNkN0kDR2YUO2YTODVjNCJjMxETMwQzM3YzQEljN4MTNxkjRDZkRyUTQBJTN1EjN2kzM2I0N0gDRDRkM3MTREdDR4QkRCdDMycjREJDMyYkRDlDRCN0QFZjN1UEODNUNDlDRBREN3MjRCNUMDFURyYEM3QEO4cDRChTMDVTRBZDNDNkQyEEMBFEMyMDRGJEMBNDNygTR0QUOyETQGVUMzcDMDNEN2UDNFVER2Q0MENzQ5kTOBJERygDN1YkNxE0MxkzQ0IUN1cjMGF0MzAzQ2ADRwQ0NxMkQCN0Q5QkQ0QTQBV0MyUzNDNTRBRUQzEDR0IzM4AjRwYUNFRERzQkMyYzQBdzMFNTNGhjM3QENBhjN0UDOEZzQxYzNzQjRwEUQ4EjM5M0QycTQ0Q0MFV0MzMEOFVTOyUDO0MDMGJjRGJTNzMTQ2YDO3ITM3IkRwQTNzMkM3IkRBREMCZERwYzMxYzQ5QDO5ATR0IUOGljRCR0MxMkM3AjM1UEMzE0M2UTNzkzMyMERyMERFNER0EkNEVTM5AzMBFUMwIkM4YUN2AzQ5YkMCNUOBZDN3cTNxYDOBJENGRTR2QjQyQ0MCJEM5IDRERjNyQDM4kDO1EzNGJ0QCRzM3MEN2YjMBFzNyETR4MkNxgjQ5MjMBNzQ3YkRwIzMwUUOGFDRGFUMzIDNGlzQFdzNxgzMCVzMzMjM4YjQFFUN3IkN0EjNyEERyEUNFlzMzQDN3YTQ1YDNyMjRzU0QClTQEJ0N1MjREJUN2YkMFZDN2UjQFljNBFjM5IzMEJEOClDO3MkM5ETOxEkM1UTN3MER2YEMyQEN2IjN3IjN1UDRDVjNyMEN5YDN2EEMwIUN4MTM2kDMBBTOxUENDBTMzQURxkTQwEjQ2kjRCVEOzQjNxYjRyEERzETMChTNDhTMBRkQyMEMGlzN5YTO1MDR1YzQ4QjMBVjQygTRDZTOwMTM5EDOwIDM1QkNxEjMFZTRycjQ2QUM2IDO1YDO1UjN2QDN3kTOCBjM2EUM0IEO2cDNBR0M3YkQ3UzNzMUR0MjR2MDN2UERCVDMGdDR0kzNEZjRCFTNGJDNBRTN4EENFJTOyYUQ5MzQBBTNxYDN5MDO5IDNBNzNwgjRBNERGRkQGNjREZERGJjQ3YkMDFzM1kTODFUOwYDNzITQCFEODRDRwYUNBVDOEdTR4EUM0EzQ2UDM2UzN0EUMwI0N5MUNxMkQxQDOxYEMCVERBJTQwgTMzEUN2YTQBNkNCR0NBZDMxMTO4UkQDFzQ5ATR2wiR1kDOwQDR2UUMxIDNFRTMDJURyEkQxETNyYzQ3cDR3EDOGhjNElTN5MjRBZkQ5MERBJTM2QkQFFTMFZ0MBRTMwUER1cDMBhzNDFjMCJjRCZ0NCJjQGRURFZTMGV0MGFjNxQjNwUDNxMzN2QTOBdTM2EkMyIzMyUDNEN0NFNjM0YDRFVDMFVjREFUQyQzNxkzQBVjQ3IzMCVTQ1UEN5UDOChjM3EENGlDREFDNFFzM3ATQGRERzADODREOwUENGZkQzcjQ2czN1IUQDRTOxQzNCFjR3QjQ3YkQwcjM3UTMElDRxMDRzMTM4cTO1QURxATRCFUMDdjQ5QDRFVTQzQ0QGJTN4YTQCNER1MER2EzN2UTN0cTQCJ0Q1MzN1UDO2QkRFNUMFNkQGNUO2gzMwUEM4QERyQkM3YTRCFTR1UjMEN0Q3MDOzUEO3QkRDJTMBlTQxIURBJkQycjNwQTQ0QDOygzN3EEN3cjR0QENxMEO3gDRzQUQykzN3YzNxY0QxITMzIDNzUUNxEDMzgTR0MUNzYUNxgjR5QjMFN0QyQkQxAjQyQzQCBjNDBDOBRUN0cjRDR0NyQ0M2czQ3IEOCF0QGVTR0MkM3gjM3kjRCZDMCNERCZERDJzN5EUQzAjNBdzMzUENFRjQxYEM1EkQ4kzQzMUM0MzNEBzMDhjM5gjQFlTO2I0M0QkQDVTQGhTREVzMEdDRFNkR3IkMEVERycTRzgTRxMUM4QTQ1QUN3gzQGhjRDRER1YEM1gzNGRDODN0QDBjQzkTMBdTQBJEM3QEO4QjRxITQyYUNyUTN5kjNGZEN2EENwcDN2UzNwQUQGRTQ4YTQ2IUM2YkM4UkQyYERENURFFjRwIzNwIDN1kTR2cDM5cTQEJDR2cTRFJjM5I0MFZkNwAzNFR0M0ETMEVUMFZENFNUNxgjMzM0N4YUNykDMyQkMDZUNxkDMCZ0NwEDMERDNBJEO1kzQBlTREZjR5IUO3kjN5ATR4MDNFhTO1YzMzIUQ4kDMFJEMDFDR2EzMwEENBZDNxMkQBRDNyITQGlTNDVTQxgDO1QDMFVjM3E0NEBjMFJkQDhjMDljQEFEOFNTOwUjN1YER3MjQ4ITO1AjQDJ0MzATOwUER1M0N1QzQwIEOGhjNBZTN2UERFREOxMEOykjR2UTQ2QDREVDMBZEMykjNENURBVTO1EUR0YDO0EkNzETOENERGZEO2EEO5UDOCR0MFR0MDNkNFBjM5IzMyIUOxUzMwQjRCRkMBFDODVkM2UTM3gjR4UjR4EUM1EEMxI0QDFkQER0NFFTOBNzQwYkQDNTOxU0MEJDRFNjQFV0N3ITQ5IENyYjMxgTN3MERFBTOCVDO1kDOzY0N

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Ragnarok

    Ransomware family deployed from Citrix servers infected via CVE-2019-19781.

    ransomwareragnarok
  • Makes http(s) request 2 IoCs

    Contacts server via http/https, possibly for C2 communication.

  • Drops desktop.ini file(s) 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee7221f0d74d03a613ca334aa6cacbcff381a10a1d0ded8a485c3ad1ba8530e1.exe
    "C:\Users\Admin\AppData\Local\Temp\ee7221f0d74d03a613ca334aa6cacbcff381a10a1d0ded8a485c3ad1ba8530e1.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet
      2⤵
        PID:4036
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:344
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
        2⤵
          PID:4048
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {current} bootstatuspolicy ignoreallfailures
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:1016
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c bcdedit /set {current} recoveryenabled no
          2⤵
            PID:4032
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {current} recoveryenabled no
              3⤵
              • Modifies boot configuration data using bcdedit
              PID:4008
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c netsh advfirewall set allprofiles state off
            2⤵
              PID:4052
              • C:\Windows\system32\netsh.exe
                netsh advfirewall set allprofiles state off
                3⤵
                  PID:3832
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              • Modifies service
              PID:2132
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How_To_Decrypt_My_Files.txt
              1⤵
              • Opens file in notepad (likely ransom note)
              • Suspicious use of FindShellTrayWindow
              PID:4004
            • C:\Windows\system32\OpenWith.exe
              C:\Windows\system32\OpenWith.exe -Embedding
              1⤵
              • Suspicious use of SetWindowsHookEx
              • Modifies registry class
              PID:2548

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads