1c83ff2394da76e6296e6ad72c40dbde107704a711bbd08b633c57587230ccf8

Analysis

max time kernel
144s
max time network
143s
platform
windows10_x64
resource
win10
submitted
18-06-2020 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90a909a4508aa899b4be372e7de6f500.exe
Size

62KB
MD5

90a909a4508aa899b4be372e7de6f500
SHA1

7bb201923d7055c149858d087c0a44ab9530536e
SHA256

1c83ff2394da76e6296e6ad72c40dbde107704a711bbd08b633c57587230ccf8
SHA512

57b732ac3827878c81ed45e26001695c42240b6eb16d4c9d0ecd34d41ede0d598983c156a5c22c8a5f79e81437ed308e0414571cda1c0725ab7b2b3ef9f683cf

Score

10^/10

ransomware spyware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\DEAL_FOR_ACCESS_TO_YOUR_FILES.txt

Ransom Note

*** WARNING *** Important Files In This Machine Has LOCKED. Your Files ONLY Can Recover By Special Unlocker. Important And Private Documents Also COPIED. After This Message Time For Payment Is Limited. After Time Limit Next Payment Will Be x2 Next Step Is Publish Files And Document. You Can Test 1 File (Max. 2MB) To Unlock l1u1t1@secmail.pro Key Identifier: On5TrSwffaf8cdrYWygamPz+sRvUObZ84oiaI2t3MVfipXn+mgBPo1hizJfpCpOBm6Lany40ycuFkjhm4s0WebPgOzJTu/iY0l4UH/Csw/uv7Cr/MK2SRJeW4WHUBxpu/8lS2SzQ/67rSUPRtk8zlp43C9euJM5/SK/khT3kkrofhaUhqY01sHQLdNVwPzI9ohDM6dQuXv4wJLpTUa/Fl7RFRlLNLuAQfBUX1vg0543Y8QTuUuFDpUKozZes5jdah/U8tqz9uUy6pim1QhyluiH2Sx8RNRcuPddlH+SKnsqgY3JdYOQ1wwNf6PZQZQhqSx43vxPVMRZjKGb176AR4g==

Emails

l1u1t1@secmail.pro

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

Processes:

90a909a4508aa899b4be372e7de6f500.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	90a909a4508aa899b4be372e7de6f500.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
3632	vssadmin.exe
3948	vssadmin.exe
740	vssadmin.exe
496	vssadmin.exe
476	vssadmin.exe
3940	vssadmin.exe
3924	vssadmin.exe
3824	vssadmin.exe
3796	vssadmin.exe
3820	vssadmin.exe
3584	vssadmin.exe
3928	vssadmin.exe
3448	vssadmin.exe
4008	vssadmin.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

3832 taskkill.exe
776 taskkill.exe
2960 taskkill.exe
Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

notepad.exeNOTEPAD.EXE

pid process

3916 notepad.exe
3804 NOTEPAD.EXE
Runs net.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

2684 PING.EXE
2916 PING.EXE
3836 PING.EXE
3884 PING.EXE
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1308 WINWORD.EXE
1308 WINWORD.EXE

pid	process
3832	taskkill.exe
776	taskkill.exe
2960	taskkill.exe

pid	process
3916	notepad.exe
3804	NOTEPAD.EXE

pid	process
2684	PING.EXE
2916	PING.EXE
3836	PING.EXE
3884	PING.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

90a909a4508aa899b4be372e7de6f500.exetaskkill.exetaskkill.exetaskkill.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2896	90a909a4508aa899b4be372e7de6f500.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	776	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeBackupPrivilege	3876	vssvc.exe
Token: SeRestorePrivilege	3876	vssvc.exe
Token: SeAuditPrivilege	3876	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

90a909a4508aa899b4be372e7de6f500.exe

pid process

2896 90a909a4508aa899b4be372e7de6f500.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

90a909a4508aa899b4be372e7de6f500.exe

pid process

2896 90a909a4508aa899b4be372e7de6f500.exe

pid	process
2896	90a909a4508aa899b4be372e7de6f500.exe

pid	process
2896	90a909a4508aa899b4be372e7de6f500.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

WINWORD.EXE

pid	process
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE
1308	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

90a909a4508aa899b4be372e7de6f500.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2896 wrote to memory of 3520	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3520	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3520	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 3520 wrote to memory of 3840	3520	net.exe	net1.exe
PID 3520 wrote to memory of 3840	3520	net.exe	net1.exe
PID 3520 wrote to memory of 3840	3520	net.exe	net1.exe
PID 2896 wrote to memory of 3984	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3984	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3984	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 3984 wrote to memory of 3828	3984	net.exe	net1.exe
PID 3984 wrote to memory of 3828	3984	net.exe	net1.exe
PID 3984 wrote to memory of 3828	3984	net.exe	net1.exe
PID 2896 wrote to memory of 3872	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3872	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3872	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 3872 wrote to memory of 3888	3872	net.exe	net1.exe
PID 3872 wrote to memory of 3888	3872	net.exe	net1.exe
PID 3872 wrote to memory of 3888	3872	net.exe	net1.exe
PID 2896 wrote to memory of 3868	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3868	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3868	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 3868 wrote to memory of 3928	3868	net.exe	net1.exe
PID 3868 wrote to memory of 3928	3868	net.exe	net1.exe
PID 3868 wrote to memory of 3928	3868	net.exe	net1.exe
PID 2896 wrote to memory of 2668	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 2668	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 2668	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2668 wrote to memory of 3380	2668	net.exe	net1.exe
PID 2668 wrote to memory of 3380	2668	net.exe	net1.exe
PID 2668 wrote to memory of 3380	2668	net.exe	net1.exe
PID 2896 wrote to memory of 3384	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3384	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3384	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 3384 wrote to memory of 2916	3384	net.exe	net1.exe
PID 3384 wrote to memory of 2916	3384	net.exe	net1.exe
PID 3384 wrote to memory of 2916	3384	net.exe	net1.exe
PID 2896 wrote to memory of 2760	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 2760	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 2760	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2760 wrote to memory of 2336	2760	net.exe	net1.exe
PID 2760 wrote to memory of 2336	2760	net.exe	net1.exe
PID 2760 wrote to memory of 2336	2760	net.exe	net1.exe
PID 2896 wrote to memory of 2116	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 2116	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 2116	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2116 wrote to memory of 2976	2116	net.exe	net1.exe
PID 2116 wrote to memory of 2976	2116	net.exe	net1.exe
PID 2116 wrote to memory of 2976	2116	net.exe	net1.exe
PID 2896 wrote to memory of 3652	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3652	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3652	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 3652 wrote to memory of 3840	3652	net.exe	net1.exe
PID 3652 wrote to memory of 3840	3652	net.exe	net1.exe
PID 3652 wrote to memory of 3840	3652	net.exe	net1.exe
PID 2896 wrote to memory of 3812	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3812	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3812	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 3812 wrote to memory of 3828	3812	net.exe	net1.exe
PID 3812 wrote to memory of 3828	3812	net.exe	net1.exe
PID 3812 wrote to memory of 3828	3812	net.exe	net1.exe
PID 2896 wrote to memory of 3816	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3816	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 2896 wrote to memory of 3816	2896	90a909a4508aa899b4be372e7de6f500.exe	net.exe
PID 3816 wrote to memory of 3884	3816	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\90a909a4508aa899b4be372e7de6f500.exe
"C:\Users\Admin\AppData\Local\Temp\90a909a4508aa899b4be372e7de6f500.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\net.exe
"net.exe" stop avpsus /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop avpsus /y
3⤵
PID:3840

C:\Windows\SysWOW64\net.exe
"net.exe" stop McAfeeDLPAgentService /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
3⤵
PID:3828

C:\Windows\SysWOW64\net.exe
"net.exe" stop mfewc /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfewc /y
3⤵
PID:3888

C:\Windows\SysWOW64\net.exe
"net.exe" stop BMR Boot Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BMR Boot Service /y
3⤵
PID:3928

C:\Windows\SysWOW64\net.exe
"net.exe" stop NetBackup BMR MTFTP Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
3⤵
PID:3380

C:\Windows\SysWOW64\net.exe
"net.exe" stop DefWatch /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3384

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DefWatch /y
3⤵
PID:2916

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccEvtMgr /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
3⤵
PID:2336

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccSetMgr /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccSetMgr /y
3⤵
PID:2976

C:\Windows\SysWOW64\net.exe
"net.exe" stop SavRoam /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SavRoam /y
3⤵
PID:3840

C:\Windows\SysWOW64\net.exe
"net.exe" stop RTVscan /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
3⤵
PID:3828

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBFCService /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
3⤵
PID:3884

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBIDPService /y
2⤵
PID:3800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
3⤵
PID:3936

C:\Windows\SysWOW64\net.exe
"net.exe" stop Intuit.QuickBooks.FCS /y
2⤵
PID:3144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
3⤵
PID:3264

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBCFMonitorService /y
2⤵
PID:3320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
3⤵
PID:2660

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooBackup /y
2⤵
PID:400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
3⤵
PID:612

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooIT /y
2⤵
PID:2980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooIT /y
3⤵
PID:2000

C:\Windows\SysWOW64\net.exe
"net.exe" stop zhudongfangyu /y
2⤵
PID:2888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
3⤵
PID:3572

C:\Windows\SysWOW64\net.exe
"net.exe" stop stc_raw_agent /y
2⤵
PID:3808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
3⤵
PID:3828

C:\Windows\SysWOW64\net.exe
"net.exe" stop VSNAPVSS /y
2⤵
PID:3768

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
3⤵
PID:3944

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:3936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:3772

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:3388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:1656

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:64

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:1336

C:\Windows\SysWOW64\net.exe
"net.exe" stop veeam /y
2⤵
PID:732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop veeam /y
3⤵
PID:2052

C:\Windows\SysWOW64\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:3572

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:3648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:4052

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:996

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:3376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:3916

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecDiveciMediaService /y
2⤵
PID:3772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
3⤵
PID:4008

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:736

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:2044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:2684

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:3644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:3024

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:3856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:3828

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:3884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:3380

C:\Windows\SysWOW64\net.exe
"net.exe" stop CASAD2DWebSvc /y
2⤵
PID:3916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
3⤵
PID:3392

C:\Windows\SysWOW64\net.exe
"net.exe" stop CAARCUpdateSvc /y
2⤵
PID:3588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
3⤵
PID:3640

C:\Windows\SysWOW64\net.exe
"net.exe" stop sophos /y
2⤵
PID:2288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophos /y
3⤵
PID:3908

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY start= disabled
2⤵
PID:2976

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
2⤵
PID:972

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLWriter start= disabled
2⤵
PID:3024

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SstpSvc start= disabled
2⤵
PID:3776

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:3632

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:3796

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:3948

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:740

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:496

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3820

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3584

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:476

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3940

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3924

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3448

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3824

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3928

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:4008

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
2⤵
PID:3764

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpEF13.bat
2⤵
PID:3880

C:\Windows\SysWOW64\mountvol.exe
mountvol
3⤵
PID:2000

C:\Windows\SysWOW64\find.exe
find "}\"
3⤵
PID:3572

C:\Windows\SysWOW64\mountvol.exe
mountvol !freedrive!: \\?\Volume{9563bb1f-0000-0000-0000-500600000000}\
3⤵
PID:2052

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
3⤵
- Runs ping.exe
PID:2684

C:\Windows\SysWOW64\mountvol.exe
mountvol !freedrive!: \\?\Volume{9563bb1f-0000-0000-0000-100000000000}\
3⤵
PID:2344

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
3⤵
- Runs ping.exe
PID:2916

C:\Windows\SysWOW64\mountvol.exe
mountvol !freedrive!: \\?\Volume{d61488bd-b008-11ea-95e4-806e6f6e6963}\
3⤵
PID:3572

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
3⤵
- Runs ping.exe
PID:3836

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\DEAL_FOR_ACCESS_TO_YOUR_FILES.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:3916

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
2⤵
PID:3388

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.7 -n 3
3⤵
- Runs ping.exe
PID:3884

C:\Windows\SysWOW64\fsutil.exe
fsutil file setZeroData offset=0 length=524288 “%s”
3⤵
PID:1188

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\90a909a4508aa899b4be372e7de6f500.exe
2⤵
PID:796

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:1768

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3092

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\EnableFind.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1308

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\OptimizeRename.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEF13.bat
MD5
1af2c796c268a8160d0d93e8866dc7b0

SHA1
6d786ee5bf9cb9b1da115ce6daffe1e7b5ef988f

SHA256
94e31962442ee5f22c9ff8f6539c214dabf49e1b672a91cb042e2c0c1369abc8

SHA512
af10c10ef2c7f976ebc52201d17c95cb2a5c433d39c7d722b0c1f56cb48fa27c07cf60e7de8c2d9974f6594212eb02568007da90e49ba3bca226efbe8943271e

Download Submit
C:\Users\Admin\AppData\Local\Temp\v.txt
MD5
6904d06486a00b0c3633fb57180f663d

SHA1
5369899d14980ad49a183f3fee44631f806194c7

SHA256
03bb07b5fcc7613ee9c4201647bbfab1dab2045a336813b349a2402f95b212bd

SHA512
8e276de659c3209fcfdf369630b1a72c0d05fccb1406f7d28f5a2829d477a5ec0d17752e97b360964ab8a11be5bf10ce9a29f3a65c57f345291318dad2eadb30

Download Submit
C:\Users\Admin\Desktop\DEAL_FOR_ACCESS_TO_YOUR_FILES.txt
MD5
6f394578305ee1978f73a0a13f021e7b

SHA1
3a8105811a3dc6bd29a9cbab4f9e1a1bfbec2215

SHA256
70f2550ff11ddb0ed9264fbe81aff333d3b522bcf7a02b59b4b526a22deff240

SHA512
a20f9c3ca19c73155b9de341b0533e4897737d597c93c2e9e7920e16bd1aefa79bc1bd8a3bd4a44ba779a43614058e26c1a48b3045c96f3a127f46d7d1c23bf6

Download Submit
C:\Users\Admin\Desktop\EnableFind.rtf
MD5
c368cecdb79fc221ed59542a41c7b81a

SHA1
7d1d1d1d439fe4a98c28aa381ad9656600050b34

SHA256
756935cfa1b55ec41420ebbe53fbcfe409c940a5709da858accf8413b3dc7e5e

SHA512
2a953680fd645c13c372d501f3de89ed5cc74fe767f1d2d5f8ebdf488b54f909df51230d5a2dfc4f5251510ce261fe8daea71d931172d13871d92a0847f2c1fa

Download Submit
C:\Users\Admin\Desktop\OptimizeRename.txt
MD5
cf29204f3383382863fdf280d4c808e3

SHA1
f73494ba158692a2bee133a9ba949dfad53e852e

SHA256
c8fd5624b181288feec1138608159210547e2353433ce577c7b2fe9919a03687

SHA512
660821cacadfe75f290c9751dce5bc58ff646a28f879e441e273cdaf5801582cee8b2f1f0a08522de6f7fc12d3f2ab66c4b4c82a600cad7f1724becb03e923c6

Download Submit
C:\Users\Admin\Documents\Are.docx
MD5
fc196d75b0bd76e30eaf622f6db78a9b

SHA1
b1bb41b3d88382d86c040bcfd02fb19259236865

SHA256
2ad99aee31977a66af3bfd49aa8cca533699255ff2c69f25379fc5ce89fa4b26

SHA512
9436e5e4cbe4f5ac4d5587a688f9687cf2b93343a93538ecbc745b9829b510624ca683bcae67fc4bd3170b0096e65059cc9e7321e82bfb402a5bdc7a49a6fb0e

Download Submit
C:\Users\Admin\Documents\Files.docx
MD5
c859cce4e08ffbda90de78b8484c97ff

SHA1
e9c79f26816f0886038a2f7798b53c61ebe97fec

SHA256
f8f601a72c9443c7348240bc64d0f2c4bbbcb64573a4c77b3059abbd80173e0d

SHA512
516c4e959ba07ba4902a0e65026d5c60591535b08632036d305278f0760be1f56ab01ff7c89f19dbb599f6a46fa5423aa5044fd22aecb105972cdd8c2e586956

Download Submit
C:\Users\Admin\Documents\Opened.docx
MD5
b95d7719f84df265d9053a793a93a5cd

SHA1
bba9a53fa583ca228f958fdac1e40c5b14f34c48

SHA256
ffaff0183082ea32765029694b94e89835654def5fb920aa7877cfc19e7b8fb3

SHA512
cf8ced8c895a387ee13f9764269e112573a5a9a1b2792d234f386671ec9cc74b9154d2f0fa364327de438ff822364475dc7e5e20bbda0714db878cb2e8879ab7

Download Submit
C:\Users\Admin\Documents\Recently.docx
MD5
0a6d2c367de8ce6419804527a9feb2e2

SHA1
8702944c041ec9cc871defe9f51fd353553a059c

SHA256
d552bb2c9c1d3f8b8adb5b3d8d3396dad790da1ded93cf73a8c9337c93b1b18d

SHA512
b21ba1e6311190404bd4672ee051102b44498dac7783d670da74c1798b89c5f96efa74a3ac932460f63d862382756c441d3cbe091902386fa2c49fc07749c184

Download Submit
C:\Users\Admin\Documents\These.docx
MD5
c314ae79a45efd50edc459765a7a08fa

SHA1
bc14d205e4e6fa0f49d3029a66279b3672eb2fb8

SHA256
ba00a67665ec61c6fc084bfba4548a5281443178748194f26542db7f845dca5f

SHA512
92a13c7d6223c46d09b6f640f39bfc9bc92328615366a078638747658558f5015213dc61205a52d5e3fa96f12e3eb3108fcf3967beb718176df9e3300a234245

Download Submit
memory/64-42-0x0000000000000000-mapping.dmp

Download
memory/400-28-0x0000000000000000-mapping.dmp

Download
memory/476-86-0x0000000000000000-mapping.dmp

Download
memory/496-83-0x0000000000000000-mapping.dmp

Download
memory/612-29-0x0000000000000000-mapping.dmp

Download
memory/728-46-0x0000000000000000-mapping.dmp

Download
memory/732-44-0x0000000000000000-mapping.dmp

Download
memory/736-57-0x0000000000000000-mapping.dmp

Download
memory/740-82-0x0000000000000000-mapping.dmp

Download
memory/776-77-0x0000000000000000-mapping.dmp

Download
memory/780-56-0x0000000000000000-mapping.dmp

Download
memory/796-110-0x0000000000000000-mapping.dmp

Download
memory/972-73-0x0000000000000000-mapping.dmp

Download
memory/992-50-0x0000000000000000-mapping.dmp

Download
memory/996-51-0x0000000000000000-mapping.dmp

Download
memory/1188-109-0x0000000000000000-mapping.dmp

Download
memory/1336-43-0x0000000000000000-mapping.dmp

Download
memory/1656-41-0x0000000000000000-mapping.dmp

Download
memory/1768-111-0x0000000000000000-mapping.dmp

Download
memory/2000-96-0x0000000000000000-mapping.dmp

Download
memory/2000-31-0x0000000000000000-mapping.dmp

Download
memory/2044-58-0x0000000000000000-mapping.dmp

Download
memory/2052-98-0x0000000000000000-mapping.dmp

Download
memory/2052-45-0x0000000000000000-mapping.dmp

Download
memory/2116-14-0x0000000000000000-mapping.dmp

Download
memory/2288-70-0x0000000000000000-mapping.dmp

Download
memory/2336-13-0x0000000000000000-mapping.dmp

Download
memory/2344-100-0x0000000000000000-mapping.dmp

Download
memory/2660-27-0x0000000000000000-mapping.dmp

Download
memory/2668-8-0x0000000000000000-mapping.dmp

Download
memory/2684-59-0x0000000000000000-mapping.dmp

Download
memory/2684-99-0x0000000000000000-mapping.dmp

Download
memory/2760-12-0x0000000000000000-mapping.dmp

Download
memory/2888-32-0x0000000000000000-mapping.dmp

Download
memory/2916-11-0x0000000000000000-mapping.dmp

Download
memory/2916-101-0x0000000000000000-mapping.dmp

Download
memory/2960-78-0x0000000000000000-mapping.dmp

Download
memory/2976-72-0x0000000000000000-mapping.dmp

Download
memory/2976-15-0x0000000000000000-mapping.dmp

Download
memory/2980-30-0x0000000000000000-mapping.dmp

Download
memory/3024-61-0x0000000000000000-mapping.dmp

Download
memory/3024-74-0x0000000000000000-mapping.dmp

Download
memory/3144-24-0x0000000000000000-mapping.dmp

Download
memory/3264-25-0x0000000000000000-mapping.dmp

Download
memory/3320-26-0x0000000000000000-mapping.dmp

Download
memory/3376-52-0x0000000000000000-mapping.dmp

Download
memory/3380-65-0x0000000000000000-mapping.dmp

Download
memory/3380-9-0x0000000000000000-mapping.dmp

Download
memory/3384-10-0x0000000000000000-mapping.dmp

Download
memory/3388-40-0x0000000000000000-mapping.dmp

Download
memory/3388-106-0x0000000000000000-mapping.dmp

Download
memory/3392-67-0x0000000000000000-mapping.dmp

Download
memory/3448-89-0x0000000000000000-mapping.dmp

Download
memory/3520-0-0x0000000000000000-mapping.dmp

Download
memory/3572-97-0x0000000000000000-mapping.dmp

Download
memory/3572-33-0x0000000000000000-mapping.dmp

Download
memory/3572-102-0x0000000000000000-mapping.dmp

Download
memory/3572-47-0x0000000000000000-mapping.dmp

Download
memory/3584-85-0x0000000000000000-mapping.dmp

Download
memory/3588-68-0x0000000000000000-mapping.dmp

Download
memory/3632-79-0x0000000000000000-mapping.dmp

Download
memory/3640-69-0x0000000000000000-mapping.dmp

Download
memory/3644-60-0x0000000000000000-mapping.dmp

Download
memory/3648-48-0x0000000000000000-mapping.dmp

Download
memory/3652-16-0x0000000000000000-mapping.dmp

Download
memory/3764-93-0x0000000000000000-mapping.dmp

Download
memory/3768-36-0x0000000000000000-mapping.dmp

Download
memory/3772-54-0x0000000000000000-mapping.dmp

Download
memory/3772-39-0x0000000000000000-mapping.dmp

Download
memory/3776-75-0x0000000000000000-mapping.dmp

Download
memory/3796-80-0x0000000000000000-mapping.dmp

Download
memory/3800-22-0x0000000000000000-mapping.dmp

Download
memory/3808-34-0x0000000000000000-mapping.dmp

Download
memory/3812-18-0x0000000000000000-mapping.dmp

Download
memory/3816-20-0x0000000000000000-mapping.dmp

Download
memory/3820-84-0x0000000000000000-mapping.dmp

Download
memory/3824-90-0x0000000000000000-mapping.dmp

Download
memory/3828-3-0x0000000000000000-mapping.dmp

Download
memory/3828-19-0x0000000000000000-mapping.dmp

Download
memory/3828-35-0x0000000000000000-mapping.dmp

Download
memory/3828-63-0x0000000000000000-mapping.dmp

Download
memory/3832-76-0x0000000000000000-mapping.dmp

Download
memory/3836-103-0x0000000000000000-mapping.dmp

Download
memory/3840-17-0x0000000000000000-mapping.dmp

Download
memory/3840-1-0x0000000000000000-mapping.dmp

Download
memory/3856-62-0x0000000000000000-mapping.dmp

Download
memory/3868-6-0x0000000000000000-mapping.dmp

Download
memory/3872-4-0x0000000000000000-mapping.dmp

Download
memory/3880-94-0x0000000000000000-mapping.dmp

Download
memory/3884-21-0x0000000000000000-mapping.dmp

Download
memory/3884-107-0x0000000000000000-mapping.dmp

Download
memory/3884-64-0x0000000000000000-mapping.dmp

Download
memory/3888-5-0x0000000000000000-mapping.dmp

Download
memory/3908-71-0x0000000000000000-mapping.dmp

Download
memory/3916-53-0x0000000000000000-mapping.dmp

Download
memory/3916-66-0x0000000000000000-mapping.dmp

Download
memory/3916-105-0x0000000000000000-mapping.dmp

Download
memory/3924-88-0x0000000000000000-mapping.dmp

Download
memory/3928-7-0x0000000000000000-mapping.dmp

Download
memory/3928-91-0x0000000000000000-mapping.dmp

Download
memory/3936-38-0x0000000000000000-mapping.dmp

Download
memory/3936-23-0x0000000000000000-mapping.dmp

Download
memory/3940-87-0x0000000000000000-mapping.dmp

Download
memory/3944-37-0x0000000000000000-mapping.dmp

Download
memory/3948-81-0x0000000000000000-mapping.dmp

Download
memory/3984-2-0x0000000000000000-mapping.dmp

Download
memory/4008-55-0x0000000000000000-mapping.dmp

Download
memory/4008-92-0x0000000000000000-mapping.dmp

Download
memory/4052-49-0x0000000000000000-mapping.dmp

Download