Analysis
- max time kernel
140s - max time network
134s - platform
windows10_x64 - resource
win10 - submitted
30/07/2020, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
r.bin.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
r.bin.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target r.bin.exe
- Size 2.1MB
- Sample200730-cw5252s23j
- SHA256 e24f69aa8738d14b85ad76a1783d51120b8b6ba467190fe7d8f96ad2969c8fdf
- MD5 ccede1200a6e8eff54a358fa1e6d119a
- SHA1 e62fbe82dc5c1efbdecfd94791e023002d3c178b
- SHA512 d4c7e45c2f509e43b521bfbcd67474ef271fa12088f7a57794ba866cdd41ddd3e9ee8fc776b31dd0a0811e62542b813e97c0f3404f4e416066c1338193f7f6c7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\odt\EUoev_readme.txt
Ransom Note
- -------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bDADEAcCab You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LXF1eWRJYXVHVWJBTzkrV0xqKzlFRWo3cVRjYzRnaitzWDJBenVJVkdHTk5FeDAyazRVVW1rVzVXRU1VZDhyZWtlb2txRzcxRWl6cWRCZ3kxTml1TzJzSTViRkhRdDBZVDBRUldMWWNJMHBpWTlNZ09zckRrMTZMNHllWlVpSGczQVNrVVFFcGZxYkFucm5SNjZBQ3hvSFM1TEQvQzVYS29Fc25BUHhNdk5TcTNsUUJsVEpGSktVVnh2cEFMc3oya0I2ekhjZXM2eWx2Z1lwUEk2NHFqcXkyYU1nSVZxN01RMndRa0ZrMFMyM3hPdC9EUHBvcnprTGQvajBvaGd0SWZtb0J3anArSEN3U2VwSFpMTk5GcVhkQ28xQ0U1TURoeTVpdFNxSDJmVFdTclNsK3pzSnE0ajdtUFNqUytiNG9PNDU0ZTFWWFduK0RCWmJEL1VVOHUvUk1UeEZTeDdnMUJHN2xORTdKa1h6RE9ncDNkVmRhazZPeWtudk1zU25ET2JTT0JVaDUrb3ZDYjFpRlpZVFJGVlJLemlPUFFrSXlLWmdOb2hPWThKV0w1ZnZVV3hyMzJ2WXRNdXhSdzNNV0Q1YndWQnpqUUFTNlhTSGh4VklYaVZ0QzUyeDFLNHlqWWRRVE1LdlZmcUNUSjR6QlFxbTBzMGdwWWduWnBxb2dtQXVqSGJiUkRFZmx4K01wU2djNVhXVElpZWFVaFJHZkZ4RUFwN1ZHVHI3ZHI2Mzhtc3VBaS9PUnpraDcyMGRvb29QWW5QQ3JFZjZkQnFsSnQydVVVak56TGZ1RzNNVFFsV3huK0M5clpQbmtsS3Z2akVxaENEWUZGc21MSzMyQURYYTREeGFicVg0R1V6T0pWNDRvWTBmRGdvZ3RPWm5va2FQMjViblJOZ2k0eituVTlGZUJwLzZUa2VYenJlK2tLNFAzdjdXaFB6aGR3UmdVQjRtemhFMzJIZEdEd0NMTDVyWERZaDlrMEJiN0haaFpDc2tNTkNjb0Q4U2Z2NzhjK3lWa3VYRGhjL3M0NUdqZlArYWZ1bHBRNGtRamdzajRncm56MkFIRlVkVG5tMzRWWHpkUFFNQjVKZHRDc0VTNHdZVituNlpTUndkRkI2SjhKUnltUDRhRFVLWmJyNjdteGVyNTdLTGlSVWVzZWRINU9iRVFMbjluVFpYMzYxVUpPTWR0a01QWW9rREdOTDMwR2dWdzZpd0Q1Uy85c0s2amc2ZXVmRHBHL2QvYWFqZ2ZTL2lsQ241dXFQZXdCSVhJMmVyQ2ZrbnUvM1QzZmVRb2tpSFc5S3ZBQ2lIbUtUemJEUHJveHVLYTlFeTJlbzZkaC9IclprVzhpcklNcGNyN093UnFHaDJTQmNIallzb2NUS3QxektRV05qT3NWdU1jamJST3U3ampDdkszU2Q5ckdoUXZkcmRpeDc5QXJrL0dJSUsrTFdyTDA0YzZ4Um1HRktaRm5GNWh2bWsrZ3l2VDF3WXhyQUNkUFJBeVQ1MHZQTUplejlCZ2ZOQzkxKytud3JhdE9ibG4wdU54QmlIRnhaZHlVRXZSYS9jUUdHYkZROE84QlJldGR0UHFtYlEzWFJLbEtacTUrbWhwNVBZM0NIUUdmZlFQa3J4b3Bab3ArL3FzN0Y1NTZxTlJqUGxqWEUyNVV4T0ptTUZaOXMxNHR2bmpIQ21wUU1FMFdkLzRzd2NFMnZQUDZVTk5RZ2NZamhJR2xkaTJOanJnTExsMm5zaCtrbFlkelFSaHIxQXRiOEdpYjJ0REExVkxTTjVOZHJIOHFKcENmRzVZc0lKY1E3VXQwaXJaRk9GOVAvZkFmbGw3ejlPN1F6Mm81UDA2K25xeFM3aEtuYVNWRUhQU2ZLLzcxcjJVYWNRaU5HQXNrRld0MmlTTTRqcHg0N3JiVE8vZXN3N1B5STJLYUhpcUhZSzJVMmVxQnF4VUgzcXMvM2x0YXRmdGVzQ1VyZFliTFlya3BtK1NtWDhZeVgxVmFtZjNJMkRLSXE2Y2V1OXJseGlxZVBVQ0hIU0hvR3E0dG1SS1dadjJQTnFqa1Z5VWxNTXR5azV0UmZIM211WUQzdFhZd2JnQWI2MHdxeTcwb0IrdHR4K2g3VHdXdGk4bGQ= -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * REXraxIhbSJf0UA7GzxCm
URLs
-
http://avaddonbotrxmuyl.onion
Extracted
Path
-
C:\Users\Admin\Documents\EUoev_readme.txt
Ransom Note
- -------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bDADEAcCab You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LXF1eWRJYXVHVWJBTzkrV0xqKzlFRWo3cVRjYzRnaitzWDJBenVJVkdHTk5FeDAyazRVVW1rVzVXRU1VZDhyZWtlb2txRzcxRWl6cWRCZ3kxTml1TzJzSTViRkhRdDBZVDBRUldMWWNJMHBpWTlNZ09zckRrMTZMNHllWlVpSGczQVNrVVFFcGZxYkFucm5SNjZBQ3hvSFM1TEQvQzVYS29Fc25BUHhNdk5TcTNsUUJsVEpGSktVVnh2cEFMc3oya0I2ekhjZXM2eWx2Z1lwUEk2NHFqcXkyYU1nSVZxN01RMndRa0ZrMFMyM3hPdC9EUHBvcnprTGQvajBvaGd0SWZtb0J3anArSEN3U2VwSFpMTk5GcVhkQ28xQ0U1TURoeTVpdFNxSDJmVFdTclNsK3pzSnE0ajdtUFNqUytiNG9PNDU0ZTFWWFduK0RCWmJEL1VVOHUvUk1UeEZTeDdnMUJHN2xORTdKa1h6RE9ncDNkVmRhazZPeWtudk1zU25ET2JTT0JVaDUrb3ZDYjFpRlpZVFJGVlJLemlPUFFrSXlLWmdOb2hPWThKV0w1ZnZVV3hyMzJ2WXRNdXhSdzNNV0Q1YndWQnpqUUFTNlhTSGh4VklYaVZ0QzUyeDFLNHlqWWRRVE1LdlZmcUNUSjR6QlFxbTBzMGdwWWduWnBxb2dtQXVqSGJiUkRFZmx4K01wU2djNVhXVElpZWFVaFJHZkZ4RUFwN1ZHVHI3ZHI2Mzhtc3VBaS9PUnpraDcyMGRvb29QWW5QQ3JFZjZkQnFsSnQydVVVak56TGZ1RzNNVFFsV3huK0M5clpQbmtsS3Z2akVxaENEWUZGc21MSzMyQURYYTREeGFicVg0R1V6T0pWNDRvWTBmRGdvZ3RPWm5va2FQMjViblJOZ2k0eituVTlGZUJwLzZUa2VYenJlK2tLNFAzdjdXaFB6aGR3UmdVQjRtemhFMzJIZEdEd0NMTDVyWERZaDlrMEJiN0haaFpDc2tNTkNjb0Q4U2Z2NzhjK3lWa3VYRGhjL3M0NUdqZlArYWZ1bHBRNGtRamdzajRncm56MkFIRlVkVG5tMzRWWHpkUFFNQjVKZHRDc0VTNHdZVituNlpTUndkRkI2SjhKUnltUDRhRFVLWmJyNjdteGVyNTdLTGlSVWVzZWRINU9iRVFMbjluVFpYMzYxVUpPTWR0a01QWW9rREdOTDMwR2dWdzZpd0Q1Uy85c0s2amc2ZXVmRHBHL2QvYWFqZ2ZTL2lsQ241dXFQZXdCSVhJMmVyQ2ZrbnUvM1QzZmVRb2tpSFc5S3ZBQ2lIbUtUemJEUHJveHVLYTlFeTJlbzZkaC9IclprVzhpcklNcGNyN093UnFHaDJTQmNIallzb2NUS3QxektRV05qT3NWdU1jamJST3U3ampDdkszU2Q5ckdoUXZkcmRpeDc5QXJrL0dJSUsrTFdyTDA0YzZ4Um1HRktaRm5GNWh2bWsrZ3l2VDF3WXhyQUNkUFJBeVQ1MHZQTUplejlCZ2ZOQzkxKytud3JhdE9ibG4wdU54QmlIRnhaZHlVRXZSYS9jUUdHYkZROE84QlJldGR0UHFtYlEzWFJLbEtacTUrbWhwNVBZM0NIUUdmZlFQa3J4b3Bab3ArL3FzN0Y1NTZxTlJqUGxqWEUyNVV4T0ptTUZaOXMxNHR2bmpIQ21wUU1FMFdkLzRzd2NFMnZQUDZVTk5RZ2NZamhJR2xkaTJOanJnTExsMm5zaCtrbFlkelFSaHIxQXRiOEdpYjJ0REExVkxTTjVOZHJIOHFKcENmRzVZc0lKY1E3VXQwaXJaRk9GOVAvZkFmbGw3ejlPN1F6Mm81UDA2K25xeFM3aEtuYVNWRUhQU2ZLLzcxcjJVYWNRaU5HQXNrRld0MmlTTTRqcHg0N3JiVE8vZXN3N1B5STJLYUhpcUhZSzJVMmVxQnF4VUgzcXMvM2x0YXRmdGVzQ1VyZFliTFlya3BtK1NtWDhZeVgxVmFtZjNJMkRLSXE2Y2V1OXJseGlxZVBVQ0hIU0hvR3E0dG1SS1dadjJQTnFqa1Z5VWxNTXR5azV0UmZIM211WUQzdFhZd2JnQWI2MHdxeTcwb0IrdHR4K2g3VHdXdGk4bGQ= -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * oM8DvA5UR42EtuI9RWsoTBt7
URLs
-
http://avaddonbotrxmuyl.onion
Extracted
Path
-
C:\Users\Admin\Downloads\EUoev_readme.txt
Ransom Note
- -------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bDADEAcCab You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LXF1eWRJYXVHVWJBTzkrV0xqKzlFRWo3cVRjYzRnaitzWDJBenVJVkdHTk5FeDAyazRVVW1rVzVXRU1VZDhyZWtlb2txRzcxRWl6cWRCZ3kxTml1TzJzSTViRkhRdDBZVDBRUldMWWNJMHBpWTlNZ09zckRrMTZMNHllWlVpSGczQVNrVVFFcGZxYkFucm5SNjZBQ3hvSFM1TEQvQzVYS29Fc25BUHhNdk5TcTNsUUJsVEpGSktVVnh2cEFMc3oya0I2ekhjZXM2eWx2Z1lwUEk2NHFqcXkyYU1nSVZxN01RMndRa0ZrMFMyM3hPdC9EUHBvcnprTGQvajBvaGd0SWZtb0J3anArSEN3U2VwSFpMTk5GcVhkQ28xQ0U1TURoeTVpdFNxSDJmVFdTclNsK3pzSnE0ajdtUFNqUytiNG9PNDU0ZTFWWFduK0RCWmJEL1VVOHUvUk1UeEZTeDdnMUJHN2xORTdKa1h6RE9ncDNkVmRhazZPeWtudk1zU25ET2JTT0JVaDUrb3ZDYjFpRlpZVFJGVlJLemlPUFFrSXlLWmdOb2hPWThKV0w1ZnZVV3hyMzJ2WXRNdXhSdzNNV0Q1YndWQnpqUUFTNlhTSGh4VklYaVZ0QzUyeDFLNHlqWWRRVE1LdlZmcUNUSjR6QlFxbTBzMGdwWWduWnBxb2dtQXVqSGJiUkRFZmx4K01wU2djNVhXVElpZWFVaFJHZkZ4RUFwN1ZHVHI3ZHI2Mzhtc3VBaS9PUnpraDcyMGRvb29QWW5QQ3JFZjZkQnFsSnQydVVVak56TGZ1RzNNVFFsV3huK0M5clpQbmtsS3Z2akVxaENEWUZGc21MSzMyQURYYTREeGFicVg0R1V6T0pWNDRvWTBmRGdvZ3RPWm5va2FQMjViblJOZ2k0eituVTlGZUJwLzZUa2VYenJlK2tLNFAzdjdXaFB6aGR3UmdVQjRtemhFMzJIZEdEd0NMTDVyWERZaDlrMEJiN0haaFpDc2tNTkNjb0Q4U2Z2NzhjK3lWa3VYRGhjL3M0NUdqZlArYWZ1bHBRNGtRamdzajRncm56MkFIRlVkVG5tMzRWWHpkUFFNQjVKZHRDc0VTNHdZVituNlpTUndkRkI2SjhKUnltUDRhRFVLWmJyNjdteGVyNTdLTGlSVWVzZWRINU9iRVFMbjluVFpYMzYxVUpPTWR0a01QWW9rREdOTDMwR2dWdzZpd0Q1Uy85c0s2amc2ZXVmRHBHL2QvYWFqZ2ZTL2lsQ241dXFQZXdCSVhJMmVyQ2ZrbnUvM1QzZmVRb2tpSFc5S3ZBQ2lIbUtUemJEUHJveHVLYTlFeTJlbzZkaC9IclprVzhpcklNcGNyN093UnFHaDJTQmNIallzb2NUS3QxektRV05qT3NWdU1jamJST3U3ampDdkszU2Q5ckdoUXZkcmRpeDc5QXJrL0dJSUsrTFdyTDA0YzZ4Um1HRktaRm5GNWh2bWsrZ3l2VDF3WXhyQUNkUFJBeVQ1MHZQTUplejlCZ2ZOQzkxKytud3JhdE9ibG4wdU54QmlIRnhaZHlVRXZSYS9jUUdHYkZROE84QlJldGR0UHFtYlEzWFJLbEtacTUrbWhwNVBZM0NIUUdmZlFQa3J4b3Bab3ArL3FzN0Y1NTZxTlJqUGxqWEUyNVV4T0ptTUZaOXMxNHR2bmpIQ21wUU1FMFdkLzRzd2NFMnZQUDZVTk5RZ2NZamhJR2xkaTJOanJnTExsMm5zaCtrbFlkelFSaHIxQXRiOEdpYjJ0REExVkxTTjVOZHJIOHFKcENmRzVZc0lKY1E3VXQwaXJaRk9GOVAvZkFmbGw3ejlPN1F6Mm81UDA2K25xeFM3aEtuYVNWRUhQU2ZLLzcxcjJVYWNRaU5HQXNrRld0MmlTTTRqcHg0N3JiVE8vZXN3N1B5STJLYUhpcUhZSzJVMmVxQnF4VUgzcXMvM2x0YXRmdGVzQ1VyZFliTFlya3BtK1NtWDhZeVgxVmFtZjNJMkRLSXE2Y2V1OXJseGlxZVBVQ0hIU0hvR3E0dG1SS1dadjJQTnFqa1Z5VWxNTXR5azV0UmZIM211WUQzdFhZd2JnQWI2MHdxeTcwb0IrdHR4K2g3VHdXdGk4bGQ= -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * Ayj4FMsongkIFqwB72mveq287ME
URLs
-
http://avaddonbotrxmuyl.onion
Extracted
Path
-
C:\Users\Admin\Pictures\EUoev_readme.txt
Ransom Note
- -------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bDADEAcCab You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LXF1eWRJYXVHVWJBTzkrV0xqKzlFRWo3cVRjYzRnaitzWDJBenVJVkdHTk5FeDAyazRVVW1rVzVXRU1VZDhyZWtlb2txRzcxRWl6cWRCZ3kxTml1TzJzSTViRkhRdDBZVDBRUldMWWNJMHBpWTlNZ09zckRrMTZMNHllWlVpSGczQVNrVVFFcGZxYkFucm5SNjZBQ3hvSFM1TEQvQzVYS29Fc25BUHhNdk5TcTNsUUJsVEpGSktVVnh2cEFMc3oya0I2ekhjZXM2eWx2Z1lwUEk2NHFqcXkyYU1nSVZxN01RMndRa0ZrMFMyM3hPdC9EUHBvcnprTGQvajBvaGd0SWZtb0J3anArSEN3U2VwSFpMTk5GcVhkQ28xQ0U1TURoeTVpdFNxSDJmVFdTclNsK3pzSnE0ajdtUFNqUytiNG9PNDU0ZTFWWFduK0RCWmJEL1VVOHUvUk1UeEZTeDdnMUJHN2xORTdKa1h6RE9ncDNkVmRhazZPeWtudk1zU25ET2JTT0JVaDUrb3ZDYjFpRlpZVFJGVlJLemlPUFFrSXlLWmdOb2hPWThKV0w1ZnZVV3hyMzJ2WXRNdXhSdzNNV0Q1YndWQnpqUUFTNlhTSGh4VklYaVZ0QzUyeDFLNHlqWWRRVE1LdlZmcUNUSjR6QlFxbTBzMGdwWWduWnBxb2dtQXVqSGJiUkRFZmx4K01wU2djNVhXVElpZWFVaFJHZkZ4RUFwN1ZHVHI3ZHI2Mzhtc3VBaS9PUnpraDcyMGRvb29QWW5QQ3JFZjZkQnFsSnQydVVVak56TGZ1RzNNVFFsV3huK0M5clpQbmtsS3Z2akVxaENEWUZGc21MSzMyQURYYTREeGFicVg0R1V6T0pWNDRvWTBmRGdvZ3RPWm5va2FQMjViblJOZ2k0eituVTlGZUJwLzZUa2VYenJlK2tLNFAzdjdXaFB6aGR3UmdVQjRtemhFMzJIZEdEd0NMTDVyWERZaDlrMEJiN0haaFpDc2tNTkNjb0Q4U2Z2NzhjK3lWa3VYRGhjL3M0NUdqZlArYWZ1bHBRNGtRamdzajRncm56MkFIRlVkVG5tMzRWWHpkUFFNQjVKZHRDc0VTNHdZVituNlpTUndkRkI2SjhKUnltUDRhRFVLWmJyNjdteGVyNTdLTGlSVWVzZWRINU9iRVFMbjluVFpYMzYxVUpPTWR0a01QWW9rREdOTDMwR2dWdzZpd0Q1Uy85c0s2amc2ZXVmRHBHL2QvYWFqZ2ZTL2lsQ241dXFQZXdCSVhJMmVyQ2ZrbnUvM1QzZmVRb2tpSFc5S3ZBQ2lIbUtUemJEUHJveHVLYTlFeTJlbzZkaC9IclprVzhpcklNcGNyN093UnFHaDJTQmNIallzb2NUS3QxektRV05qT3NWdU1jamJST3U3ampDdkszU2Q5ckdoUXZkcmRpeDc5QXJrL0dJSUsrTFdyTDA0YzZ4Um1HRktaRm5GNWh2bWsrZ3l2VDF3WXhyQUNkUFJBeVQ1MHZQTUplejlCZ2ZOQzkxKytud3JhdE9ibG4wdU54QmlIRnhaZHlVRXZSYS9jUUdHYkZROE84QlJldGR0UHFtYlEzWFJLbEtacTUrbWhwNVBZM0NIUUdmZlFQa3J4b3Bab3ArL3FzN0Y1NTZxTlJqUGxqWEUyNVV4T0ptTUZaOXMxNHR2bmpIQ21wUU1FMFdkLzRzd2NFMnZQUDZVTk5RZ2NZamhJR2xkaTJOanJnTExsMm5zaCtrbFlkelFSaHIxQXRiOEdpYjJ0REExVkxTTjVOZHJIOHFKcENmRzVZc0lKY1E3VXQwaXJaRk9GOVAvZkFmbGw3ejlPN1F6Mm81UDA2K25xeFM3aEtuYVNWRUhQU2ZLLzcxcjJVYWNRaU5HQXNrRld0MmlTTTRqcHg0N3JiVE8vZXN3N1B5STJLYUhpcUhZSzJVMmVxQnF4VUgzcXMvM2x0YXRmdGVzQ1VyZFliTFlya3BtK1NtWDhZeVgxVmFtZjNJMkRLSXE2Y2V1OXJseGlxZVBVQ0hIU0hvR3E0dG1SS1dadjJQTnFqa1Z5VWxNTXR5azV0UmZIM211WUQzdFhZd2JnQWI2MHdxeTcwb0IrdHR4K2g3VHdXdGk4bGQ= -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 0bLR4ZebdISr7G4Dm3D3L1BfUWSkSG
URLs
-
http://avaddonbotrxmuyl.onion
Extracted
Path
-
C:\Users\Admin\Searches\EUoev_readme.txt
Ransom Note
- -------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bDADEAcCab You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LXF1eWRJYXVHVWJBTzkrV0xqKzlFRWo3cVRjYzRnaitzWDJBenVJVkdHTk5FeDAyazRVVW1rVzVXRU1VZDhyZWtlb2txRzcxRWl6cWRCZ3kxTml1TzJzSTViRkhRdDBZVDBRUldMWWNJMHBpWTlNZ09zckRrMTZMNHllWlVpSGczQVNrVVFFcGZxYkFucm5SNjZBQ3hvSFM1TEQvQzVYS29Fc25BUHhNdk5TcTNsUUJsVEpGSktVVnh2cEFMc3oya0I2ekhjZXM2eWx2Z1lwUEk2NHFqcXkyYU1nSVZxN01RMndRa0ZrMFMyM3hPdC9EUHBvcnprTGQvajBvaGd0SWZtb0J3anArSEN3U2VwSFpMTk5GcVhkQ28xQ0U1TURoeTVpdFNxSDJmVFdTclNsK3pzSnE0ajdtUFNqUytiNG9PNDU0ZTFWWFduK0RCWmJEL1VVOHUvUk1UeEZTeDdnMUJHN2xORTdKa1h6RE9ncDNkVmRhazZPeWtudk1zU25ET2JTT0JVaDUrb3ZDYjFpRlpZVFJGVlJLemlPUFFrSXlLWmdOb2hPWThKV0w1ZnZVV3hyMzJ2WXRNdXhSdzNNV0Q1YndWQnpqUUFTNlhTSGh4VklYaVZ0QzUyeDFLNHlqWWRRVE1LdlZmcUNUSjR6QlFxbTBzMGdwWWduWnBxb2dtQXVqSGJiUkRFZmx4K01wU2djNVhXVElpZWFVaFJHZkZ4RUFwN1ZHVHI3ZHI2Mzhtc3VBaS9PUnpraDcyMGRvb29QWW5QQ3JFZjZkQnFsSnQydVVVak56TGZ1RzNNVFFsV3huK0M5clpQbmtsS3Z2akVxaENEWUZGc21MSzMyQURYYTREeGFicVg0R1V6T0pWNDRvWTBmRGdvZ3RPWm5va2FQMjViblJOZ2k0eituVTlGZUJwLzZUa2VYenJlK2tLNFAzdjdXaFB6aGR3UmdVQjRtemhFMzJIZEdEd0NMTDVyWERZaDlrMEJiN0haaFpDc2tNTkNjb0Q4U2Z2NzhjK3lWa3VYRGhjL3M0NUdqZlArYWZ1bHBRNGtRamdzajRncm56MkFIRlVkVG5tMzRWWHpkUFFNQjVKZHRDc0VTNHdZVituNlpTUndkRkI2SjhKUnltUDRhRFVLWmJyNjdteGVyNTdLTGlSVWVzZWRINU9iRVFMbjluVFpYMzYxVUpPTWR0a01QWW9rREdOTDMwR2dWdzZpd0Q1Uy85c0s2amc2ZXVmRHBHL2QvYWFqZ2ZTL2lsQ241dXFQZXdCSVhJMmVyQ2ZrbnUvM1QzZmVRb2tpSFc5S3ZBQ2lIbUtUemJEUHJveHVLYTlFeTJlbzZkaC9IclprVzhpcklNcGNyN093UnFHaDJTQmNIallzb2NUS3QxektRV05qT3NWdU1jamJST3U3ampDdkszU2Q5ckdoUXZkcmRpeDc5QXJrL0dJSUsrTFdyTDA0YzZ4Um1HRktaRm5GNWh2bWsrZ3l2VDF3WXhyQUNkUFJBeVQ1MHZQTUplejlCZ2ZOQzkxKytud3JhdE9ibG4wdU54QmlIRnhaZHlVRXZSYS9jUUdHYkZROE84QlJldGR0UHFtYlEzWFJLbEtacTUrbWhwNVBZM0NIUUdmZlFQa3J4b3Bab3ArL3FzN0Y1NTZxTlJqUGxqWEUyNVV4T0ptTUZaOXMxNHR2bmpIQ21wUU1FMFdkLzRzd2NFMnZQUDZVTk5RZ2NZamhJR2xkaTJOanJnTExsMm5zaCtrbFlkelFSaHIxQXRiOEdpYjJ0REExVkxTTjVOZHJIOHFKcENmRzVZc0lKY1E3VXQwaXJaRk9GOVAvZkFmbGw3ejlPN1F6Mm81UDA2K25xeFM3aEtuYVNWRUhQU2ZLLzcxcjJVYWNRaU5HQXNrRld0MmlTTTRqcHg0N3JiVE8vZXN3N1B5STJLYUhpcUhZSzJVMmVxQnF4VUgzcXMvM2x0YXRmdGVzQ1VyZFliTFlya3BtK1NtWDhZeVgxVmFtZjNJMkRLSXE2Y2V1OXJseGlxZVBVQ0hIU0hvR3E0dG1SS1dadjJQTnFqa1Z5VWxNTXR5azV0UmZIM211WUQzdFhZd2JnQWI2MHdxeTcwb0IrdHR4K2g3VHdXdGk4bGQ= -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * Nj
URLs
-
http://avaddonbotrxmuyl.onion
Signatures
- Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3692 r.bin.exe - Suspicious behavior: EnumeratesProcesses 762 IoCs
pid Process 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe - Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe - Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ClearExit.raw => C:\Users\Admin\Pictures\ClearExit.raw.bDADEAcCab r.bin.exe File renamed C:\Users\Admin\Pictures\ConvertMove.png => C:\Users\Admin\Pictures\ConvertMove.png.bDADEAcCab r.bin.exe File renamed C:\Users\Admin\Pictures\DisconnectFormat.png => C:\Users\Admin\Pictures\DisconnectFormat.png.bDADEAcCab r.bin.exe File renamed C:\Users\Admin\Pictures\ReceiveEnter.png => C:\Users\Admin\Pictures\ReceiveEnter.png.bDADEAcCab r.bin.exe File renamed C:\Users\Admin\Pictures\SaveSend.raw => C:\Users\Admin\Pictures\SaveSend.raw.bDADEAcCab r.bin.exe File renamed C:\Users\Admin\Pictures\StepEnter.raw => C:\Users\Admin\Pictures\StepEnter.raw.bDADEAcCab r.bin.exe File renamed C:\Users\Admin\Pictures\WaitRevoke.png => C:\Users\Admin\Pictures\WaitRevoke.png.bDADEAcCab r.bin.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" r.bin.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe 3692 r.bin.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3692 wrote to memory of 3776 3692 r.bin.exe 67 PID 3692 wrote to memory of 3776 3692 r.bin.exe 67 PID 3692 wrote to memory of 3776 3692 r.bin.exe 67 PID 3692 wrote to memory of 500 3692 r.bin.exe 71 PID 3692 wrote to memory of 500 3692 r.bin.exe 71 PID 3692 wrote to memory of 500 3692 r.bin.exe 71 PID 3692 wrote to memory of 1080 3692 r.bin.exe 74 PID 3692 wrote to memory of 1080 3692 r.bin.exe 74 PID 3692 wrote to memory of 1080 3692 r.bin.exe 74 PID 3692 wrote to memory of 1348 3692 r.bin.exe 76 PID 3692 wrote to memory of 1348 3692 r.bin.exe 76 PID 3692 wrote to memory of 1348 3692 r.bin.exe 76 PID 3692 wrote to memory of 1552 3692 r.bin.exe 78 PID 3692 wrote to memory of 1552 3692 r.bin.exe 78 PID 3692 wrote to memory of 1552 3692 r.bin.exe 78 PID 3692 wrote to memory of 1856 3692 r.bin.exe 80 PID 3692 wrote to memory of 1856 3692 r.bin.exe 80 PID 3692 wrote to memory of 1856 3692 r.bin.exe 80 - Suspicious use of AdjustPrivilegeToken 66 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3776 wmic.exe Token: SeSecurityPrivilege 3776 wmic.exe Token: SeTakeOwnershipPrivilege 3776 wmic.exe Token: SeLoadDriverPrivilege 3776 wmic.exe Token: SeSystemProfilePrivilege 3776 wmic.exe Token: SeSystemtimePrivilege 3776 wmic.exe Token: SeProfSingleProcessPrivilege 3776 wmic.exe Token: SeIncBasePriorityPrivilege 3776 wmic.exe Token: SeCreatePagefilePrivilege 3776 wmic.exe Token: SeBackupPrivilege 3776 wmic.exe Token: SeRestorePrivilege 3776 wmic.exe Token: SeShutdownPrivilege 3776 wmic.exe Token: SeDebugPrivilege 3776 wmic.exe Token: SeSystemEnvironmentPrivilege 3776 wmic.exe Token: SeRemoteShutdownPrivilege 3776 wmic.exe Token: SeUndockPrivilege 3776 wmic.exe Token: SeManageVolumePrivilege 3776 wmic.exe Token: 33 3776 wmic.exe Token: 34 3776 wmic.exe Token: 35 3776 wmic.exe Token: 36 3776 wmic.exe Token: SeBackupPrivilege 908 vssvc.exe Token: SeRestorePrivilege 908 vssvc.exe Token: SeAuditPrivilege 908 vssvc.exe Token: SeIncreaseQuotaPrivilege 1080 wmic.exe Token: SeSecurityPrivilege 1080 wmic.exe Token: SeTakeOwnershipPrivilege 1080 wmic.exe Token: SeLoadDriverPrivilege 1080 wmic.exe Token: SeSystemProfilePrivilege 1080 wmic.exe Token: SeSystemtimePrivilege 1080 wmic.exe Token: SeProfSingleProcessPrivilege 1080 wmic.exe Token: SeIncBasePriorityPrivilege 1080 wmic.exe Token: SeCreatePagefilePrivilege 1080 wmic.exe Token: SeBackupPrivilege 1080 wmic.exe Token: SeRestorePrivilege 1080 wmic.exe Token: SeShutdownPrivilege 1080 wmic.exe Token: SeDebugPrivilege 1080 wmic.exe Token: SeSystemEnvironmentPrivilege 1080 wmic.exe Token: SeRemoteShutdownPrivilege 1080 wmic.exe Token: SeUndockPrivilege 1080 wmic.exe Token: SeManageVolumePrivilege 1080 wmic.exe Token: 33 1080 wmic.exe Token: 34 1080 wmic.exe Token: 35 1080 wmic.exe Token: 36 1080 wmic.exe Token: SeIncreaseQuotaPrivilege 1552 wmic.exe Token: SeSecurityPrivilege 1552 wmic.exe Token: SeTakeOwnershipPrivilege 1552 wmic.exe Token: SeLoadDriverPrivilege 1552 wmic.exe Token: SeSystemProfilePrivilege 1552 wmic.exe Token: SeSystemtimePrivilege 1552 wmic.exe Token: SeProfSingleProcessPrivilege 1552 wmic.exe Token: SeIncBasePriorityPrivilege 1552 wmic.exe Token: SeCreatePagefilePrivilege 1552 wmic.exe Token: SeBackupPrivilege 1552 wmic.exe Token: SeRestorePrivilege 1552 wmic.exe Token: SeShutdownPrivilege 1552 wmic.exe Token: SeDebugPrivilege 1552 wmic.exe Token: SeSystemEnvironmentPrivilege 1552 wmic.exe Token: SeRemoteShutdownPrivilege 1552 wmic.exe Token: SeUndockPrivilege 1552 wmic.exe Token: SeManageVolumePrivilege 1552 wmic.exe Token: 33 1552 wmic.exe Token: 34 1552 wmic.exe Token: 35 1552 wmic.exe Token: 36 1552 wmic.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2066881839-3229799743-3576549721-1000\desktop.ini r.bin.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 api.myip.com 15 api.myip.com - Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 500 vssadmin.exe 1348 vssadmin.exe 1856 vssadmin.exe - Enumerates connected drives 3 TTPs
- System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" r.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" r.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" r.bin.exe - Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
Processes
-
C:\Users\Admin\AppData\Local\Temp\r.bin.exe"C:\Users\Admin\AppData\Local\Temp\r.bin.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Modifies extensions of user files
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
- Drops desktop.ini file(s)
- System policy modification
PID:3692 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3776
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:500
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1348
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1856
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:908