hive | 83796fb61255c7604cf96f0c5aec2ac62cbdeb9154289a0340407168d4809720

Analysis

max time kernel
57s
max time network
128s
platform
windows10_x64
resource
win10v20210410
submitted
28-07-2021 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

Score

10^/10

hive ransomware spyware stealer

Malware Config

Signatures

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 2 IoCs

Processes:

77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 6 IoCs

Processes:

77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\desktop.ini	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

Drops file in Program Files directory 64 IoCs

Processes:

77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\1036\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\VFS\ProgramFilesCommonX64\Microsoft Shared\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-125.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-24.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7834_24x24x32.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\mfc140u.dll	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-150.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_HK.properties.jwQGw9lb08iBIOKIXG35kWNu1KT3UJltQmfwt3jttmg.hive	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.jwQGw9lb08iBIOKIXG35kUloZmyZjZEHohVG3dBNEyQ.hive	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedStoreLogo.scale-100_contrast-white.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ro_16x11.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_contrast-white.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\MedTile.scale-100.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\LargeTile.scale-200.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-unplated.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\Bin\LightedTextured_VertexLighting_VS.fxo	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\_Resources\index.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Xaml.Toolkit\Assets\Buttons\Back\Back-over.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_EU-ES.respack	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125_contrast-white.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5613_40x40x32.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-125.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\New-Fixture.Tests.ps1	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.TXT	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\4632_32x32x32.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-24_altform-unplated.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-16.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\ui-strings.js	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ui-strings.js	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Mobile\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\nb.pak.jwQGw9lb08iBIOKIXG35kX8o0f2Ut6sFKf-0L8YKNX8.hive	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\libGLESv2.dll.jwQGw9lb08iBIOKIXG35kepLxIF49kRWvsFdV1Yyvw4.hive	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pt_BR.jar.jwQGw9lb08iBIOKIXG35kSNzNlZpqrNluKmKRs0T61w.hive	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files\Windows Media Player\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-24_altform-unplated.png	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\TimeControls.dll	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\ui-strings.js	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\SY______.PFB	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

Drops file in Windows directory 64 IoCs

Processes:

77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

description	ioc	process
File created	C:\Windows\INF\TAPISRV\0000\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_split.scale-100_8wekyb3d8bbwe\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Calendar\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Applications\Microsoft.WindowsCamera_2017.125.40.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\winsdkfb\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\DigitalLocker\en-US\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\0409\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\Assets\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\Boot\EFI\fr-CA\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\Help\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\INF\rdyboost\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.Views\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\Boot\PCAT\es-ES\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\Assets\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\Boot\EFI\en-US\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Applications\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\Media\Afternoon\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\Boot\EFI\es-MX\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\INF\.NET CLR Networking 4.0.0.0\0000\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\SurfaceProfiles\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\CSC\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\INF\ESENT\0409\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\MS.Entertainment.Common\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\INF\SMSvcHost 3.0.0.0\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Styling\css\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\Boot\Fonts\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\Boot\PCAT\nl-NL\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\IME\IMEJP\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\INF\MSDTC Bridge 3.0.0.0\0000\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\INF\TermService\0000\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\INF\usbhub\0000\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
File created	C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Fable\HOW_TO_DECRYPT.txt	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

Delays execution with timeout.exe 28 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
1464	timeout.exe
2756	timeout.exe
2436	timeout.exe
2208	timeout.exe
1612	timeout.exe
2428	timeout.exe
1648	timeout.exe
3944	timeout.exe
2716	timeout.exe
1000	timeout.exe
732	timeout.exe
2188	timeout.exe
3928	timeout.exe
184	timeout.exe
496	timeout.exe
736	timeout.exe
3504	timeout.exe
3636	timeout.exe
4072	timeout.exe
2428	timeout.exe
1188	timeout.exe
780	timeout.exe
2148	timeout.exe
192	timeout.exe
4004	timeout.exe
2768	timeout.exe
4052	timeout.exe
4016	timeout.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1840 vssadmin.exe

pid	process
1840	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

pid	process
4056	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
4056	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2072 vssvc.exe
Token: SeRestorePrivilege 2072 vssvc.exe
Token: SeAuditPrivilege 2072 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	2072	vssvc.exe
Token: SeRestorePrivilege	2072	vssvc.exe
Token: SeAuditPrivilege	2072	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.execmd.execmd.exe

description	pid	process	target process
PID 4056 wrote to memory of 1360	4056	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe	cmd.exe
PID 4056 wrote to memory of 1360	4056	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe	cmd.exe
PID 4056 wrote to memory of 1360	4056	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe	cmd.exe
PID 4056 wrote to memory of 1576	4056	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe	cmd.exe
PID 4056 wrote to memory of 1576	4056	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe	cmd.exe
PID 4056 wrote to memory of 1576	4056	77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe	cmd.exe
PID 1360 wrote to memory of 3636	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 3636	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 3636	1360	cmd.exe	timeout.exe
PID 1576 wrote to memory of 1840	1576	cmd.exe	vssadmin.exe
PID 1576 wrote to memory of 1840	1576	cmd.exe	vssadmin.exe
PID 1576 wrote to memory of 1840	1576	cmd.exe	vssadmin.exe
PID 1360 wrote to memory of 3944	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 3944	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 3944	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 1464	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 1464	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 1464	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 496	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 496	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 496	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2428	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2428	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2428	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2716	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2716	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2716	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2756	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2756	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2756	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 184	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 184	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 184	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2148	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2148	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2148	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2436	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2436	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2436	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 1000	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 1000	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 1000	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 732	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 732	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 732	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 192	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 192	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 192	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 4004	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 4004	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 4004	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2188	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2188	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2188	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 736	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 736	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 736	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2208	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2208	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2208	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 3928	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 3928	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 3928	1360	cmd.exe	timeout.exe
PID 1360 wrote to memory of 2768	1360	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe
"C:\Users\Admin\AppData\Local\Temp\77a398c870ad4904d06d455c9249e7864ac92dda877e288e5718b3c8d9fc6618.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3636
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3944
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1464
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:496
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2428
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2716
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2756
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:184
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2148
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2436
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1000
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:732
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:192
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4004
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2188
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:736
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2208
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3928
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2768
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3504
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1188
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1612
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2428
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1648
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4072
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4052
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4016
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\hive.bat

MD5
3c34a87cf0107262a93c2adccde10b37

SHA1
bcf860da19191d91f015096aedf16e7492238763

SHA256
5993e915a2c1520c5f1261d4139544dd998cb7f2c4f780bbe1ff29f5e86d0560

SHA512
8c6503bf188583611b000bdb128a3146b372ddf1ba9780942dc8675ad5bc39bf6da5ef61a35fc0153d154ee74662d6b9118f57ad24b0afe0fdc95068583905a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\shadow.bat

MD5
df5552357692e0cba5e69f8fbf06abb6

SHA1
4714f1e6bb75a80a8faf69434726d176b70d7bd8

SHA256
d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

SHA512
a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

Download Submit
memory/184-127-0x0000000000000000-mapping.dmp

Download
memory/192-132-0x0000000000000000-mapping.dmp

Download
memory/496-123-0x0000000000000000-mapping.dmp

Download
memory/732-131-0x0000000000000000-mapping.dmp

Download
memory/736-135-0x0000000000000000-mapping.dmp

Download
memory/780-147-0x0000000000000000-mapping.dmp

Download
memory/1000-130-0x0000000000000000-mapping.dmp

Download
memory/1188-140-0x0000000000000000-mapping.dmp

Download
memory/1360-114-0x0000000000000000-mapping.dmp

Download
memory/1464-122-0x0000000000000000-mapping.dmp

Download
memory/1576-115-0x0000000000000000-mapping.dmp

Download
memory/1612-141-0x0000000000000000-mapping.dmp

Download
memory/1648-143-0x0000000000000000-mapping.dmp

Download
memory/1840-120-0x0000000000000000-mapping.dmp

Download
memory/2148-128-0x0000000000000000-mapping.dmp

Download
memory/2188-134-0x0000000000000000-mapping.dmp

Download
memory/2208-136-0x0000000000000000-mapping.dmp

Download
memory/2428-124-0x0000000000000000-mapping.dmp

Download
memory/2428-142-0x0000000000000000-mapping.dmp

Download
memory/2436-129-0x0000000000000000-mapping.dmp

Download
memory/2716-125-0x0000000000000000-mapping.dmp

Download
memory/2756-126-0x0000000000000000-mapping.dmp

Download
memory/2768-138-0x0000000000000000-mapping.dmp

Download
memory/3504-139-0x0000000000000000-mapping.dmp

Download
memory/3636-118-0x0000000000000000-mapping.dmp

Download
memory/3928-137-0x0000000000000000-mapping.dmp

Download
memory/3944-121-0x0000000000000000-mapping.dmp

Download
memory/4004-133-0x0000000000000000-mapping.dmp

Download
memory/4016-146-0x0000000000000000-mapping.dmp

Download
memory/4052-145-0x0000000000000000-mapping.dmp

Download
memory/4072-144-0x0000000000000000-mapping.dmp

Download