Analysis

  • max time kernel
    155s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-08-2021 17:11

General

  • Target

    5984c5c2b4ccc824c196ad3a9f966013.exe

  • Size

    151KB

  • MD5

    5984c5c2b4ccc824c196ad3a9f966013

  • SHA1

    6f5c96fb67b4b88d08d0b4e28001421366c4cd66

  • SHA256

    7e92233d9ad854b672068825a64c442ed8e6f4f283729c874296278e235d7241

  • SHA512

    443ba4a8df892f3d0a6a7bc70233c639e92af87e9beb38dbdd4396f0896dd640a1fde3e513a73de6b13c6add3801bc34b90659bcd0e71cc05eb7fdb0c1c573b8

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. PAY FAST 590$=0.013 btc or the price will increase tomorrow bitcoin address bc1qqxnp9z0ff8x852dyflp5r9r6rzse8jl5hzmqz8 To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? [email protected] TELEGRAM @ payfast290 Your personal ID: C95-F8C-EF5 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Path

C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt

Family

ryuk

Ransom Note
��������Ŀ �ZEPPELIN� ���������� ��������Ŀ �ZEPPELIN� ���������� ������������2M�x�?�B��$�2��S��{Pˡ���K� ��u�m �2SG�W������<�Qpvڕ����OM�  &K*״��X�] �U5O(���Dy��v����Ri��7� CL��Pƒ��l/O���d�Y�n� U#�)x|�y$8;���տ8�ƣ�����t4|�E�H����uf�(���N�p��~�~j��0�}o���#/���cƐ��֤�_@����>?o�X!���EX���6��i���zP0܀�N�ǧ�I(�����Uf�?zhQ8QŦY.���֪s]X/W?݈�x������b��.�� �}=ү_��?K;�vi� ���WV�v���e,���K�YR;����Ǧ��7��l�wh���!�o}#3V�K��~ Lk�@�O�����g�Րԏ�I>�]��+�z�/��� rK9�G�=���{�)����c���i�5<��9bQ* ���kB�,�\�V��r�'� A����!t��[n��� �IINP��Y�S��Z� ܏#e_E���<�bH��X��[������4ˍ�B5�<�c�v�����������+���,p�9}`�ҫ����d���)Q!��=���-�u����V��o�W�-��d��+!� .d������W6�E�a�䌄{��?��;=�ɏ�O�[��l,� h��fE.��V� Bo��ף���)��.��t���`U ����l��F���� � #����͢{���[�وMVۄ�D�}����b�A����Q���rԭ�A�A�&�ճv^؊pF��&�gH8uR��GF���V�n0;;HZ��}c��ʗRLY���+�6�=��� =��x8�a5���Jl�G����%jaʮ�4EB� ����˪�t�/Kl�F�Ճ���F��<:��N,a|FM�bL�K[���Ftl2��S��I�Q�3 ?7:����'s-�oέ!�`��.t!B q%|�=�6�"�V��*�.�ۆb-X��X���#M滀oٓ���A��Z����B�K��O�������m����[o��&�D�4���d���`Ά{/v��P�C��������Vn1>� BBu���' ML��)���Υr���U��)�w�)�vc�?�t�H�%��G���~b�|���{"�f���KظQ"�0�I�ŤWm؎�;:+ODkf���U>��eф����$�'���2�ĊTVM��I��o�������>��b�e���v��" \0|3L�B� !��S���*�bA#���s�3�w�X}- s9'�8V���@ ��˶7f�Ę@I�u���䜉��Z��5vM���n�`��JST���ǰ��M�)�;ű%:� c�SIL�c�}�P��P3Wn�ˑi�c饸3����:�RjЋ-/A� gƜ��`��g����Ox��c<f;��><c�B6[���B��b����� K�c�����~2mP�6ݚ�r�P�qe���ñp^�s7~�`�oY�3��8rpvUA����8��*��A'`� q�lw�W��m���3E�w�.���G�B�&�@+:5Y�1w:Sg ��Iӟ��Bltt�p�I1��SF���/!�R�W���L�����)̼�%���L����)���=��jn�>M��P��ԕ�N �.����3x�w��x{���Q�$d��$�ꓔ=tUc�o1۩.WJ���=����FW�b'������C���o�<�_�<:M]�7?��U�Sc����)�pSlJ$q�O����m��Ď����xLI�����O�=��Q��<b��9��&��F���m;b�z�de��J�haGAGB�5 �2ʧpRF���h��9S�������0�D�i8�z�PI�V̋�T\���)V?���W��yB�Y�c��U�{E������q|N��$j<����6�������A\��H`s�<�Y��h9bߞ�};d�j|h}����Ubri�����W�fP;�h�8����C�T��E��� "�7�R)��ݘ�4���ͺ(^��L�-&e�ܞ������ȩ�Z�a�����5hH�KI!/F�D�p�Ȧ����!u��UEb�!?�׈��X\�J��_�գ:'��Y�����!{Kz������ L�I�KO W۷����/�e$F^M�j��g֔� w���� �Z���t���B��܇<:_0�����6X�G/���i���r寀(e�0%��o.�tE6��v�!�P#�V6����s�}��J/.C'�ߺN_!ʥ]K�~�D?r������ی�]N����o�*љ�`��NL|���+��YX����S�j�c���0(��$|�����B�c٧��w���k���q�<Õ[�y��������(� I��C�g�<���DH~�����j���a��o�f�9�'Ǥ��8�}��m�3 �xi/Q������� �Rq3��`�'ͯ�����:����N�F=R���J`�����& &�.�4� j#H�%�F���ʺ�w9h]č���|J���T�0L��)�彋��hW1p�#>'�r|��?Fp!��%b�} (��'I�*������st�G�I%#���R*��9��0(��:�:�q���7�l�4���Ҝݖ��hjfK�E�:���?�����" �4�r�M%�$5���b�}��Eg�-jÿ6�<Eh&�h�ìqo�N�@�W����xю�`�����Pͫ{h~i)����c��WW��`�, vV��������y��q��;�饟{uq����ɔ��>�A&H/���j"��0"B�ϥ|�g������@6��m4T}���dq}�ԩe���y�AUQ9��E� B�eQ;��A}�ya�w�F����=9�/x��Q�c���ԎU����Xv��0S �0u�G�k�oY�i�5���u3�X��-R�n%�l�X��%ф��G�G� c��7L�QWVZ�Ku_�� w��J�U��5(�������ye�>6�p���d´Q���A�m�OA2;���DQ!�l�j�0p k��$��fa��"�@�"dd�=�.+�ݎmo)��R�^�Γ:\���؈�,�ܛ��S�wd�#�2��E�=$C�Vڬ��/ zt+o �=��Q���5��{��C8s���Fb����Se���qy�i��Z��d8q�*.�y�fB �r���{�����}֥�؀"Vl��ŷ�c���kP�*85�1.z���Uj٤g�Hc�����IN�=*d�!)���WA��_��6��~I����e]�"��+��Zx�%̱��c����M�4�`��,�9:�ц���6,_$������)���cn�^�{yc��Q�զ�H65�k~*"gR>Eh܎'��ZOU��� C�ڼtuq�'G���/��I�����1� D��se�) ������g!��z��g�"@���h�����z�!��^��o�ĹXV��]֎y:����$I�����Cs]{���6Eur��8�e[|���Ӂ���t�[��Y�|�W���*��B\��ڄ�Q��V�[(�_L��#mJ��HO��b '˲g����`-4��>�*�B�'0&-H�P���`_4P,t�[�[���NA�D�}j��k���c2~}4�oW\��;�;�ho�;_�;mRϓ��3����}b3=�����NA �]i ����CX@V��^�� g��y5�8��,���V��Y�-S�X���NPr��_�4�A�ezTR�� t�x�/� ��8�zΏ����儥E�&gB��r���N���i=Z�p��^j�wu���j*Z-I<�Dfd��)�:����l���'� �Z9�)rm� ���-��[�U���tC3ݣ9�w����F}�%�,������mG���;Eیe;�oqAi���ٝ�mE�R�&i�L˪X%x�`! �j}r����.�@(i�|���57u��7Q�$�?����?Jv��14�a����b���$i_�]�G�߁,�n��T'��[hJ"����Gg��8�G����.��Q>"'�~�b�����?2_�P��[dҭ��*b���Fg�>����}-�]I��E���)%i0~7�v��oEO�ur12+naY����wħ���{�ԯ1e��(�}�㿦k���W�O�mѹ��ģT��؛vAŝ�'�B0�ė`A.&�g*��g��|�p�&-(p)f+^ E6 <��5��@]���n R�'����A��Z8N@�Q���Ai�p�F��+AD�<�p\e$1��S��U��dG<Q6���ĉ)CQ���G�tD� 6�~D8�é�Aʧ�!���P��f�m2�Q?�S*!��^��5|l��Y ��B���ɀ�w���x�/��y� 86]V���=��h�B.�C""n�;V�o,�:7���3�k)��ZQ�1`�W)�m�%�W�ԸZq �\ �&%�u2G?�~A���N�fW+s��ˉVN��J�rƟ'���bm٨��+j�P�i��=��[��NO+��D�!�����R�{�]�s[��)PM�(:�-����N'��JWM�����,="g����e�C��)�v��@bQn�Ҙƒ�+ tJC���)sF½p�����c�V�&�b���H�Avtn;��d?�9�K��$�]~2�'VԞ��nD�2q��������:ð�̚R'�f� ��I���x;L���}�k:���XeE��7r���V sh�1�&�Kgy���Zr���HL1ъ�ձ2�(��6#U�y�����E�����p��3�9�?�\,w�˭E�Y��G3��3X�0<�K���q�TM݇��87K˭K��Rn-�"�',�]|ߙ�*�Ӱӽ1�Y��o�MV�gQYYt ��H������Ǧ^x��hc_R�M�?�'>ׅ����;�Q� ̯�u߯�fī �}���);�� ��AA��ݩ&�ȖY�����#��tĥ���[�Ս�$೨+�o"]t����Yw�S��Q��Zj�d�gI�%��*�m,�h���Ayof�n��5n����GY����Ӹ���M�����̀��"���5B"��j>f��3e�gr�4���=!���ƃ�(.b���b�t�ㆊ�Q9O�z����U��Q�i����S�� nޒ;t��Z�P�W��J�/K�OO�u�( � ��L�����p/�Qe��C)�[)g�(���^�^� �ZI���W�fӣhu2�Ղu�N.��9����N���]R������<���W#Qga�Q�w9"a#��.5<���g�T#������} Daנ�Z�֓]T�v��ّl�W�"�W���,��� ��0�p|Ĺ�Emf||��?�m*V����I���b~�\ ���!XM:���������b�{ ���j�{Y�:��� �D����8����0�X��T�i#Y�ݵ��L�����h�|J*B�edS׀����o( �����E��8���ÛX$P���v��@�c�TYT��$�cQ�Q$.Z�������Z���7�CYs��ӓ�\�d��e!SF�i��nC���:��zU�,=��~�������N�ſ?'iě���e�b9����]�D(C?����̳�&]C��i:�߬{O�i�*iĄ �k1��d��̿�"U��m6��J5�(�C� P�#ā�h$`C��K�z���p��sr��;Yb '35��� ��%�q�����R� ��0����U�Vr�ڽ4����a�/k��tk=# h��@ef�}����ɤp�C���GX:g�K�q4��~���td�ߎ;��Y4_�5���J͌�:ZҺ[�QbeC�L>>N`j}�D��&3o٪����������J^.�E<�j+Rv��\� Ka�7b�l�$�G�Ώ�D#*f�9r3��Z�4Ba���V�ϣK���\=l���e|��}]��"�.��Ņ��䪯 ��+o��f9�]/{l�ژh�?�� ��F����!��؍ҙL}')�y$����ɉ.�l��<\�ERA=i�Hµ���/F���ԗ��E��A��:�%O}�KYx��H�3�9�T�R3��>�m&T�<�dgn�k-8��)A��?���,rix�Ԋ�a0�|��4ғ �Bc:��ԋ1�[�{����5�YOԪ��V�emgY��k�]����D�E���&׬�."I���g�]�g"��T�R����+��m�W�$���3�{�`>n���秐]�3 �" ���^lE���|/(U0��3�g���Sy�%ʐJ�>� q ����Zb~�F�:�.���J:4���� ��1�V}�����������p(��xJ6P%�� 2�n���PU^S��@)p���C�ݬ�@��LI�9�t�r>rF�|4B���c$y!��yuVҪ�!��,/H�L|�P�����z�د��Z�v����Ij� ��9&��0E?}�������=3��ħ*�zco>�Ԏ����vX1��i ���Nut�{�\d3R>��X9� �R�T��h�B��Z�m����"�����]o $~�b��Jq����6�3�:���M 6��`/Gf���;��_���e�s|���4�b��Ͻ� V�D����O�p_Me0�j�k9��r��m��%�����4��g ���K1�GL�=?�h�����T�'>�L� k���AR|Q�D�2�ɔa0���E �9��M���� tW1e�l�����gc㴖q���2��F!� F�A�+����J����FJ����u�?�Fs{������Xj�ѵ߲!�� ��`C� HU�p|Lxt��v�%k�n�V__I��``� ��&����.i��]xt9��x�߆��=H��.ھY ����,���ù��>Z*���f|���.w��25��?���� Q����w�UD�3P�I� ���*&HĂ���mvZ׊Nz���l���_X�৴���8����S���i ��h��ǀ��l��-��8�<�i/P��h&� �.s��4�8��߭�d)��U䍊*Ձ��xU�]8(� n�_7�s�iPU�C��0gEE)���K�e>Y1��gi��XV� �&4V����W���7�܍谞L��yޚ�-��{J������[���;2>�e�E�g����[n��������n<ZjXih8���n�����E:�tw:8�9̄<���H��b1^0{�i"����G�Uj��N�/��[q����q������p9�����nL�ه�:��*�*j�WT�i@s<D��)7�P�qU��C ���Ɠu����P~�E�s��DZ@�7R?��������`S�r��{���D� w����T�*h������*���շCrţGݫ&EU�!� K�s�-J��U+��f�=�R*u|�i8�I���b�t)2Ͻ� (�8x��/x�ݤ���s���r�e4�)�m���3t���� t]�@��X���d5&�4Zc؀H��*U: ž*_��o�����)�!��d��G��~0�E��ߟ����S���V��M��3���^���n��A�YO��wC�U��I~��z�{�HM�<��Z�b�5F$�n�c���PB>�v�D#h�Ĩ�6�������b�Sb�z\+�b�� ��r :���F��鶢u ����ѫ��7����saU���/�oB�yW�>�E� ����h�:(��"��E��� �,�E��H�0ʶ��-���I)�~rd��Ny����A��A�yfJ`�'��$#�a��,� D����7�H��y� S0�?�ej싻H�\Ӏ��npم�iA�¾:���4��l(��D�U�x�,#)�t����bHzN��6 *Q��F��pR�%-� Ä�Y٢�=<P�p7A���4 � !���C� ��1�]9��C/"��!͘F+g��75���k*�gAf������������M�~�u��/o4P۪ɼTNY:���iA�%����Q,�34�¿����-���X�����+A�E�K&YHY��v��1D�")�~��8��H�ed�����g�2�4������ Ăr���nҗâ�H��V¹���V�� ��9*�p)1�;l���DwLz��P�� �Xt ZK"��'�`?(=�+�}({�,2����,�w��7����3P��[� �-,��g��A��k�~��Zk���n_��sa��.>���i?������k��j�d`St��J� K��~�ÜSv���~���pӐ ��X'�b���\s_ڇ��"B�%�P��{ml#���$���;5_[�ؔ������� ��\�Iæ[Ѧ ��֢���S?��e�|(��������^�����Թ� �f�� � ؖ+�(���@Y�l"HiF.�����^[������w��$V�pl�-����݋eU���?Ok$���J�H8r��ƍ��ت,�������]��(�O�|O�� ����8=�%C���1��!,�I���p�CR���"���4�EҲy�TG��ޘ�l��Q /V�!��Y χ �Cg0�^��`���܀�`[��/T� ��ž�Yu0�4U(�'�B||��_aS �dn�:gG� �$�P�{������#h��h��?�?�r���ɽ ?�J���n�=��#�PB;7U��A)���>�]�?��yO�a[�S�i��I�?�T\i�қ�<�~�����0�_P�E���m��

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

http://readinglistforaugust6.site/

http://readinglistforaugust7.site/

http://readinglistforaugust8.site/

http://readinglistforaugust9.site/

http://readinglistforaugust10.site/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

40.1

Botnet

824

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    824

Extracted

Family

vidar

Version

40.1

Botnet

903

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    903

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 1 IoCs
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5984c5c2b4ccc824c196ad3a9f966013.exe
    "C:\Users\Admin\AppData\Local\Temp\5984c5c2b4ccc824c196ad3a9f966013.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Users\Admin\AppData\Local\Temp\5984c5c2b4ccc824c196ad3a9f966013.exe
      "C:\Users\Admin\AppData\Local\Temp\5984c5c2b4ccc824c196ad3a9f966013.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3464
  • C:\Users\Admin\AppData\Local\Temp\FE3C.exe
    C:\Users\Admin\AppData\Local\Temp\FE3C.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1136
  • C:\Users\Admin\AppData\Local\Temp\FF75.exe
    C:\Users\Admin\AppData\Local\Temp\FF75.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:3612
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im FF75.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\FF75.exe" & del C:\ProgramData\*.dll & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im FF75.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2232
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 6
        3⤵
        • Delays execution with timeout.exe
        PID:3148
  • C:\Users\Admin\AppData\Local\Temp\16A.exe
    C:\Users\Admin\AppData\Local\Temp\16A.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1328
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      PID:2296
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
          PID:3880
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2212
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:200
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:204
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -agent 0
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:1892
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
                PID:4060
                • C:\Windows\SysWOW64\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  4⤵
                  • Interacts with shadow copies
                  PID:948
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                3⤵
                  PID:1280
            • C:\Users\Admin\AppData\Local\Temp\4B7.exe
              C:\Users\Admin\AppData\Local\Temp\4B7.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1196
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                2⤵
                • Loads dropped DLL
                PID:1364
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1488
                  3⤵
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3932
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:1536
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:1816
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:3476
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:2292
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:3596
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:3636
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:1988
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe
                            1⤵
                              PID:3884
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              1⤵
                                PID:3600
                              • C:\Windows\system32\vssvc.exe
                                C:\Windows\system32\vssvc.exe
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1876

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • memory/1136-153-0x0000000005A40000-0x0000000005A41000-memory.dmp

                                Filesize

                                4KB

                              • memory/1136-141-0x0000000005A70000-0x0000000005A71000-memory.dmp

                                Filesize

                                4KB

                              • memory/1136-167-0x0000000005CC0000-0x0000000005CC1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1136-128-0x0000000076EB0000-0x000000007703E000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/1136-151-0x0000000005B10000-0x0000000005B11000-memory.dmp

                                Filesize

                                4KB

                              • memory/1136-147-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1136-133-0x0000000000800000-0x0000000000801000-memory.dmp

                                Filesize

                                4KB

                              • memory/1136-140-0x0000000006060000-0x0000000006061000-memory.dmp

                                Filesize

                                4KB

                              • memory/1196-132-0x0000000000460000-0x0000000000461000-memory.dmp

                                Filesize

                                4KB

                              • memory/1196-157-0x0000000005B10000-0x0000000005B5E000-memory.dmp

                                Filesize

                                312KB

                              • memory/1196-160-0x0000000005C00000-0x0000000005C01000-memory.dmp

                                Filesize

                                4KB

                              • memory/1196-136-0x0000000005150000-0x0000000005151000-memory.dmp

                                Filesize

                                4KB

                              • memory/1196-152-0x0000000004C50000-0x000000000514E000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/1364-178-0x0000000000400000-0x00000000004A1000-memory.dmp

                                Filesize

                                644KB

                              • memory/1364-169-0x0000000000400000-0x00000000004A1000-memory.dmp

                                Filesize

                                644KB

                              • memory/1536-143-0x0000000000670000-0x00000000006E4000-memory.dmp

                                Filesize

                                464KB

                              • memory/1536-144-0x0000000000600000-0x000000000066B000-memory.dmp

                                Filesize

                                428KB

                              • memory/1816-146-0x0000000000110000-0x000000000011C000-memory.dmp

                                Filesize

                                48KB

                              • memory/1816-145-0x0000000000120000-0x0000000000127000-memory.dmp

                                Filesize

                                28KB

                              • memory/1988-187-0x0000000000340000-0x0000000000344000-memory.dmp

                                Filesize

                                16KB

                              • memory/1988-188-0x0000000000330000-0x0000000000339000-memory.dmp

                                Filesize

                                36KB

                              • memory/2292-162-0x0000000000A80000-0x0000000000A8F000-memory.dmp

                                Filesize

                                60KB

                              • memory/2292-161-0x0000000000A90000-0x0000000000A99000-memory.dmp

                                Filesize

                                36KB

                              • memory/3000-117-0x0000000000EC0000-0x0000000000ED6000-memory.dmp

                                Filesize

                                88KB

                              • memory/3464-115-0x0000000000400000-0x0000000000409000-memory.dmp

                                Filesize

                                36KB

                              • memory/3476-154-0x0000000000180000-0x0000000000187000-memory.dmp

                                Filesize

                                28KB

                              • memory/3476-155-0x0000000000170000-0x000000000017B000-memory.dmp

                                Filesize

                                44KB

                              • memory/3492-114-0x0000000002DA0000-0x0000000002DAA000-memory.dmp

                                Filesize

                                40KB

                              • memory/3596-177-0x0000000003390000-0x0000000003399000-memory.dmp

                                Filesize

                                36KB

                              • memory/3596-172-0x00000000033A0000-0x00000000033A5000-memory.dmp

                                Filesize

                                20KB

                              • memory/3600-210-0x00000000032F0000-0x00000000032F9000-memory.dmp

                                Filesize

                                36KB

                              • memory/3600-209-0x0000000003300000-0x0000000003305000-memory.dmp

                                Filesize

                                20KB

                              • memory/3612-139-0x0000000000400000-0x00000000023FF000-memory.dmp

                                Filesize

                                32.0MB

                              • memory/3612-138-0x0000000003FD0000-0x000000000406D000-memory.dmp

                                Filesize

                                628KB

                              • memory/3636-180-0x00000000009B0000-0x00000000009B6000-memory.dmp

                                Filesize

                                24KB

                              • memory/3636-181-0x00000000009A0000-0x00000000009AC000-memory.dmp

                                Filesize

                                48KB

                              • memory/3884-206-0x0000000000BF0000-0x0000000000BF9000-memory.dmp

                                Filesize

                                36KB

                              • memory/3884-205-0x0000000000E80000-0x0000000000E85000-memory.dmp

                                Filesize

                                20KB