Analysis
-
max time kernel
36s -
max time network
163s -
platform
windows10_x64 -
resource
win10-en -
submitted
20/09/2021, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
sqlservr.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
sqlservr.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
-
Target
sqlservr.exe
-
Size
1.8MB
-
MD5
e1338c42da2d2363afbbd0eeabad1ca9
-
SHA1
fe5d669b732c9227bb25787083906f49b732c335
-
SHA256
61c47effdf6b6eafd20e74a8a6b52da09e082fefef31c6ae4a2046b6a756050e
-
SHA512
bcc887777c3bcb778000893c15357abcc9a78009a1cd8ae325de787a918d98ded1100fe9b21b79b16fe1d44d5d9fe0147292164ff36cf12a13e9e31b02ed372a
Score
10/10
Malware Config
Extracted
Path
C:\Read Me.TXT
Ransom Note
8888888b. 888
888 Y88b 888
888 888 888
888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888
8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P"
888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888
888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888
888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888
Made by Cerebrate - Dread Forums TOR
[http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/]
[Q1] What happened, I cannot open my files and they have an odd extension?
[A1] Your files have been encrypted by Redeemer, a new ransomware operation.
[Q2] Is there any way to recover my files?
[A2] Yes, you can recover your files. This will however cost you money in XMR (Monero).
[Q3] Is there any any way to recover my files without paying?
[A3] Without paying it is impossible your files.
Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security.
Without a proper key, you will never regain access to your files.
[Q4] What is XMR (Monero)?
[A4] It is a privacy oriented cryptocurrency.
You can learn more about Monero on getmonero.org.
You can view ways to purchase it on www.monero.how/how-to-buy-monero.
[Q5] How will I decrypt my files?
[A5] Follow the general instructions:
-1. Buy 02 XMR.
-2. Contact [email protected] and send the following key:
-----BEGIN REDEEMER PUBLIC KEY-----
MTAK4k1pfaewqYz8kbtiZBAJ2bLqybEnTQUjkVbRp0QudQEkTo
2bnZAYmruQNo390d3jhST98DGo+eH6f3eMZ+3eVq6PbOLOYBwY
WHHPIOV02IWPGO4917ixFp0LD6ceyEVfSWjoBjDLlBPXqJMJ89
x28YDv21MV0Jy9o4GMDVuLjfKiroFJT2sCFn+foWf4UM24SiYg
jeQRvHA5i8enWNh+Jljb9zFE7h/vBKYSwbJrUoPloyWkrFq6w6
oTzs0bmP+2pCjZEVSB7CSmxpJnvJyur6jO932S/HQmwz+8B5s8
8+kfm4CPvejmkHsLZQhgsGVd5cCRoWFGCxUW/8B7jGE+LcrETn
WIivmN4h2yuiTpaotewcmnOlaF+Mg36AWmyk9BjAy7KpE26yAx
kYXfNPBFEQ4Xk3oIPlvtqYkDZ7LuNSZrbkrFqzBSkStOGfxElV
F12dAstpole9XGWmaKAyDsOYTJBon3USW9xGzTrAe4CtqRQHOw
ShY/OSFeHX8i74V1REVCWkSOPSFYPC49PSByio1tZ54rcMknBe
xCqIDpLrqxTanfrRTJLqwXD4X6Mg+PJZIvYAgzVGeVac3szUl9
iwCRsSK1CB4in+mbvVvEmQ9PQgEagMW+HbhNk01KhAKpwQmZdX
NLx+4cbVO4J9fURsgaRc/I/jNv2ifelKMJWQ==
-----END REDEEMER PUBLIC KEY-----
-3. You will receive an XMR address where you will need to pay the requested amount of Monero.
-4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.
Emails
Signatures
-
Clears Windows event logs 1 TTPs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1256 svchost.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\UnpublishNew.tiff svchost.exe File created C:\Users\Admin\Pictures\ImportUnprotect.tif.redeem svchost.exe File created C:\Users\Admin\Pictures\UnpublishNew.tiff.redeem svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation sqlservr.exe -
Deletes itself 1 IoCs
pid Process 1256 svchost.exe -
Modifies WinLogon 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "8888888b. 888 \n888 Y88b 888 \n888 888 888 \n888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 \n8888888P\" d8P Y8b d88\" 888 d8P Y8b d8P Y8b 888 \"888 \"88b d8P Y8b 888P\" \n888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 \n888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 \n888 T88b \"Y8888 \"Y88888 \"Y8888 \"Y8888 888 888 888 \"Y8888 888 \n\nMade by Cerebrate - Dread Forums TOR\n[http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/]\n\n\n\n[Q1] What happened, I cannot open my files and they have an odd extension?\n[A1] Your files have been encrypted by Redeemer, a new ransomware operation.\n\n[Q2] Is there any way to recover my files?\n[A2] Yes, you can recover your files. This will however cost you money in XMR (Monero).\n\n[Q3] Is there any any way to recover my files without paying?\n[A3] Without paying it is impossible your files.\nRedeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security.\nWithout a proper key, you will never regain access to your files.\n\n[Q4] What is XMR (Monero)?\n[A4] It is a privacy oriented cryptocurrency.\nYou can learn more about Monero on getmonero.org.\nYou can view ways to purchase it on www.monero.how/how-to-buy-monero.\n\n[Q5] How will I decrypt my files?\n[A5] Follow the general instructions:\n-1. Buy 02 XMR.\n-2. Contact [email protected] and send the following key:\n\n-----BEGIN REDEEMER PUBLIC KEY-----\nMTAK4k1pfaewqYz8kbtiZBAJ2bLqybEnTQUjkVbRp0QudQEkTo\n2bnZAYmruQNo390d3jhST98DGo+eH6f3eMZ+3eVq6PbOLOYBwY\nWHHPIOV02IWPGO4917ixFp0LD6ceyEVfSWjoBjDLlBPXqJMJ89\nx28YDv21MV0Jy9o4GMDVuLjfKiroFJT2sCFn+foWf4UM24SiYg\njeQRvHA5i8enWNh+Jljb9zFE7h/vBKYSwbJrUoPloyWkrFq6w6\noTzs0bmP+2pCjZEVSB7CSmxpJnvJyur6jO932S/HQmwz+8B5s8\n8+kfm4CPvejmkHsLZQhgsGVd5cCRoWFGCxUW/8B7jGE+LcrETn\nWIivmN4h2yuiTpaotewcmnOlaF+Mg36AWmyk9BjAy7KpE26yAx\nkYXfNPBFEQ4Xk3oIPlvtqYkDZ7LuNSZrbkrFqzBSkStOGfxElV\nF12dAstpole9XGWmaKAyDsOYTJBon3USW9xGzTrAe4CtqRQHOw\nShY/OSFeHX8i74V1REVCWkSOPSFYPC49PSByio1tZ54rcMknBe\nxCqIDpLrqxTanfrRTJLqwXD4X6Mg+PJZIvYAgzVGeVac3szUl9\niwCRsSK1CB4in+mbvVvEmQ9PQgEagMW+HbhNk01KhAKpwQmZdX\nNLx+4cbVO4J9fURsgaRc/I/jNv2ifelKMJWQ==\n-----END REDEEMER PUBLIC KEY-----\n\n-3. You will receive an XMR address where you will need to pay the requested amount of Monero.\n-4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Redeemer Ransomware - Your Data Is Encrypted" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "8888888b. 888 \n888 Y88b 888 \n888 888 888 \n888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 \n8888888P\" d8P Y8b d88\" 888 d8P Y8b d8P Y8b 888 \"888 \"88b d8P Y8b 888P\" \n888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 \n888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 \n888 T88b \"Y8888 \"Y88888 \"Y8888 \"Y8888 888 888 888 \"Y8888 888 \n\nMade by Cerebrate - Dread Forums TOR\n[http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/]\n\n\n\n[Q1] What happened, I cannot open my files and they have an odd extension?\n[A1] Your files have been encrypted by Redeemer, a new ransomware operation.\n\n[Q2] Is there any way to recover my files?\n[A2] Yes, you can recover your files. This will however cost you money in XMR (Monero).\n\n[Q3] Is there any any way to recover my files without paying?\n[A3] Without paying it is impossible your files.\nRedeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security.\nWithout a proper key, you will never regain access to your files.\n\n[Q4] What is XMR (Monero)?\n[A4] It is a privacy oriented cryptocurrency.\nYou can learn more about Monero on getmonero.org.\nYou can view ways to purchase it on www.monero.how/how-to-buy-monero.\n\n[Q5] How will I decrypt my files?\n[A5] Follow the general instructions:\n-1. Buy 02 XMR.\n-2. Contact [email protected] and send the following key:\n\n-----BEGIN REDEEMER PUBLIC KEY-----\nMTAK4k1pfaewqYz8kbtiZBAJ2bLqybEnTQUjkVbRp0QudQEkTo\n2bnZAYmruQNo390d3jhST98DGo+eH6f3eMZ+3eVq6PbOLOYBwY\nWHHPIOV02IWPGO4917ixFp0LD6ceyEVfSWjoBjDLlBPXqJMJ89\nx28YDv21MV0Jy9o4GMDVuLjfKiroFJT2sCFn+foWf4UM24SiYg\njeQRvHA5i8enWNh+Jljb9zFE7h/vBKYSwbJrUoPloyWkrFq6w6\noTzs0bmP+2pCjZEVSB7CSmxpJnvJyur6jO932S/HQmwz+8B5s8\n8+kfm4CPvejmkHsLZQhgsGVd5cCRoWFGCxUW/8B7jGE+LcrETn\nWIivmN4h2yuiTpaotewcmnOlaF+Mg36AWmyk9BjAy7KpE26yAx\nkYXfNPBFEQ4Xk3oIPlvtqYkDZ7LuNSZrbkrFqzBSkStOGfxElV\nF12dAstpole9XGWmaKAyDsOYTJBon3USW9xGzTrAe4CtqRQHOw\nShY/OSFeHX8i74V1REVCWkSOPSFYPC49PSByio1tZ54rcMknBe\nxCqIDpLrqxTanfrRTJLqwXD4X6Mg+PJZIvYAgzVGeVac3szUl9\niwCRsSK1CB4in+mbvVvEmQ9PQgEagMW+HbhNk01KhAKpwQmZdX\nNLx+4cbVO4J9fURsgaRc/I/jNv2ifelKMJWQ==\n-----END REDEEMER PUBLIC KEY-----\n\n-3. You will receive an XMR address where you will need to pay the requested amount of Monero.\n-4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Redeemer Ransomware - Your Data Is Encrypted" svchost.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\WIN_TEMP_\ sqlservr.exe File created C:\Windows\WIN_TEMP_\svchost.exe sqlservr.exe File opened for modification C:\Windows\WIN_TEMP_\svchost.exe sqlservr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2244 vssadmin.exe -
Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance sqlservr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\redeemer cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\redeemer\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\redeemer\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\redeemer\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\redeemer\Shell\Open\Command\ = "\"C:\\Windows\\system32\\cmd.exe\" /c msg * Redeemer Ransowmare - this file cannot be opened until decrypted. Check ReadMe.TXT for more details how to decrypt your file." cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.redeem cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.redeem\ = "redeemer" cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 3724 vssvc.exe Token: SeRestorePrivilege 3724 vssvc.exe Token: SeAuditPrivilege 3724 vssvc.exe Token: SeSecurityPrivilege 3892 wevtutil.exe Token: SeBackupPrivilege 3892 wevtutil.exe Token: SeSecurityPrivilege 4012 wevtutil.exe Token: SeBackupPrivilege 4012 wevtutil.exe Token: SeSecurityPrivilege 988 wevtutil.exe Token: SeBackupPrivilege 988 wevtutil.exe Token: SeSecurityPrivilege 1056 wevtutil.exe Token: SeBackupPrivilege 1056 wevtutil.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe Token: SeTakeOwnershipPrivilege 1256 svchost.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 4044 wrote to memory of 1256 4044 sqlservr.exe 70 PID 4044 wrote to memory of 1256 4044 sqlservr.exe 70 PID 4044 wrote to memory of 1256 4044 sqlservr.exe 70 PID 1256 wrote to memory of 3876 1256 svchost.exe 72 PID 1256 wrote to memory of 3876 1256 svchost.exe 72 PID 1256 wrote to memory of 3876 1256 svchost.exe 72 PID 3876 wrote to memory of 2244 3876 cmd.exe 73 PID 3876 wrote to memory of 2244 3876 cmd.exe 73 PID 3876 wrote to memory of 2244 3876 cmd.exe 73 PID 1256 wrote to memory of 4064 1256 svchost.exe 75 PID 1256 wrote to memory of 4064 1256 svchost.exe 75 PID 1256 wrote to memory of 4064 1256 svchost.exe 75 PID 4064 wrote to memory of 3892 4064 cmd.exe 76 PID 4064 wrote to memory of 3892 4064 cmd.exe 76 PID 4064 wrote to memory of 3892 4064 cmd.exe 76 PID 1256 wrote to memory of 636 1256 svchost.exe 77 PID 1256 wrote to memory of 636 1256 svchost.exe 77 PID 1256 wrote to memory of 636 1256 svchost.exe 77 PID 636 wrote to memory of 4012 636 cmd.exe 78 PID 636 wrote to memory of 4012 636 cmd.exe 78 PID 636 wrote to memory of 4012 636 cmd.exe 78 PID 1256 wrote to memory of 840 1256 svchost.exe 79 PID 1256 wrote to memory of 840 1256 svchost.exe 79 PID 1256 wrote to memory of 840 1256 svchost.exe 79 PID 840 wrote to memory of 988 840 cmd.exe 80 PID 840 wrote to memory of 988 840 cmd.exe 80 PID 840 wrote to memory of 988 840 cmd.exe 80 PID 1256 wrote to memory of 676 1256 svchost.exe 81 PID 1256 wrote to memory of 676 1256 svchost.exe 81 PID 1256 wrote to memory of 676 1256 svchost.exe 81 PID 676 wrote to memory of 1056 676 cmd.exe 82 PID 676 wrote to memory of 1056 676 cmd.exe 82 PID 676 wrote to memory of 1056 676 cmd.exe 82 PID 1256 wrote to memory of 3880 1256 svchost.exe 83 PID 1256 wrote to memory of 3880 1256 svchost.exe 83 PID 1256 wrote to memory of 3880 1256 svchost.exe 83 PID 1256 wrote to memory of 1208 1256 svchost.exe 84 PID 1256 wrote to memory of 1208 1256 svchost.exe 84 PID 1256 wrote to memory of 1208 1256 svchost.exe 84 PID 1256 wrote to memory of 1280 1256 svchost.exe 85 PID 1256 wrote to memory of 1280 1256 svchost.exe 85 PID 1256 wrote to memory of 1280 1256 svchost.exe 85 PID 1256 wrote to memory of 1308 1256 svchost.exe 86 PID 1256 wrote to memory of 1308 1256 svchost.exe 86 PID 1256 wrote to memory of 1308 1256 svchost.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\sqlservr.exe"C:\Users\Admin\AppData\Local\Temp\sqlservr.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\WIN_TEMP_\svchost.exe"C:\Windows\WIN_TEMP_\svchost.exe" C:\Users\Admin\AppData\Local\Temp\sqlservr.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Deletes itself
- Modifies WinLogon
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /Quiet3⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:2244
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log Application3⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log Application4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log Security3⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log Security4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log Setup3⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log Setup4⤵
- Suspicious use of AdjustPrivilegeToken
PID:988
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log System3⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log System4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet3⤵PID:3880
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete systemstatebackup -deleteoldest -quiet3⤵PID:1208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ftype redeemer="C:\Windows\system32\cmd.exe" /c msg * Redeemer Ransowmare - this file cannot be opened until decrypted. Check ReadMe.TXT for more details how to decrypt your file.3⤵
- Modifies registry class
PID:1280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c assoc .redeem=redeemer3⤵
- Modifies registry class
PID:1308
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3724