medusalocker | f2a155473c06ecad973676f1e2a8d228ab4a8adf32a87477c716f31fddf6cbaf

General

Target

B06.exe
Size

4.5MB
MD5

49fb0e5a3415155c24d6839250cd7fed
SHA1

69fa4c797df21b98740368c268cfd1919bf4a6e0
SHA256

f2a155473c06ecad973676f1e2a8d228ab4a8adf32a87477c716f31fddf6cbaf
SHA512

4bcf713b36e0c0bd1e12018cc835a988dbbb2d54556531ebddf97435fd430dab0393fe55e16de5b0c894a49fbea7829f2e6cba5214230f4ee70978a6a87ce397

Score

10^/10

medusalocker evasion persistence ransomware spyware stealer

Malware Config

Signatures

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

MedusaLocker Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-53-0x000000013FBC0000-0x0000000140438000-memory.dmp	family_medusalocker

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1028 bcdedit.exe
1360 bcdedit.exe
Deletes System State backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

1316 wbadmin.exe
1396 wbadmin.exe

pid	process
1028	bcdedit.exe
1360	bcdedit.exe

pid	process
1316	wbadmin.exe
1396	wbadmin.exe

Drops file in Drivers directory 12 IoCs

Processes:

B06.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts.inprocess	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol.inprocess	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol.udacha	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\services	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.inprocess	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.udacha	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts.udacha	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks.inprocess	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks.udacha	B06.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol	B06.exe

Modifies extensions of user files 29 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

B06.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\InvokeSelect.tiff.inprocess => C:\Users\Admin\Pictures\InvokeSelect.tiff.udacha	B06.exe
File renamed	C:\Users\Admin\Pictures\UnlockEnter.tif => C:\Users\Admin\Pictures\UnlockEnter.tif.inprocess	B06.exe
File renamed	C:\Users\Admin\Pictures\UnpublishEnter.png.inprocess => C:\Users\Admin\Pictures\UnpublishEnter.png.udacha	B06.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeSelect.tiff	B06.exe
File renamed	C:\Users\Admin\Pictures\InvokeSelect.tiff => C:\Users\Admin\Pictures\InvokeSelect.tiff.inprocess	B06.exe
File renamed	C:\Users\Admin\Pictures\RestorePublish.png => C:\Users\Admin\Pictures\RestorePublish.png.inprocess	B06.exe
File opened for modification	C:\Users\Admin\Pictures\RestorePublish.png.udacha	B06.exe
File renamed	C:\Users\Admin\Pictures\BlockUnpublish.raw.inprocess => C:\Users\Admin\Pictures\BlockUnpublish.raw.udacha	B06.exe
File renamed	C:\Users\Admin\Pictures\CompressRepair.raw.inprocess => C:\Users\Admin\Pictures\CompressRepair.raw.udacha	B06.exe
File opened for modification	C:\Users\Admin\Pictures\CompressRepair.raw.inprocess	B06.exe
File opened for modification	C:\Users\Admin\Pictures\CompressRepair.raw.udacha	B06.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockEnter.tif.inprocess	B06.exe
File opened for modification	C:\Users\Admin\Pictures\BlockUnpublish.raw.inprocess	B06.exe
File renamed	C:\Users\Admin\Pictures\CompressRepair.raw => C:\Users\Admin\Pictures\CompressRepair.raw.inprocess	B06.exe
File renamed	C:\Users\Admin\Pictures\UnpublishEnter.png => C:\Users\Admin\Pictures\UnpublishEnter.png.inprocess	B06.exe
File opened for modification	C:\Users\Admin\Pictures\UnpublishEnter.png.udacha	B06.exe
File renamed	C:\Users\Admin\Pictures\BlockUnpublish.raw => C:\Users\Admin\Pictures\BlockUnpublish.raw.inprocess	B06.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeSelect.tiff.inprocess	B06.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeSelect.tiff.udacha	B06.exe
File opened for modification	C:\Users\Admin\Pictures\UnpublishEnter.png.inprocess	B06.exe
File opened for modification	C:\Users\Admin\Pictures\BlockDisable.tif.udacha	B06.exe
File opened for modification	C:\Users\Admin\Pictures\BlockUnpublish.raw.udacha	B06.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockEnter.tif.udacha	B06.exe
File renamed	C:\Users\Admin\Pictures\BlockDisable.tif.inprocess => C:\Users\Admin\Pictures\BlockDisable.tif.udacha	B06.exe
File renamed	C:\Users\Admin\Pictures\UnlockEnter.tif.inprocess => C:\Users\Admin\Pictures\UnlockEnter.tif.udacha	B06.exe
File opened for modification	C:\Users\Admin\Pictures\BlockDisable.tif.inprocess	B06.exe
File opened for modification	C:\Users\Admin\Pictures\RestorePublish.png.inprocess	B06.exe
File renamed	C:\Users\Admin\Pictures\BlockDisable.tif => C:\Users\Admin\Pictures\BlockDisable.tif.inprocess	B06.exe
File renamed	C:\Users\Admin\Pictures\RestorePublish.png.inprocess => C:\Users\Admin\Pictures\RestorePublish.png.udacha	B06.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1032 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1032	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

B06.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Windows\CurrentVersion\Run	B06.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\B06.exe\" e"	B06.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

B06.exe

description ioc process

File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-2375386074-2889020035-839874990-1000\desktop.ini B06.exe

description	ioc	process
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-2375386074-2889020035-839874990-1000\desktop.ini	B06.exe

Enumerates connected drives 3 TTPs 41 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exeB06.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\F:	B06.exe
File opened (read-only)	\??\O:	B06.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\H:	B06.exe
File opened (read-only)	\??\J:	B06.exe
File opened (read-only)	\??\M:	B06.exe
File opened (read-only)	\??\T:	B06.exe
File opened (read-only)	\??\Z:	B06.exe
File opened (read-only)	\??\E:	B06.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\K:	B06.exe
File opened (read-only)	\??\Q:	B06.exe
File opened (read-only)	\??\S:	B06.exe
File opened (read-only)	\??\Y:	B06.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\A:	B06.exe
File opened (read-only)	\??\I:	B06.exe
File opened (read-only)	\??\U:	B06.exe
File opened (read-only)	\??\W:	B06.exe
File opened (read-only)	\??\D:	B06.exe
File opened (read-only)	\??\B:	B06.exe
File opened (read-only)	\??\P:	B06.exe
File opened (read-only)	\??\R:	B06.exe
File opened (read-only)	\??\X:	B06.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\G:	B06.exe
File opened (read-only)	\??\L:	B06.exe
File opened (read-only)	\??\N:	B06.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\V:	B06.exe

Drops file in System32 directory 64 IoCs

Processes:

B06.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\9ac9c03b-303d-45a8-b90d-6390b2b66ff9.udacha	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	B06.exe
File opened for modification	C:\Windows\System32\config\RegBack\SOFTWARE	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.udacha	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\9ac9c03b-303d-45a8-b90d-6390b2b66ff9	B06.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.udacha	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.inprocess	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess	B06.exe
File opened for modification	C:\Windows\System32\config\BCD-Template.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\SYSTEM	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.udacha	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\DEFAULT	B06.exe
File opened for modification	C:\Windows\System32\config\RegBack\DEFAULT	B06.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\af3c5d49-8e5b-4720-a907-0d451e26a339	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\b0886740-568e-4686-b7a6-d3c299f18a96.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess	B06.exe
File opened for modification	C:\Windows\System32\config\BCD-Template	B06.exe
File opened for modification	C:\Windows\System32\config\SAM	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\9ac9c03b-303d-45a8-b90d-6390b2b66ff9.inprocess	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess	B06.exe
File opened for modification	C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb	B06.exe
File opened for modification	C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb	B06.exe
File opened for modification	C:\Windows\System32\config\RegBack\SYSTEM	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	B06.exe
File opened for modification	C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.udacha	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\b0886740-568e-4686-b7a6-d3c299f18a96	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d.inprocess	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\af3c5d49-8e5b-4720-a907-0d451e26a339.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess	B06.exe
File opened for modification	C:\Windows\System32\config\BCD-Template.inprocess	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.inprocess	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.inprocess	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\COMPONENTS	B06.exe
File opened for modification	C:\Windows\System32\config\RegBack\SECURITY	B06.exe
File opened for modification	C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.inprocess	B06.exe
File opened for modification	C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.inprocess	B06.exe
File opened for modification	C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.udacha	B06.exe
File opened for modification	C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.inprocess	B06.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.udacha	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.udacha	B06.exe
File opened for modification	C:\Windows\System32\config\RegBack\SAM	B06.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\b0886740-568e-4686-b7a6-d3c299f18a96.inprocess	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	B06.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.inprocess	B06.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess	B06.exe

Drops file in Program Files directory 64 IoCs

Processes:

B06.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Rome	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Nassau.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\release.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Manaus.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Ojinaga.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Sitka	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\MST7MDT	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Curacao.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Dawson.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Havana	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\GMT.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Brunei.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Cancun	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Moncton.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Bahia.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\CST6CDT.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Dili	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.udacha	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.inprocess	B06.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.inprocess	B06.exe

Drops file in Windows directory 42 IoCs

Processes:

B06.exewbadmin.exewbadmin.exe

description	ioc	process
File opened for modification	C:\Windows\Boot\DVD\PCAT\BCD	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2th0	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\enwindow	B06.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.udacha	B06.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	B06.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Panther\setupinfo	B06.exe
File opened for modification	C:\Windows\Boot\DVD\EFI\BCD	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1cb2	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1th1	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\absthr_0	B06.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state	B06.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	B06.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\absthr_2	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\alloc_3	B06.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.inprocess	B06.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.udacha	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2cb0	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2cb2	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\alloc_2	B06.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\absthr_1	B06.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess	B06.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Panther\setupinfo.udacha	B06.exe
File opened for modification	C:\Windows\Boot\PCAT\bootmgr	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1cb0	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1th2	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2cb1	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2th1	B06.exe
File opened for modification	C:\Windows\Panther\setupinfo.inprocess	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1cb1	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\2th2	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\alloc_0	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\dewindow	B06.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\1th0	B06.exe
File opened for modification	C:\Windows\ehome\CreateDisc\Components\tables\alloc_1	B06.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.udacha	B06.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 13 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
796	vssadmin.exe
1968	vssadmin.exe
1188	vssadmin.exe
608	vssadmin.exe
652	vssadmin.exe
616	vssadmin.exe
1064	vssadmin.exe
1992	vssadmin.exe
456	vssadmin.exe
1936	vssadmin.exe
216	vssadmin.exe
1756	vssadmin.exe
2040	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

B06.exe

pid	process
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe
2032	B06.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

vssvc.exewmic.exe

description	pid	process
Token: SeBackupPrivilege	1816	vssvc.exe
Token: SeRestorePrivilege	1816	vssvc.exe
Token: SeAuditPrivilege	1816	vssvc.exe
Token: SeIncreaseQuotaPrivilege	456	wmic.exe
Token: SeSecurityPrivilege	456	wmic.exe
Token: SeTakeOwnershipPrivilege	456	wmic.exe
Token: SeLoadDriverPrivilege	456	wmic.exe
Token: SeSystemProfilePrivilege	456	wmic.exe
Token: SeSystemtimePrivilege	456	wmic.exe
Token: SeProfSingleProcessPrivilege	456	wmic.exe
Token: SeIncBasePriorityPrivilege	456	wmic.exe
Token: SeCreatePagefilePrivilege	456	wmic.exe
Token: SeBackupPrivilege	456	wmic.exe
Token: SeRestorePrivilege	456	wmic.exe
Token: SeShutdownPrivilege	456	wmic.exe
Token: SeDebugPrivilege	456	wmic.exe
Token: SeSystemEnvironmentPrivilege	456	wmic.exe
Token: SeRemoteShutdownPrivilege	456	wmic.exe
Token: SeUndockPrivilege	456	wmic.exe
Token: SeManageVolumePrivilege	456	wmic.exe
Token: 33	456	wmic.exe
Token: 34	456	wmic.exe
Token: 35	456	wmic.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

B06.exe

description	pid	process	target process
PID 2032 wrote to memory of 616	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 616	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 616	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 796	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 796	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 796	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1968	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1968	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1968	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1064	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1064	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1064	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1188	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1188	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1188	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1992	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1992	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1992	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 608	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 608	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 608	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 456	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 456	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 456	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1936	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1936	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1936	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 216	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 216	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 216	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1756	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1756	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1756	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 652	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 652	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 652	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 2040	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 2040	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 2040	2032	B06.exe	vssadmin.exe
PID 2032 wrote to memory of 1028	2032	B06.exe	bcdedit.exe
PID 2032 wrote to memory of 1028	2032	B06.exe	bcdedit.exe
PID 2032 wrote to memory of 1028	2032	B06.exe	bcdedit.exe
PID 2032 wrote to memory of 1360	2032	B06.exe	bcdedit.exe
PID 2032 wrote to memory of 1360	2032	B06.exe	bcdedit.exe
PID 2032 wrote to memory of 1360	2032	B06.exe	bcdedit.exe
PID 2032 wrote to memory of 1316	2032	B06.exe	wbadmin.exe
PID 2032 wrote to memory of 1316	2032	B06.exe	wbadmin.exe
PID 2032 wrote to memory of 1316	2032	B06.exe	wbadmin.exe
PID 2032 wrote to memory of 1396	2032	B06.exe	wbadmin.exe
PID 2032 wrote to memory of 1396	2032	B06.exe	wbadmin.exe
PID 2032 wrote to memory of 1396	2032	B06.exe	wbadmin.exe
PID 2032 wrote to memory of 456	2032	B06.exe	wmic.exe
PID 2032 wrote to memory of 456	2032	B06.exe	wmic.exe
PID 2032 wrote to memory of 456	2032	B06.exe	wmic.exe
PID 2032 wrote to memory of 1032	2032	B06.exe	cmd.exe
PID 2032 wrote to memory of 1032	2032	B06.exe	cmd.exe
PID 2032 wrote to memory of 1032	2032	B06.exe	cmd.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

B06.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" B06.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	B06.exe

C:\Users\Admin\AppData\Local\Temp\B06.exe
"C:\Users\Admin\AppData\Local\Temp\B06.exe"
1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2032

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
2⤵
- Interacts with shadow copies
PID:616

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
2⤵
- Interacts with shadow copies
PID:796

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1968

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1064

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1188

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1992

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:608

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:456

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1936

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:216

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1756

C:\Windows\system32\vssadmin.exe
vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:652

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:2040

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} recoveryenabled No
2⤵
- Modifies boot configuration data using bcdedit
PID:1028

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
2⤵
- Modifies boot configuration data using bcdedit
PID:1360

C:\Windows\system32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1316

C:\Windows\system32\wbadmin.exe
wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1396

C:\Windows\System32\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B06.exe >> NUL
2⤵
- Deletes itself
PID:1032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

3

T1107

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-63-0x0000000000000000-mapping.dmp

Download
memory/456-73-0x0000000000000000-mapping.dmp

Download
memory/456-61-0x0000000000000000-mapping.dmp

Download
memory/608-60-0x0000000000000000-mapping.dmp

Download
memory/616-54-0x0000000000000000-mapping.dmp

Download
memory/652-65-0x0000000000000000-mapping.dmp

Download
memory/796-55-0x0000000000000000-mapping.dmp

Download
memory/1028-67-0x0000000000000000-mapping.dmp

Download
memory/1032-74-0x0000000000000000-mapping.dmp

Download
memory/1064-57-0x0000000000000000-mapping.dmp

Download
memory/1188-58-0x0000000000000000-mapping.dmp

Download
memory/1316-69-0x0000000000000000-mapping.dmp

Download
memory/1316-70-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

Filesize
8KB

Download
memory/1360-68-0x0000000000000000-mapping.dmp

Download
memory/1396-71-0x0000000000000000-mapping.dmp

Download
memory/1756-64-0x0000000000000000-mapping.dmp

Download
memory/1936-62-0x0000000000000000-mapping.dmp

Download
memory/1968-56-0x0000000000000000-mapping.dmp

Download
memory/1992-59-0x0000000000000000-mapping.dmp

Download
memory/2032-53-0x000000013FBC0000-0x0000000140438000-memory.dmp

Filesize
8.5MB

Download
memory/2040-66-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads