de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d
de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe
94KB
20-10-2021 09:24
993b73d6490bc5a7e23e02210b317247
6fd314af34409e945504e166eb8cd88127c1070e
de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d
Extracted
Path | C:\odt\A2D63-Readme.txt |
Family | netwalker |
Ransom Note |
Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .a2d63
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Contact us:
1.knoocknoo@cock.li
2.eeeooppaaaxxx@tuta.io
Don't forget to include your code in the email:
{code_1b1ea859_a2d63:
V6RDuHNbgGVtcrSKiRSkrbCAyttmSwsQGYnMn/65kF0q6XqaDg
/cnVmF7YfLsLd35MG01hBug/9yPfooToj/DygT5yfR6a13Wage
G/ThEh+Q3vJA+Hq2FJsKBluPwAp1YKyCMSCZkgoi4lib93nYH6
YcdTLnlXnOhSQGQrbeH9uBfZidXpQ2xYqU9Xr+rRiBvfncbVzG
bFhtujPNAyiizLAl+vel3YFnNdEFCCIKLiL1YkvaZ8GfScF5JT
GwVO3gVx4soWUVnVrBfj9EwX/AcSkfmCM=}
|
Emails |
knoocknoo@cock.li eeeooppaaaxxx@tuta.io |
Extracted
Path | C:\Users\Admin\AppData\Roaming\A2D63-Readme.txt |
Family | netwalker |
Ransom Note |
Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .a2d63
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Contact us:
1.knoocknoo@cock.li
2.eeeooppaaaxxx@tuta.io
Don't forget to include your code in the email:
{code_1b1ea859_a2d63:
V6RDuHNbgGVtcrSKiRSkrbCAyttmSwsQGYnMn/65kF0q6XqaDg
/cnVmF7YfLsLd35MG01hBug/9yPfooToj/DygT5yfR6a13Wage
G/ThEh+Q3vJA+Hq2FJsKBluPwAp1YKyCMSCZkgoi4lib93nYH6
YcdTLnlXnOhSQGQrbeH9uBfZidXpQ2xYqU9Xr+rRiBvfncbVzG
bFhtujPNAyiizLAl+vel3YFnNdEFCCIKLiL1YkvaZ8GfScF5JT
GwVO3gVx4soWUVnVrBfj9EwX/AcSkfmCM=}Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .a2d63
--
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down,
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
--
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free,
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
Contact us:
1.knoocknoo@cock.li
2.eeeooppaaaxxx@tuta.io
Don't forget to include your code in the email:
{code_1b1ea859_a2d63:
V6RDuHNbgGVtcrSKiRSkrbCAyttmSwsQGYnMn/65kF0q6XqaDg
/cnVmF7YfLsLd35MG01hBug/9yPfooToj/DygT5yfR6a13Wage
G/ThEh+Q3vJA+Hq2FJsKBluPwAp1YKyCMSCZkgoi4lib93nYH6
YcdTLnlXnOhSQGQrbeH9uBfZidXpQ2xYqU9Xr+rRiBvfncbVzG
bFhtujPNAyiizLAl+vel3YFnNdEFCCIKLiL1YkvaZ8GfScF5JT
GwVO3gVx4soWUVnVrBfj9EwX/AcSkfmCM=}
|
Emails |
knoocknoo@cock.li eeeooppaaaxxx@tuta.io |
Filter: none
-
Detected Netwalker Ransomware
Description
Detected unpacked Netwalker executable.
Reported IOCs
resource yara_rule behavioral1/memory/2264-118-0x0000000000450000-0x000000000046B000-memory.dmp netwalker_ransomware behavioral1/memory/3800-117-0x0000000000540000-0x000000000055B000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Description
Ransomware family with multiple versions. Also known as MailTo.
Tags
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Modifies extensions of user filesexplorer.exe
Description
Ransomware generally changes the extension on encrypted files.
Tags
Reported IOCs
description ioc process File opened for modification C:\Users\Admin\Pictures\ReadConnect.tiff explorer.exe File opened for modification C:\Users\Admin\Pictures\FindSuspend.tiff explorer.exe -
Deletes itselfexplorer.exe
Reported IOCs
pid process 3800 explorer.exe -
Adds Run key to start applicationexplorer.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a2d63472 = "C:\\Program Files (x86)\\a2d63472\\a2d63472.exe" explorer.exe -
Suspicious use of SetThreadContextde04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe
Reported IOCs
description pid process target process PID 2072 set thread context of 3800 2072 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe explorer.exe -
Drops file in Program Files directoryexplorer.exe
Reported IOCs
description ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-200.png explorer.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\US_export_policy.jar explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\COPYRIGHT explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\gn_60x42.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\A2D63-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\OneConnectAppList.targetsize-48.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\A2D63-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main.css explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\ui-strings.js explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_it.properties explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\Attribution\foreca.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-200_contrast-black.png explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-white_scale-125.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT532.CNV explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSplashScreen.scale-125.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Livetiles\MicrosoftSolitaireAppList.targetsize-96_altform-unplated.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-32_altform-unplated.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-16_altform-unplated.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-black_scale-125.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\A2D63-Readme.txt explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\PeopleSplashScreen.scale-200.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\192.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SegXbox2.ttf explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-256.png explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconEditRichCapture.scale-125.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\star.png explorer.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\access-bridge-64.jar explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-400.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7989_20x20x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-125.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\mu_16x11.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-fr\ui-strings.js explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-loaders.jar explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\file_info.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\ui-strings.js explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\166.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\MedTile.scale-200.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\desktop\en-GB\doc_offline_getconnected.xml explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-fullcolor.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_18.svg explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\ui-strings.js explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reportabuse-default_18.svg explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8041_48x48x32.png explorer.exe -
Interacts with shadow copiesvssadmin.exevssadmin.exe
Description
Shadow copies are often targeted by ransomware to inhibit system recovery.
Tags
TTPs
Reported IOCs
pid process 1428 vssadmin.exe 9992 vssadmin.exe -
Suspicious behavior: EnumeratesProcessesexplorer.exeexplorer.exe
Reported IOCs
pid process 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 3800 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe 2264 explorer.exe -
Suspicious behavior: MapViewOfSectionde04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exeexplorer.exe
Reported IOCs
pid process 2072 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe 3800 explorer.exe -
Suspicious use of AdjustPrivilegeTokenexplorer.exevssvc.exeexplorer.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 2264 explorer.exe Token: SeBackupPrivilege 972 vssvc.exe Token: SeRestorePrivilege 972 vssvc.exe Token: SeAuditPrivilege 972 vssvc.exe Token: SeDebugPrivilege 3800 explorer.exe Token: SeImpersonatePrivilege 3800 explorer.exe -
Suspicious use of WriteProcessMemoryde04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exeexplorer.exeexplorer.exe
Reported IOCs
description pid process target process PID 2072 wrote to memory of 3800 2072 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe explorer.exe PID 2072 wrote to memory of 3800 2072 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe explorer.exe PID 2072 wrote to memory of 3800 2072 de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe explorer.exe PID 3800 wrote to memory of 2264 3800 explorer.exe explorer.exe PID 3800 wrote to memory of 2264 3800 explorer.exe explorer.exe PID 3800 wrote to memory of 2264 3800 explorer.exe explorer.exe PID 2264 wrote to memory of 1428 2264 explorer.exe vssadmin.exe PID 2264 wrote to memory of 1428 2264 explorer.exe vssadmin.exe PID 3800 wrote to memory of 4220 3800 explorer.exe notepad.exe PID 3800 wrote to memory of 4220 3800 explorer.exe notepad.exe PID 3800 wrote to memory of 4220 3800 explorer.exe notepad.exe PID 3800 wrote to memory of 9992 3800 explorer.exe vssadmin.exe PID 3800 wrote to memory of 9992 3800 explorer.exe vssadmin.exe
-
C:\Users\Admin\AppData\Local\Temp\de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe"C:\Users\Admin\AppData\Local\Temp\de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d.exe"Suspicious use of SetThreadContextSuspicious behavior: MapViewOfSectionSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"Modifies extensions of user filesDeletes itselfAdds Run key to start applicationDrops file in Program Files directorySuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quietInteracts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\A2D63-Readme.txt"
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quietInteracts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exeSuspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\A2D63-Readme.txt
-
C:\Users\Admin\Desktop\A2D63-Readme.txt
MD521023b4f94067b6b71afc6f07554ed12
SHA15717d119f17a52a7a3d5fb6ed515bb9f3f50bf72
SHA2567ca20b2cbb8fe9b73a624871212c285263f0a571e7f639d632029bd727ab4a28
SHA5120e41dfb43abca29505e7c0b2a729ca6c0d909dc2fd2bba3198248985e794f41920f403e78a361e556c9ad9b6516523966801efaa130bf47258319ed10df55f89
-
C:\Users\Admin\Desktop\A2D63-Readme.txt
MD521023b4f94067b6b71afc6f07554ed12
SHA15717d119f17a52a7a3d5fb6ed515bb9f3f50bf72
SHA2567ca20b2cbb8fe9b73a624871212c285263f0a571e7f639d632029bd727ab4a28
SHA5120e41dfb43abca29505e7c0b2a729ca6c0d909dc2fd2bba3198248985e794f41920f403e78a361e556c9ad9b6516523966801efaa130bf47258319ed10df55f89
-
memory/1428-119-0x0000000000000000-mapping.dmp
-
memory/2264-116-0x0000000000000000-mapping.dmp
-
memory/2264-118-0x0000000000450000-0x000000000046B000-memory.dmp
-
memory/3800-115-0x0000000000000000-mapping.dmp
-
memory/3800-117-0x0000000000540000-0x000000000055B000-memory.dmp
-
memory/4220-121-0x0000000000000000-mapping.dmp
-
memory/9992-122-0x0000000000000000-mapping.dmp