5808f60c452afaac69a4de6a345209e168a79b2a0c67de5ed0c227e6c4d2cc1c

Analysis

max time kernel
151s
max time network
122s
platform
windows10_x64
resource
win10-en-20211014
submitted
21/11/2021, 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MoleculeV_.bin.exe
Size

461KB
MD5

bb09e9b8daef63d4ebe21fcb2519c5d5
SHA1

9adacd3ed8963404925d72efa1acca50dd9673b8
SHA256

d47e0056a7336be404b2ddf56bdb6897046f6a6ddb0f38bb9f6674ca4c3eaf15
SHA512

18f6d6023d1922a6e81833ef294e7fba4dde436fd67727d30a5f7c9f0b564cd940dca58217222f54454d2177a2fd4303389f4d4e4cd6e2d0290309cfc85f6267

Score

10^/10

agilenet evasion ransomware trojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\READ_IT.txt

Ransom Note

What happened to your files? All your files are encrypted with RSA-4096, Read more on https://en.wikipedia.org/wiki/RSA_(cryptosystem) RSA is an algorithm used by modern computers to encrypt and decrypt the data. RSA is an asymmetric cryptographic algorithm. Asymmetric means that there are two different keys. This is also called public key cryptography, because one of the keys can be given to anyone: 1 - We encrypted your files with our Public key 2 - You can decrypt, the encrypted files with specific Private key and your private key is in our hands ( It's not possible to recover your files without our private key ) Is it possible to get back your data? Yes, We have a decrypter with the private key. We have one option to get all your data back. "Follow the instructions to get all your data back: Step 1 : You must send us 80$ worth of Bitcoin for your affected system Step 2 : After you sent us the bitcoin our system automatically decrypt all you files and our software will delete itself Our Bitcoin address is: 1AcXKNDs71c1QZgVNvFZVwQgWNBQDjvT4H Where to buy Bitcoin? The easiest way is LocalBitcoins, but you can find more websites to buy bitcoin using Google Search: buy bitcoin online MMoga.com Bitcoin gift cards is a fast way to buy bitcoins

Wallets

1AcXKNDs71c1QZgVNvFZVwQgWNBQDjvT4H

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Clears Windows event logs 1 TTPs
evasion ransomware

Indicator Removal on Host
T1070
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4764	bcdedit.exe
4272	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
4148	wbadmin.exe

Executes dropped EXE 4 IoCs

pid	Process
652	Molecule.exe
4144	2c818d6f-6b05-478c-8ce1-9d49a3874096.exe
4344	2c818d6f-6b05-478c-8ce1-9d49a3874096.exe
5040	2c818d6f-6b05-478c-8ce1-9d49a3874096.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows_Update.url	MoleculeV_.bin.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows_Update.url	MoleculeV_.bin.exe

Loads dropped DLL 4 IoCs

pid	Process
652	Molecule.exe
5040	2c818d6f-6b05-478c-8ce1-9d49a3874096.exe
4344	2c818d6f-6b05-478c-8ce1-9d49a3874096.exe
4144	2c818d6f-6b05-478c-8ce1-9d49a3874096.exe

Obfuscated with Agile.Net obfuscator 6 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/files/0x00020000000197cf-269.dat	agile_net
behavioral2/files/0x00020000000197cf-275.dat	agile_net
behavioral2/files/0x000400000001aba4-604.dat	agile_net
behavioral2/files/0x000400000001aba4-605.dat	agile_net
behavioral2/files/0x000400000001aba4-606.dat	agile_net
behavioral2/files/0x000400000001aba4-602.dat	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp"	MoleculeV_.bin.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
4304	vssadmin.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\Desktop\WallpaperStyle = "2"	MoleculeV_.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\Desktop\TileWallpaper = "0"	MoleculeV_.bin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
2752	MoleculeV_.bin.exe
1184	powershell.exe
608	powershell.exe
896	powershell.exe
392	powershell.exe
676	powershell.exe
984	powershell.exe
892	powershell.exe
1368	powershell.exe
1528	powershell.exe
3132	powershell.exe
2032	powershell.exe
2976	powershell.exe
1184	powershell.exe
1184	powershell.exe
608	powershell.exe
608	powershell.exe
896	powershell.exe
896	powershell.exe
892	powershell.exe
892	powershell.exe
984	powershell.exe
984	powershell.exe
392	powershell.exe
392	powershell.exe
676	powershell.exe
676	powershell.exe
1368	powershell.exe
1368	powershell.exe
3132	powershell.exe
3132	powershell.exe
1528	powershell.exe
1528	powershell.exe
2032	powershell.exe
2032	powershell.exe
2976	powershell.exe
2976	powershell.exe
608	powershell.exe
892	powershell.exe
1184	powershell.exe
984	powershell.exe
896	powershell.exe
392	powershell.exe
676	powershell.exe
2752	MoleculeV_.bin.exe
2752	MoleculeV_.bin.exe
1368	powershell.exe
1528	powershell.exe
3132	powershell.exe
2032	powershell.exe
2976	powershell.exe
652	Molecule.exe
652	Molecule.exe
652	Molecule.exe
652	Molecule.exe
652	Molecule.exe
652	Molecule.exe
652	Molecule.exe
652	Molecule.exe
652	Molecule.exe
652	Molecule.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	MoleculeV_.bin.exe
Token: SeDebugPrivilege	2752	MoleculeV_.bin.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeIncreaseQuotaPrivilege	3744	powershell.exe
Token: SeSecurityPrivilege	3744	powershell.exe
Token: SeTakeOwnershipPrivilege	3744	powershell.exe
Token: SeLoadDriverPrivilege	3744	powershell.exe
Token: SeSystemProfilePrivilege	3744	powershell.exe
Token: SeSystemtimePrivilege	3744	powershell.exe
Token: SeProfSingleProcessPrivilege	3744	powershell.exe
Token: SeIncBasePriorityPrivilege	3744	powershell.exe
Token: SeCreatePagefilePrivilege	3744	powershell.exe
Token: SeBackupPrivilege	3744	powershell.exe
Token: SeRestorePrivilege	3744	powershell.exe
Token: SeShutdownPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeSystemEnvironmentPrivilege	3744	powershell.exe
Token: SeRemoteShutdownPrivilege	3744	powershell.exe
Token: SeUndockPrivilege	3744	powershell.exe
Token: SeManageVolumePrivilege	3744	powershell.exe
Token: 33	3744	powershell.exe
Token: 34	3744	powershell.exe
Token: 35	3744	powershell.exe
Token: 36	3744	powershell.exe
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	608	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2752	MoleculeV_.bin.exe
Token: SeIncreaseQuotaPrivilege	608	powershell.exe
Token: SeSecurityPrivilege	608	powershell.exe
Token: SeTakeOwnershipPrivilege	608	powershell.exe
Token: SeLoadDriverPrivilege	608	powershell.exe
Token: SeSystemProfilePrivilege	608	powershell.exe
Token: SeSystemtimePrivilege	608	powershell.exe
Token: SeProfSingleProcessPrivilege	608	powershell.exe
Token: SeIncBasePriorityPrivilege	608	powershell.exe
Token: SeCreatePagefilePrivilege	608	powershell.exe
Token: SeBackupPrivilege	608	powershell.exe
Token: SeRestorePrivilege	608	powershell.exe
Token: SeShutdownPrivilege	608	powershell.exe
Token: SeDebugPrivilege	608	powershell.exe
Token: SeSystemEnvironmentPrivilege	608	powershell.exe
Token: SeRemoteShutdownPrivilege	608	powershell.exe
Token: SeUndockPrivilege	608	powershell.exe
Token: SeManageVolumePrivilege	608	powershell.exe
Token: 33	608	powershell.exe
Token: 34	608	powershell.exe
Token: 35	608	powershell.exe
Token: 36	608	powershell.exe
Token: SeBackupPrivilege	4904	vssvc.exe
Token: SeRestorePrivilege	4904	vssvc.exe
Token: SeAuditPrivilege	4904	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1184	powershell.exe
Token: SeSecurityPrivilege	1184	powershell.exe
Token: SeTakeOwnershipPrivilege	1184	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3744	2752	MoleculeV_.bin.exe	69
PID 2752 wrote to memory of 3744	2752	MoleculeV_.bin.exe	69
PID 2752 wrote to memory of 1184	2752	MoleculeV_.bin.exe	72
PID 2752 wrote to memory of 1184	2752	MoleculeV_.bin.exe	72
PID 2752 wrote to memory of 608	2752	MoleculeV_.bin.exe	73
PID 2752 wrote to memory of 608	2752	MoleculeV_.bin.exe	73
PID 2752 wrote to memory of 896	2752	MoleculeV_.bin.exe	78
PID 2752 wrote to memory of 896	2752	MoleculeV_.bin.exe	78
PID 2752 wrote to memory of 676	2752	MoleculeV_.bin.exe	77
PID 2752 wrote to memory of 676	2752	MoleculeV_.bin.exe	77
PID 2752 wrote to memory of 984	2752	MoleculeV_.bin.exe	79
PID 2752 wrote to memory of 984	2752	MoleculeV_.bin.exe	79
PID 2752 wrote to memory of 392	2752	MoleculeV_.bin.exe	85
PID 2752 wrote to memory of 392	2752	MoleculeV_.bin.exe	85
PID 2752 wrote to memory of 892	2752	MoleculeV_.bin.exe	83
PID 2752 wrote to memory of 892	2752	MoleculeV_.bin.exe	83
PID 2752 wrote to memory of 1368	2752	MoleculeV_.bin.exe	82
PID 2752 wrote to memory of 1368	2752	MoleculeV_.bin.exe	82
PID 2752 wrote to memory of 2032	2752	MoleculeV_.bin.exe	92
PID 2752 wrote to memory of 2032	2752	MoleculeV_.bin.exe	92
PID 2752 wrote to memory of 1528	2752	MoleculeV_.bin.exe	86
PID 2752 wrote to memory of 1528	2752	MoleculeV_.bin.exe	86
PID 2752 wrote to memory of 3132	2752	MoleculeV_.bin.exe	89
PID 2752 wrote to memory of 3132	2752	MoleculeV_.bin.exe	89
PID 2752 wrote to memory of 2976	2752	MoleculeV_.bin.exe	87
PID 2752 wrote to memory of 2976	2752	MoleculeV_.bin.exe	87
PID 2752 wrote to memory of 3772	2752	MoleculeV_.bin.exe	94
PID 2752 wrote to memory of 3772	2752	MoleculeV_.bin.exe	94
PID 2752 wrote to memory of 652	2752	MoleculeV_.bin.exe	99
PID 2752 wrote to memory of 652	2752	MoleculeV_.bin.exe	99
PID 2752 wrote to memory of 652	2752	MoleculeV_.bin.exe	99
PID 2752 wrote to memory of 4460	2752	MoleculeV_.bin.exe	100
PID 2752 wrote to memory of 4460	2752	MoleculeV_.bin.exe	100
PID 2752 wrote to memory of 4492	2752	MoleculeV_.bin.exe	101
PID 2752 wrote to memory of 4492	2752	MoleculeV_.bin.exe	101
PID 4460 wrote to memory of 4276	4460	cmd.exe	106
PID 4460 wrote to memory of 4276	4460	cmd.exe	106
PID 3772 wrote to memory of 4304	3772	cmd.exe	104
PID 3772 wrote to memory of 4304	3772	cmd.exe	104
PID 4492 wrote to memory of 4408	4492	cmd.exe	105
PID 4492 wrote to memory of 4408	4492	cmd.exe	105
PID 652 wrote to memory of 4144	652	Molecule.exe	109
PID 652 wrote to memory of 4144	652	Molecule.exe	109
PID 652 wrote to memory of 4144	652	Molecule.exe	109
PID 652 wrote to memory of 4344	652	Molecule.exe	110
PID 652 wrote to memory of 4344	652	Molecule.exe	110
PID 652 wrote to memory of 4344	652	Molecule.exe	110
PID 652 wrote to memory of 5040	652	Molecule.exe	111
PID 652 wrote to memory of 5040	652	Molecule.exe	111
PID 652 wrote to memory of 5040	652	Molecule.exe	111
PID 3772 wrote to memory of 4684	3772	cmd.exe	112
PID 3772 wrote to memory of 4684	3772	cmd.exe	112
PID 3772 wrote to memory of 4956	3772	cmd.exe	114
PID 3772 wrote to memory of 4956	3772	cmd.exe	114
PID 3772 wrote to memory of 4608	3772	cmd.exe	115
PID 3772 wrote to memory of 4608	3772	cmd.exe	115
PID 3772 wrote to memory of 4692	3772	cmd.exe	116
PID 3772 wrote to memory of 4692	3772	cmd.exe	116
PID 3772 wrote to memory of 4764	3772	cmd.exe	117
PID 3772 wrote to memory of 4764	3772	cmd.exe	117
PID 3772 wrote to memory of 4272	3772	cmd.exe	118
PID 3772 wrote to memory of 4272	3772	cmd.exe	118
PID 3772 wrote to memory of 4148	3772	cmd.exe	119
PID 3772 wrote to memory of 4148	3772	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\MoleculeV_.bin.exe
"C:\Users\Admin\AppData\Local\Temp\MoleculeV_.bin.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4304
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC shadowcopy delete
    3⤵
    PID:4684
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Application
    3⤵
    PID:4956
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl Security
    3⤵
    PID:4608
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl System
    3⤵
    PID:4692
- - C:\Windows\system32\bcdedit.exe
    Bcdedit.exe /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4764
- - C:\Windows\system32\bcdedit.exe
    Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4272
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog
    3⤵
    - Deletes backup catalog
    - Drops file in Windows directory
    PID:4148
- C:\Users\Admin\Molecule.exe
  "C:\Users\Admin\Molecule.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\ProgramData\Microsoft\Crypto\SystemKeys\{2c818d6f-6b05-478c-8ce1-9d49a3874096}\2c818d6f-6b05-478c-8ce1-9d49a3874096.exe
    "C:\ProgramData\Microsoft\Crypto\SystemKeys\{2c818d6f-6b05-478c-8ce1-9d49a3874096}\2c818d6f-6b05-478c-8ce1-9d49a3874096.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4144
- - C:\ProgramData\Microsoft\Crypto\SystemKeys\{2c818d6f-6b05-478c-8ce1-9d49a3874096}\2c818d6f-6b05-478c-8ce1-9d49a3874096.exe
    "C:\ProgramData\Microsoft\Crypto\SystemKeys\{2c818d6f-6b05-478c-8ce1-9d49a3874096}\2c818d6f-6b05-478c-8ce1-9d49a3874096.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4344
- - C:\ProgramData\Microsoft\Crypto\SystemKeys\{2c818d6f-6b05-478c-8ce1-9d49a3874096}\2c818d6f-6b05-478c-8ce1-9d49a3874096.exe
    "C:\ProgramData\Microsoft\Crypto\SystemKeys\{2c818d6f-6b05-478c-8ce1-9d49a3874096}\2c818d6f-6b05-478c-8ce1-9d49a3874096.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\MoleculeV_.bin.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del ""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:256

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1696

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

Indicator Removal on Host

T1070

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-209-0x0000011B473C3000-0x0000011B473C5000-memory.dmp

Filesize
8KB

Download
memory/392-185-0x0000011B2D2E0000-0x0000011B2D2E2000-memory.dmp

Filesize
8KB

Download
memory/392-188-0x0000011B2D2E0000-0x0000011B2D2E2000-memory.dmp

Filesize
8KB

Download
memory/392-201-0x0000011B2D2E0000-0x0000011B2D2E2000-memory.dmp

Filesize
8KB

Download
memory/392-355-0x0000011B473C6000-0x0000011B473C8000-memory.dmp

Filesize
8KB

Download
memory/392-650-0x0000011B473C8000-0x0000011B473C9000-memory.dmp

Filesize
4KB

Download
memory/392-194-0x0000011B2D2E0000-0x0000011B2D2E2000-memory.dmp

Filesize
8KB

Download
memory/392-206-0x0000011B473C0000-0x0000011B473C2000-memory.dmp

Filesize
8KB

Download
memory/608-173-0x000001E8FECF0000-0x000001E8FECF2000-memory.dmp

Filesize
8KB

Download
memory/608-179-0x000001E8FECF0000-0x000001E8FECF2000-memory.dmp

Filesize
8KB

Download
memory/608-631-0x000001E8FF858000-0x000001E8FF859000-memory.dmp

Filesize
4KB

Download
memory/608-339-0x000001E8FF856000-0x000001E8FF858000-memory.dmp

Filesize
8KB

Download
memory/608-168-0x000001E8FECF0000-0x000001E8FECF2000-memory.dmp

Filesize
8KB

Download
memory/608-189-0x000001E8FF850000-0x000001E8FF852000-memory.dmp

Filesize
8KB

Download
memory/608-190-0x000001E8FF853000-0x000001E8FF855000-memory.dmp

Filesize
8KB

Download
memory/608-171-0x000001E8FECF0000-0x000001E8FECF2000-memory.dmp

Filesize
8KB

Download
memory/652-359-0x0000000001460000-0x0000000001461000-memory.dmp

Filesize
4KB

Download
memory/652-492-0x0000000001463000-0x0000000001465000-memory.dmp

Filesize
8KB

Download
memory/676-364-0x0000020981576000-0x0000020981578000-memory.dmp

Filesize
8KB

Download
memory/676-239-0x0000020981573000-0x0000020981575000-memory.dmp

Filesize
8KB

Download
memory/676-202-0x0000020981450000-0x0000020981452000-memory.dmp

Filesize
8KB

Download
memory/676-238-0x0000020981570000-0x0000020981572000-memory.dmp

Filesize
8KB

Download
memory/676-651-0x0000020981578000-0x0000020981579000-memory.dmp

Filesize
4KB

Download
memory/676-183-0x0000020981450000-0x0000020981452000-memory.dmp

Filesize
8KB

Download
memory/676-187-0x0000020981450000-0x0000020981452000-memory.dmp

Filesize
8KB

Download
memory/676-193-0x0000020981450000-0x0000020981452000-memory.dmp

Filesize
8KB

Download
memory/892-214-0x000001FB1A3C0000-0x000001FB1A3C2000-memory.dmp

Filesize
8KB

Download
memory/892-345-0x000001FB1A3C6000-0x000001FB1A3C8000-memory.dmp

Filesize
8KB

Download
memory/892-191-0x000001FB1A270000-0x000001FB1A272000-memory.dmp

Filesize
8KB

Download
memory/892-203-0x000001FB1A270000-0x000001FB1A272000-memory.dmp

Filesize
8KB

Download
memory/892-648-0x000001FB1A3C8000-0x000001FB1A3C9000-memory.dmp

Filesize
4KB

Download
memory/892-196-0x000001FB1A270000-0x000001FB1A272000-memory.dmp

Filesize
8KB

Download
memory/892-218-0x000001FB1A3C3000-0x000001FB1A3C5000-memory.dmp

Filesize
8KB

Download
memory/896-192-0x000002755EAB0000-0x000002755EAB2000-memory.dmp

Filesize
8KB

Download
memory/896-178-0x000002755EAB0000-0x000002755EAB2000-memory.dmp

Filesize
8KB

Download
memory/896-186-0x000002755EAB0000-0x000002755EAB2000-memory.dmp

Filesize
8KB

Download
memory/896-652-0x00000275788A8000-0x00000275788A9000-memory.dmp

Filesize
4KB

Download
memory/896-373-0x00000275788A6000-0x00000275788A8000-memory.dmp

Filesize
8KB

Download
memory/896-195-0x00000275788A0000-0x00000275788A2000-memory.dmp

Filesize
8KB

Download
memory/896-176-0x000002755EAB0000-0x000002755EAB2000-memory.dmp

Filesize
8KB

Download
memory/896-198-0x00000275788A3000-0x00000275788A5000-memory.dmp

Filesize
8KB

Download
memory/984-242-0x0000019DBBDF3000-0x0000019DBBDF5000-memory.dmp

Filesize
8KB

Download
memory/984-368-0x0000019DBBDF6000-0x0000019DBBDF8000-memory.dmp

Filesize
8KB

Download
memory/984-182-0x0000019DBA410000-0x0000019DBA412000-memory.dmp

Filesize
8KB

Download
memory/984-181-0x0000019DBA410000-0x0000019DBA412000-memory.dmp

Filesize
8KB

Download
memory/984-649-0x0000019DBBDF8000-0x0000019DBBDF9000-memory.dmp

Filesize
4KB

Download
memory/984-197-0x0000019DBA410000-0x0000019DBA412000-memory.dmp

Filesize
8KB

Download
memory/984-240-0x0000019DBBDF0000-0x0000019DBBDF2000-memory.dmp

Filesize
8KB

Download
memory/1184-184-0x000002B49B903000-0x000002B49B905000-memory.dmp

Filesize
8KB

Download
memory/1184-169-0x000002B499DF0000-0x000002B499DF2000-memory.dmp

Filesize
8KB

Download
memory/1184-164-0x000002B499DF0000-0x000002B499DF2000-memory.dmp

Filesize
8KB

Download
memory/1184-180-0x000002B49B900000-0x000002B49B902000-memory.dmp

Filesize
8KB

Download
memory/1184-175-0x000002B499DF0000-0x000002B499DF2000-memory.dmp

Filesize
8KB

Download
memory/1184-647-0x000002B49B908000-0x000002B49B909000-memory.dmp

Filesize
4KB

Download
memory/1184-166-0x000002B499DF0000-0x000002B499DF2000-memory.dmp

Filesize
8KB

Download
memory/1184-350-0x000002B49B906000-0x000002B49B908000-memory.dmp

Filesize
8KB

Download
memory/1368-199-0x000001FC62060000-0x000001FC62062000-memory.dmp

Filesize
8KB

Download
memory/1368-379-0x000001FC7A7A6000-0x000001FC7A7A8000-memory.dmp

Filesize
8KB

Download
memory/1368-221-0x000001FC7A7A0000-0x000001FC7A7A2000-memory.dmp

Filesize
8KB

Download
memory/1368-236-0x000001FC7A7A3000-0x000001FC7A7A5000-memory.dmp

Filesize
8KB

Download
memory/1368-653-0x000001FC7A7A8000-0x000001FC7A7A9000-memory.dmp

Filesize
4KB

Download
memory/1528-508-0x00000192C41C6000-0x00000192C41C8000-memory.dmp

Filesize
8KB

Download
memory/1528-225-0x00000192C41C0000-0x00000192C41C2000-memory.dmp

Filesize
8KB

Download
memory/1528-244-0x00000192C41C3000-0x00000192C41C5000-memory.dmp

Filesize
8KB

Download
memory/1528-666-0x00000192C41C8000-0x00000192C41C9000-memory.dmp

Filesize
4KB

Download
memory/2032-200-0x000001F9EBF30000-0x000001F9EBF32000-memory.dmp

Filesize
8KB

Download
memory/2032-668-0x000001F9EDD48000-0x000001F9EDD49000-memory.dmp

Filesize
4KB

Download
memory/2032-512-0x000001F9EDD46000-0x000001F9EDD48000-memory.dmp

Filesize
8KB

Download
memory/2032-228-0x000001F9EDD40000-0x000001F9EDD42000-memory.dmp

Filesize
8KB

Download
memory/2032-247-0x000001F9EDD43000-0x000001F9EDD45000-memory.dmp

Filesize
8KB

Download
memory/2752-118-0x000000001B470000-0x000000001B4AC000-memory.dmp

Filesize
240KB

Download
memory/2752-117-0x000000001B460000-0x000000001B462000-memory.dmp

Filesize
8KB

Download
memory/2752-115-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/2752-252-0x000000001B464000-0x000000001B465000-memory.dmp

Filesize
4KB

Download
memory/2976-521-0x000001EC1FE16000-0x000001EC1FE18000-memory.dmp

Filesize
8KB

Download
memory/2976-256-0x000001EC1FE13000-0x000001EC1FE15000-memory.dmp

Filesize
8KB

Download
memory/2976-669-0x000001EC1FE18000-0x000001EC1FE19000-memory.dmp

Filesize
4KB

Download
memory/2976-232-0x000001EC1FE10000-0x000001EC1FE12000-memory.dmp

Filesize
8KB

Download
memory/3132-254-0x000001D631CD3000-0x000001D631CD5000-memory.dmp

Filesize
8KB

Download
memory/3132-516-0x000001D631CD6000-0x000001D631CD8000-memory.dmp

Filesize
8KB

Download
memory/3132-667-0x000001D631CD8000-0x000001D631CD9000-memory.dmp

Filesize
4KB

Download
memory/3132-230-0x000001D631CD0000-0x000001D631CD2000-memory.dmp

Filesize
8KB

Download
memory/3744-131-0x000001F064B40000-0x000001F064B42000-memory.dmp

Filesize
8KB

Download
memory/3744-127-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-120-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-121-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-122-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-133-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-123-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-125-0x000001F065530000-0x000001F065531000-memory.dmp

Filesize
4KB

Download
memory/3744-124-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-132-0x000001F064B43000-0x000001F064B45000-memory.dmp

Filesize
8KB

Download
memory/3744-154-0x000001F064B46000-0x000001F064B48000-memory.dmp

Filesize
8KB

Download
memory/3744-155-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-126-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-129-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/3744-128-0x000001F065660000-0x000001F065661000-memory.dmp

Filesize
4KB

Download
memory/3744-134-0x000001F04AAA0000-0x000001F04AAA2000-memory.dmp

Filesize
8KB

Download
memory/4144-644-0x0000000005113000-0x0000000005115000-memory.dmp

Filesize
8KB

Download
memory/4144-640-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4344-638-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/4344-643-0x0000000004E43000-0x0000000004E45000-memory.dmp

Filesize
8KB

Download
memory/5040-634-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/5040-645-0x0000000005513000-0x0000000005515000-memory.dmp

Filesize
8KB

Download