Analysis
-
max time kernel
145s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
16/03/2022, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe
-
Size
218KB
-
MD5
0c4a84b66832a08dccc42b478d9d5e1b
-
SHA1
160320b920a5ef22ac17b48146152ffbef60461f
-
SHA256
5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b
-
SHA512
56e4b07baca1c4c82e518088cc713b97eb2aa4e096d39bd7076396e075621bc47a20fd6a65fb897dc974d77c01f242a872532136d4bd3097a57c4664d8430872
Score
10/10
Malware Config
Extracted
Path
C:\Restore_My_Files.txt
Ransom Note
### What happened?
#### !!!Your files are encrypted!!!
*All your files are protected by strong encryption with RSA-2048.*
*There is no public decryption software.*
*We have successfully stolen your confidential document data, finances, emails, employee information, customers, research and development products...*
#### What is the price?
*The price depends on how fast you can write to us.*
*After payment, we will send you the decryption tool which will decrypt all your files.*
#### What should I do?
*There is only one way to get your files back -->>Contact us, pay and get decryption software.*
*If you decline payment, we will share your data files with the world.*
*You can browse your data breach here: http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion*
(you should download and install TOR browser first hxxps://torproject.org)
#### !!!Decryption Guaranteed!!!
*Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.*
#### !!!Contact us!!!
email:
[email protected]
#### !!!Warning!!!
*Do not attempt to decrypt your data using third-party software, this may result in permanent data loss.*
*Decrypting your files with the help of a third party may result in a price increase (they charge us a fee), or you may fall victim to a scam.*
*Don't try to delete programs or run antivirus tools. It won't work.*
*Attempting to self-decrypt the file will result in the loss of your data.*
Emails
URLs
http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion*
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\CompleteRevoke.tiff => C:\Users\Admin\Pictures\CompleteRevoke.tiff.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File renamed C:\Users\Admin\Pictures\EnterUnpublish.tif => C:\Users\Admin\Pictures\EnterUnpublish.tif.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File renamed C:\Users\Admin\Pictures\FindUnprotect.crw => C:\Users\Admin\Pictures\FindUnprotect.crw.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File renamed C:\Users\Admin\Pictures\InstallFind.tif => C:\Users\Admin\Pictures\InstallFind.tif.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File renamed C:\Users\Admin\Pictures\ProtectSuspend.tiff => C:\Users\Admin\Pictures\ProtectSuspend.tiff.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File renamed C:\Users\Admin\Pictures\RegisterImport.raw => C:\Users\Admin\Pictures\RegisterImport.raw.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened for modification C:\Users\Admin\Pictures\CompleteRevoke.tiff 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File renamed C:\Users\Admin\Pictures\ConfirmMount.crw => C:\Users\Admin\Pictures\ConfirmMount.crw.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File renamed C:\Users\Admin\Pictures\EnterUnregister.tif => C:\Users\Admin\Pictures\EnterUnregister.tif.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened for modification C:\Users\Admin\Pictures\ProtectSuspend.tiff 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File renamed C:\Users\Admin\Pictures\SplitGet.raw => C:\Users\Admin\Pictures\SplitGet.raw.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File renamed C:\Users\Admin\Pictures\UseConvertTo.png => C:\Users\Admin\Pictures\UseConvertTo.png.pandora 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\X: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\M: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\V: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\T: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\U: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\A: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\S: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\H: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\K: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\Z: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\B: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\W: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\E: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\R: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\F: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\G: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\J: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\N: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\Q: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\Y: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\I: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\O: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe File opened (read-only) \??\P: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{46B40EEB-FD7E-4CCF-AEFD-E23BEFE28559}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5F13E4A2-530D-4A41-AA77-1F4E7680FDEA}.catalogItem svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2768 vssadmin.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000073d8d503d83d4b781a4ff7bc9f55c0adcd31b27889fdf1f6a86e001d431acd5a000000000e8000000002000020000000dd5f46bcc3312a86e672c0ba0d962f1808d4d0040b163f80a6c0bb194f376eaa100d00007a6b57a21aa91fcc12c4ac622c5a925c6d0ba809e9710ab8b5415922d3aa63294e936a58854c7834d691fdfe94c01a7d1e92c41a3c393f5643d0072645c52770a114637955af0f328b9051937ddf37435aa4be5c9a61c2eff364e9387ef38104fe851d2c6fada319b1ffa7267252fbe04d49d0a7410085e7c2e62d3772b3c14baeead700a238c005401c2a85843078ec79ae521ab77758a4914b289f854151e56579605cf8edc0d23732fed785714fecd9cbcdff959bcd4255753f8c4a9282b208244d158cf3974eabfe3d2d7bcdbe9466d4efc6e50d16f548f4131148c88d8576b6c538eada9e87e6082df824207974deb8b5d6d2aacdbf0450f50c377701611a6b406ba04a2eb162cea83d4808048811513b82ea69719fb77560093e67979c0eeba3a92964864efc046c0a135ac599360fbdf7e4111c5a3b9793c934eb3fa692acb21e1c497daf2d13dc3a3a96be8e5416aecbbef53078fe1517dd9d3ca8d4139fb422e2900082c1f605bb6432136b29e74956718c6ad55337cca315f0c371e8afa291dba2eb18d5fdaaad909524e269e239b7b6e08e3b2c7eaad56da3db58d2cf792e4a88e956e9d9bafac183e6db233241ec195693d0c2afdeabff05072144f25c6902616a84d41a7cf3c12602ae12e80b96ae49e0cd9691f1e1b613c8a2fc20b2fccfcdca8f3fe4876706a90f5d9ddcbff45e2481f2cf0019a53a9a38cf67858adee0e5dc4e1befbcb78bf3bd9cf9503766891949e3fcf3c216ee647fcc965ab7b48475108f4fd67a6b7b8891fdb2b0f5e57a0754598fa21362e02b42f10cc0b62c2cf40cd7f2d5cd9e8345cf6099bf84223c6740367cd0379eb59b83a3a47fafecd1f90700c144fb570c82e02475a4cb5a0f7ef0d38ad4e4aa350bb10b77cc5a6e88d8269e9426261da8ab9ca1943f8b0cd5d6da8721f06f9ecccc1c87cdac66b9325baff0deb1408245c5b7a76b6dfd2e1d3aed137fc0bd8444c35326ea9c42049fdb674bc079aecfc1bcf0585f80f7ab72666d44bbc6e142ae501ab8f1e1b0b034996ad522fb879924f1e0487754d6cb2308108140c184728fc47faea2f7991f8916291e95c72561bb2ae4b20df0e287509a4735f6266563e5061f85e087d4cef3d85299fedf43241339994d33fc92e63b200d237b13b101ec5a382a47faf54673b1529a905236d8e249d64277dd21c5b77415e67d45915e8460f7c9b94806624e8b4239df3d87fcf2ad05e14b46b6ac9fc93bba43c93be2e9bc262ae93236aa9930a81ab37a77e740b24fec20f1e6615c2cb1fb54245881d238abed0279c9037ab67ddf552fdc3d474f5de8be61b7d876a04a8a9596b540c5d4c4ea2a931553d715b47fc4e8778c06f0755789a58f69199e490c7652d6a5152739384612f32526bf21fad373b86b79fdeef1737e92d1bd0deb4901b6e9ef7457b9372d98088ea055caccc4825dbdeca47c4a8a9143da08454645631f1a9b0611c62c828ca1b791fd73e60c5811b3e53051526cca9c16854e01f69a5f8dc4874fe8ee9e778cdfc0dcd2930a93e7518be4137b087d65799469d6134549630340db3750f64c0e044953fa9aca0c6c66bbe8ba34e61dad4783eb45ea57084ff103418feb701a2742d53503e62ddb2092f90c8226a7f79f089d91f82ff6271a61e181617d9dcffd7f360a292dd1d9f3bd5b4b75e960f61e310e65dacdd8ae58df3ab2f0f42569dd1396bf3adc03d2db856a3d8896ba7f2a64e726efb199cbc4be0eaa8557b8c8d292e7c513ce3651e58c119fc09763264704d9e0dd200c1b27a5bf50c602c4a26ca0b982bef1f69bbfd447f8781fcc1db75819b94e542f28486486ae0a3d5f26a7943d5035a3313752395afd822ce8024e165cdba1fad9bf4ec129813ce1d84e1d10b4af5fc41ff6590173dff4bd59b10c7401a6f9db13474eae1670b8f16b8ce22b2f54840f28204a61d07fd85ebdc6e3d664d093dbe062db3bd8cab6c9917b8b1ced1ab7bd287e7ad7757878b7ea3ee9b272bc5fb05b2d00248781fb40a41a1053c142f731f6cb049fdc18debe23d505da5d01543c4eb780dc8444e420ef32f3a8a4da939bb0858ea4d9d833cf50069854a54c9970f6c5f26b434a6d67e65a8f8561a2f621c03c52d0b55866d5d8e7171c98242241b5cbc360c79c70768c7d7002dfeae7e646b4c62abb78b1884e2353511dd3a2a8cd11c44513cf1bec58931f2b6770a35849c5e2f50ee6d301b08a8082fc596d63ee4a89fba7c59296bf37fb957258ae9ccaa98c4451b150ffa82312fcfd97ae5cad6c206c2cc25e5412f236b06bbe8da400a1f9b7646ef7667608a8e6814d599e5d65e6f610b69daeb160386ed6b35369cffd2d5601143e281a84eebb142fbcd048febfc15e587cd461284b526473ebe2fbf278861ad8f9b642cfae742cc8f2bb5767b2430bb7e59bf545e951ee5ce8a0baeefa9231a20619d4bf802bbe187a249f7daa1b1c0538f42441e802aa51c59e4f1a60063e2f64866c7a3c562eeff3e534066d0189175ecd17148a573027a062b09dcb94d705855c1a821b0773221d4586f76dd93544d89a3f9ff88eb830ace04fee3186c1cfee649b46f28f53c4a27aded75183b640a27c391c35cc41af84815fb4451e75001cf02dbe8834409fa38f67a2cace6b505520cb6819aba69bc5bed1c734d2da270415c4f621af7fdd77a5bd7cafbb2c6c638b242147af79e79ba22e23d2ddb57a5fdbea060f2afb72245d6b86d4f50c653a177c2cf78970e91a8367eac6c6fc5ae78bceb49a53c79e45c59651ef6c434ce8cb33a121a0880450c4e595ebb6f110b4162cf152dfb0ab4c964db03d9b2d5e43a991677cce95ee2c79324b622489b7eeb291fc2f41d3d48f83749c82b6d534f6e6bcd51ee3bde00a40550fb6852245f86562f8564032f150dcb9471abc9f19ed3878f86d30526e3552f14ad69b20239931a9937d9050b0b66615c61888a44865fce6570f3ea46d391f696c8c8d57b84ebe6ffa8109bdcfff187d11326f54ef953916b22a73adfaacfe3f42cfda1bfb7b9d50ca275337996792721cd2c3ecf1d982caa52a48e830e91eb020f72e119af1d054e2a6c32f25efd2c7007dd7c6d5fd8bea0780505e56317023c91951fa27303084257590160f938de0f5bfc8d57ab176a90d2e860b7d6ef31154a9dd0262ca6651060d14ed64786585e9004f404232d49df4a5c3c24b603f547bd550686c83f0552ba526542fa62770787b531c57fcffc41e1ad4771df9e5f53024ec84f3f111e4216f5e571d529c7235070e702d27bad28d88e88967a7c90d4af2ad1152578c56710cdf3b1149c0d02305d41d46457d5895648f205dd2dd504eef8c7496d604880645ef6af072770ba9c557b8f15f95b1cd88ca0ebc6694c28e53aacbbb4f1dfa59400651a0003fce129dfc59aab51fa73e735e0e63a20b730d622f7790fd14119ec2b9d1b74bf496e6ad3f5f6620e2173c6a1b891a76b9da9f6851527357fb11f4de26ef745c5114847c203502b73ca145d3e6e9b332d659efc38ad4fa66676f079db9b1d6c47cadd59b1bb47db9e8880a416f4affbcabc2efd524e586cb0ad4274c7045a746b447f031bd6ee83f6fd3296ec707669a36cabc7dd0c959e122991a2cad327625da58b352305403137c8b536e53ca843f829cd185718a92e54a48a694e4bb4a4400563b5ba1589d015310cc441fd2a7eb080ae760b50ca62f8e59699b89cb0da4d555d5041decc3b5a298783c3cffa9db7a9b53deb8e99020e2ce6159067409699987ed2a0afa22d0743128fbca583c235538e28672cff467bdd845912f3027343531f9f5602f6efdaee51ff27df4de13290ec8a87742ad44b4c812b6552e81801140355c09ee5df7ba1ff93183021d206f29598e1d891d9494b6e57985b153dd3b1d6689ef91c7cf8a8fabfec0c4ac62ef697862b601cfade729b03df40c3f4a67fc08517b96a4f446fd976f24be3037a2bacb3f798013a313ae4072cdb958e92f3663bf9bde82f51ccc36eadf614d38df3d1848bd24053cfc2635bae5ee2ac064014dce6eceed1de076fdb4c48f4c2ad7cbdb97c9bbb6b32888d6c3b90fef783f83fe25345b8db36e83c69948ed325e58882830084ebdc64280b4820efb3668cce696be306a3a8d95599e466bc2533d35a0bbf3fda92c0c016ad513a01d91dbb60eb2ec2f22415f1ce288079fa7a3a0b6dcf38540e550d0080820d1284ea13db70eb0150820af6d0475acb36263904fc474200fe8ed585417ad6bd8b9e58f747e34c4b5fc1ae7d5aaa9459bebf5bd4d638fb531cdf629f2099a8593c35841e1aaaf01a025cced43a25c57e9282928f4e30b4717ec1127c27e2d3f3c1e4e2184f28c00936c2146f913f0dfdec0d0ccd4e3ee3aa8b1b2bd8ac56d9b03427c6797c7aedae5d4484d3d4e4c229c29c5001ea2d293c030ba584aca89490e0ce2ab01aa0b827c3ff8e9829bba77f1439e8eed71f2ed7d6e7fc2914e2080f2fac23e78ad386ccf04e24ec7d5f788ab6bcb6209aba6184dc7f188b6fb7046cfe136daadff599437c9cd0bbc6467c0bda0777d328f6614026cb41e00fe9642850e0a7c2d06a2f23da10a38c67524f71a715fe4895b65479f9d1cec998d2a4e271efe158448083d5ef78f5ade17e30e4e04c03ec0093f076a08d54eff55713069dd98b7d4139208cfb81d96106d196665d31ea0a2cbb423d80d53a6caf9400000004f23b25168757ef8ef64fc8841eaea5e188a58dd7892cdbc02f78d66c0c8a0350114a0a5c1390047b10aab29eef1dbe40250a8c8e3e09ea5bee96e8aac55ef35 svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00188006A6A24272" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00188006A6A24272 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000e681911d2178823f1cbb79441c89d1f908cb633429f57062a5cb81f770b50388000000000e8000000002000020000000ff36fa4034e96be81efa35bb477ec763c02c222b4ec169b9717adb30de420cef80000000cf860b69564bb5fc229bed84ec2ff84d5f10912fc8217510a666fc85dd926da7b3a4ba8b9a6879478fd9a1ea2fa1d3ade4d635c35ec450562cf8bc37bf3824ddfb12d2e7757f4d451583890bc5916970c461386d652f3fe54180dfdf4f09fec1a9f95a2181ba0f2283325d81530fa6e2d5b470150ff8db355d4b344e336d316b400000005cb1f0bf475a8b004f80b15295212d868f2883b03039baec07f5a25291e475533f84e5e977b9730a95f121607ea2c49eeb375b7cc19fa13ff84934923252e66a svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe -
Opens file in notepad (likely ransom note) 6 IoCs
pid Process 4112 NOTEPAD.EXE 3188 NOTEPAD.EXE 5108 NOTEPAD.EXE 5076 NOTEPAD.EXE 3908 NOTEPAD.EXE 3040 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe Token: SeBackupPrivilege 4604 vssvc.exe Token: SeRestorePrivilege 4604 vssvc.exe Token: SeAuditPrivilege 4604 vssvc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5108 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3796 wrote to memory of 4176 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 87 PID 3796 wrote to memory of 4176 3796 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe 87 PID 4176 wrote to memory of 2768 4176 cmd.exe 89 PID 4176 wrote to memory of 2768 4176 cmd.exe 89
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3296
-
C:\Users\Admin\AppData\Local\Temp\5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe"C:\Users\Admin\AppData\Local\Temp\5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2768
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:1288
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4112
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3188
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:5108
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt1⤵
- Opens file in notepad (likely ransom note)
PID:5076
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3908
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore_My_Files.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3040